BFD failover with HSRP

[MonkeyBear007]

I have Two ASR 1001 but failover for return path doesn't work
Works fine leaving from firewall to ISP 
Problem when ISP trying to find firewall
HSRP active R1 but Internet goes down by BFD
tracert says ISP to router 2 10.10.10.2 than die finding to firewall
HSRP say it's Router 1 10.10.10.1 is active router and try to try that path but Router 2 has another gi4 that 10.10.10.2 to reach 10.10.10.1.
is there way to use BFD to solve this or HSRP tracking on the interface to force R1 to fail the answer

R1 and R2 all the failover works except ISP to Firewall inside
int gi1 145.0.0.1/30
BFD failover
Gi4 10.10.10.1/29
HSRP standby 1 10.10.10.3

Router 2
int gi1 165.0.0.1/30
NO BFD failover
Gig4 10.10.10.2/29
HSRP standby 1 ip 10.10.10.3

Firewall 
gi1 10.10.10.3/29
Ip route 0.0.0.0 0.0.0.0 10.10.10.3

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/13768-hsrp-bgp.html

you need to do some modify in attribute 
check above link for more info 

MHM

[MonkeyBear007]

I was hoping to use BFD to trigger BGP failover which work
LAN HSRP I need to talk to BFD to trigger failover
I have done in HSP before but I was hoping in BFD

[MHM Cisco World]

check below

MHM

[MonkeyBear007]

Unless the interface goes down HSRP will not kick in and doesn't work with BFD
works good with IP ISA source by WAN interface 
I know BFD with BGP failover works well only if firewall is using BGP it's not it's using static route
Let BGP decide which is best path and not use HSRP

[MHM Cisco World]

check below

MHM

[MHM Cisco World]

[MonkeyBear007]

My local-pref and AS prepend is working and it perfer R1
unless R1 interface is shut down HSRP does go down. If i shutdown from ISP interface than R1 HSRP think it's up but BFD down
Most ISP do Router on stick and you connect layer 2 switch and usually never direct connect Router
HSRP doesn't work well BFD but BFD works great in BGP.
I know if bottom devices was router or firewall running BGP than i don't need HSRP and BGP will know the best path

[MonkeyBear007]

I was told it might be the same router so might be same Loopback address for the ISP 
Check out my config What I'm doing wrong than
Right BFD kill the BGP and withdrawal
IP SLA correct set the stand using standby ip address
I was hoping to not use IP SLA echo ping and just overfail with BFD
I don't think it was good idea to do BFD on second second

[Georg Pauwen]

Hello,

post the full running configs of both R1 and R2 (sh run)...

[MonkeyBear007]

R1
track 1 ip sla 1 reachability
csdb tcp synwait-time 30
csdb tcp idle-time 3600
csdb tcp finwait-time 5
csdb tcp reassembly max-memory 1024
csdb tcp reassembly max-queue-length 16
csdb udp idle-time 30
csdb icmp idle-time 10
csdb session max-session 65535
!
!
!

!
interface Loopback0
ip address 1.1.1.1 255.255.255.255
!

interface GigabitEthernet0/0
ip address 20.20.20.2 255.255.255.252
duplex auto
speed auto
bfd interval 999 min_rx 999 multiplier 5
!
interface GigabitEthernet0/1
DESC IBGP
ip address 172.16.1.1 255.255.255.252
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/2
DESC LAN
ip address 10.10.10.1 255.255.255.248
standby 1 ip 10.10.10.3
standby 1 priority 105
standby 1 preempt
standby 1 track 1 decrement 10
duplex auto
speed auto
!

