Multiple Hop EBGP

[Kamala Kannan Selvaraj]

We have Multiple Hop EBGP configured on our network with no BGP BFD or BGP dampening(Third party vendor <> ASR 9k ver 5.3.3). An engineer removed the static route by mistake. Ebgp session went down only after 1min and 22 sec. It also black holed traffic that's using the default route for 55 secs before traffic shifted to standby path. Why? I thought BGP next hop tracking should have kicked in and traffic should failed over within 5 secs. Can anyone explain why that did not happen? Below are the log messages seen on the router. 

Static route was removed  on ASR 9k at Wed Sep 14 17:39:36 2016

RP/0/RSP1/CPU0:Sep 14 17:39:37.863 UTC: ipv4_rib[1167]: %ROUTING-RIB-7-SERVER_ROUTING_DEPTH : Recursion loop looking up prefix x.x.x.x in Vrf: "default" Tbl: "default" Safi: "Unicast" added by bgp

RP/0/RSP0/CPU0:Sep 14 17:40:43.917 UTC: bgp[1059]: %ROUTING-BGP-3-NBR_NSR_DISABLED : NSR disabled on neighbor x.x.x.x due to 'ip-tcp' detected the 'warning' condition 'NSR is down because the retransmission threshold exceeded (probably because downstream RP is not healthy)'

RP/0/RSP0/CPU0:Sep 14 17:41:01.501 UTC: bgp[1059]: %ROUTING-BGP-5-ADJCHANGE : neighbor x.x.x.x Down - Peer closing down the session (VRF: default) (AS: 7922)

[AARON WEINTRAUB]

So BGP by default is a 180/60 timer.  That means that it will send keepalives every 60 seconds and if it doesn't get 3 back, it will tear down the session.  There is no way for a multi-hop BGP session to get any sort of "advance notice" of the static route going away unless you do some kind of object tracking jujitsu with something like http://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k_r4-2/system_management/command_reference/b_sysman_cr42asr9k/b_sysman_cr42asr9k_chapter_010010.html.

BGP next-hop tracking is different, read at:

http://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/routing/configuration/guide/rcasr9kbgp.html#wp1367594

Next hop becomes unreachable
•Next hop becomes reachable
•Fully recursed IGP metric to the next hop changes
•First hop IP address or first hop interface change
•Next hop becomes connected
•Next hop becomes unconnected
•Next hop becomes a local address
•Next hop becomes a nonlocal address

so you'd need to see if any of those things actually changed after that route was removed. Note I'm not sure how exactly the router classifies the next hop being unreachable or not.