topic How to Configure BFD on FTD Firewall using FMC in Network Security

How to Configure BFD on FTD Firewall using FMC

ronbuchalski — Mon, 17 Oct 2022 22:36:34 GMT

I have an HA pair of FTD 2140 firewalls, running 7.0.1. They are managed by an FMC running 7.0.4. The firewall is running BGP with its upstream and downstream neighbors. I would like to enable BFD between the HA firewall and the upstream and downstream neighbors, to improve fault detection and BGP failover/convergence.

I see where to enable BFD for each BGP neighbor, but there is a note next to the check box that says a FlexConfig is required in order to use BFD. I have searched and have found no information on how to configure a FlexConfig to enable BFD.

Any help is appreciated.

Re: How to Configure BFD on FTD Firewall using FMC

balaji.bandi — Tue, 18 Oct 2022 07:18:38 GMT

Never used BFD in FTD, not sure below link help you..but check the below bug:

https://bst.cisco.com/bugsearch/bug/CSCvi56636

Re: How to Configure BFD on FTD Firewall using FMC

ronbuchalski — Tue, 18 Oct 2022 16:32:55 GMT

It looks like that feature request may actually be what added the checkbox in FMC web GUI, under BGP Neighbor configuration, to enable BFD. But that's where it says that FlexConfig is used to actually configure BFD on the FTD, and then the checkbox is what links BFD to BGP.

So, I still need some help on configuring FlexConfig to make the BFD configuration on the FTD.

Re: How to Configure BFD on FTD Firewall using FMC

tebogo.pholo1 — Wed, 16 Nov 2022 21:26:54 GMT

Here are the configs i applied on the FMC under Objects - Flexconfig object

bfd-template single-hop TEMPLATE1
interval both 300 multiplier 3
echo

interface Port-channel3.858 (Interface facing BGP peer)
bfd template TEMPLATE1

Once done attach them to your firewall under device flexconfig and enable BFD on BGP.

Deploy the configs and all will be fine

Re: How to Configure BFD on FTD Firewall using FMC

ronbuchalski — Thu, 17 Nov 2022 22:28:44 GMT

Thank you for that information. I ended up opening a case with Cisco TAC, and they provided the same response that you did. We implemented it and it is working great.