router bgp 600
bgp router-id 1.1.1.11
bgp log-neighbor-changes
neighbor 20.20.20.1 remote-as 6059
neighbor 20.20.20.1 fall-over bfd
neighbor 2.2.2.2 remote-as 22877
neighbor 2.2.2.2 update-source Loopback0
!
address-family ipv4
network 10.10.0.0
network 1.1.1.1 mask 255.255.255.255
neighbor 20.20.20.1 activate
neighbor 20.20.20.1 soft-reconfiguration inbound
neighbor 2.2.2.2 activate
neighbor 2.2.2.2 next-hop-self
neighbor 2.2.2.2 soft-reconfiguration inbound
exit-address-family
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip route 10.10.0.0 255.255.0.0 Null0
ip route 10.10.0.0 255.255.0.0 10.10.10.3
ip route 2.2.2.2 255.255.255.255 172.16.1.2
!
ip sla auto discovery
ip sla 1
icmp-echo 20.20.20.1 source-interface GigabitEthernet0/0
threshold 100
timeout 500
frequency 5
ip sla schedule 1 life forever start-time now
!
nls resp-timeout 1
cpd cr-id 1
R1

**********************************************************************************

R2

!
!
csdb tcp synwait-time 30
csdb tcp idle-time 3600
csdb tcp finwait-time 5
csdb tcp reassembly max-memory 1024
csdb tcp reassembly max-queue-length 16
csdb udp idle-time 30
csdb icmp idle-time 10
csdb session max-session 65535
!

!
!
interface Loopback0
ip address 2.2.2.2 255.255.255.255
!
interface Embedded-Service-Engine0/0
no ip address
shutdown
!
interface GigabitEthernet0/0
ip address 30.30.30.2 255.255.255.252
duplex auto
speed auto
!
interface GigabitEthernet0/1
ip address 172.16.1.2 255.255.255.252
duplex auto
speed auto
media-type rj45
!
interface GigabitEthernet0/2
ip address 10.10.10.2 255.255.255.248
standby 1 ip 10.10.10.3
standby 1 preempt
duplex auto
speed auto
!
router bgp 600
bgp router-id 2.2.2.2
bgp log-neighbor-changes
neighbor 30.30.30.1 remote-as 6500
neighbor 1.1.1.1 remote-as 600
neighbor 1.1.1.1 update-source Loopback0
!
address-family ipv4
network 10.10.0.0
network 2.2.2.2 mask 255.255.255.255
neighbor 30.30.30.1 activate
neighbor 30.30.30.1 soft-reconfiguration inbound
neighbor 1.1.1.1 activate
neighbor 1.1.1.1 next-hop-self
neighbor 1.1.1.1 soft-reconfiguration inbound
exit-address-family
!
ip forward-protocol nd
!
no ip http server
no ip http secure-server
!
ip route 10.10.0.0 255.255.0.0 Null0
ip route 10.10.0.0 255.255.0.0 10.10.10.6
ip route 1.1.1.1 255.255.255.255 172.16.1.1

R2

[MHM Cisco World]

we have two sided in any HSRP 
one LAN other is WAN 
for LAN you use track 1 to detect path to 20.20.20.1 and down decrement the hsrp priority by 10 that OK 

for WAN ISP router have two identical path to 10.10.0.0, I share you link how you can force traffic to active router by prepend as path for standby ,
for WAN failover BFD making BGP more fast detect path issue, and withdrawal 10.10.0.0 from active since active reachable and it better to add BFD in ISP not in Active edge router, since ISP will withdrawal 10.10.0.0 not edge router.

MHM

[MonkeyBear007]

my local-pre and AS-prepend is already working as need it
BFD is running on ISP and Active router
my problem HSRP doesn't see when BFD fails
Only when I do by ping HSRP works fine.
I really want HSRP work with BFD without tracking ping

[MHM Cisco World]

you meaning HSRP working the HSRP change the status ?
if Yes then you need as I mention before 
track interface of track IP SLA 
or use BFD multi hop between the two WAN interface not between LAN interface  need to be between LAN between WAN not work

MHM

[MonkeyBear007]

I was told it might be the connecting same router so same loopack address so ebay mulit-hop is not a good idea
we are only trying to active and standby