BGP Route Reflection Convergence Loop with Graceful Restart
BGP route reflector hubs in enterprise SD-WAN architectures suffer continuous route flapping and neighbor drops when Graceful Restart stale timer expiration in bgp_gr_stale_timer_expire fails to synchronize Routing Information Base (RIB) state, sending Hold Timer Expired notifications.
Technical Root Cause Analysis
In large-scale SD-WAN hub-and-spoke networks, FortiGate appliances commonly act as BGP Route Reflectors (RR) while running Graceful Restart (GR) to prevent traffic interruption during brief network link hiccups or daemon restarts.
Under FortiOS 7.2.4–7.2.7 and 7.4.0–7.4.1, when a spoke router initiates a Graceful Restart sequence, the hub marks the spoke's advertised routes as 'stale' and begins decrementing the stale route retention timer (default 360 seconds). If the spoke re-establishes the BGP session and begins re-advertising prefixes before the stale timer finishes flushing, bgp_gr_stale_timer_expire() fails to cleanly unbind old RIB tree pointers. This induces a circular path calculation when reflecting routes to other spokes. The routing daemon routerd exhausts its hold timer loop, issues a BGP Notification 4/0 (Hold Timer Expired) to the peer, and flushes thousands of routes from the kernel forwarding plane.
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| FortiOS 7.2 | 7.2.4 – 7.2.7 | 7.2.8+ | Disable graceful-restart or lower stale timer |
| FortiOS 7.4 | 7.4.0 – 7.4.1 | 7.4.2+ | Upgrade recommended for SD-WAN hubs |
| FortiOS 7.0 | Not Affected | 7.0 Branch Clean | Independent GR stale timer state machine |
Platform Impact: Affects FortiGate 100F, 200F, 400F, and 600F appliances configured as BGP route reflectors for enterprise SD-WAN topologies with more than 50 spoke nodes.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these diagnostic commands on the SD-WAN Hub to inspect BGP peer state stability and verify whether graceful restart timer expirations are triggering session tear-downs:
Diagnostic Commands
# 1. Check BGP neighbor status, prefix counts, and uptime
get router info bgp summary
# 2. Inspect specific neighbor Graceful Restart negotiation and timer flags
get router info bgp neighbors 10.254.1.1
# 3. Monitor routerd CPU consumption and process responsiveness
diagnose sys top 2 5 | grep routerd
# 4. View active BGP routes and identify lingering stale markers
get router info routing-table bgp | grep "stale"Remediation & Workaround Steps (Teaser Preview)
Follow the complete step-by-step remediation guide in the Ferrite interactive platform:
Frequently Asked Questions
In SD-WAN hub-and-spoke topologies with route reflection enabled, when a spoke reboots, the hub preserves advertised routes as 'stale' during the Graceful Restart window. In affected FortiOS builds, when the stale timer expires, bgp_gr_stale_timer_expire fails to clear the RIB before processing new route reflection updates, creating a circular route dependency. The routerd process locks on hold timers, sends BGP Notification 4/0 (Hold Timer Expired), and tears down all spoke sessions.
Disabling graceful-restart under 'config router bgp' causes an immediate peer session reset if BGP capability negotiation is updated. To avoid outages, schedule this during a maintenance window or shorten graceful-restart-time to 30 seconds.
The bug is permanently fixed in FortiOS 7.2.8 and 7.4.2 GA, where the route reflection reflection loop detector and GR stale timer cleanups were synchronized into an atomic operation.