Bidirectional Forwarding Detection (BFD) Management Information Base
Extracted elements (26)
Authentication-related objects (bfdSessAuthenticationType, bfdSessAuthenticationKeyID, bfdSessAuthenticationKey) are set to read-create rather than a higher restriction to support management of a single key ID at a time; the MIB explicitly notes that key rotation is not handled.
The MIB does not define a compliance requirement for systems implementing only BFD version 0, because BFD version 0 is primarily of historical interest compared to the widespread deployment of BFD version 1.
Full compliance (bfdModuleFullCompliance) requires bfdSessionGroup, bfdSessionReadOnlyGroup, bfdSessionPerfGroup, and bfdNotificationGroup. The bfdSessionPerfHCGroup (Counter64 objects) is mandatory only for systems supporting Counter64. DNS address type (dns(16)) is not allowed; ipv4z(3) is not required.
Read-only compliance (bfdModuleReadOnlyCompliance) allows monitoring without configuration. For bfdSessRowStatus, read-only compliance restricts the visible syntax to active(1) only, and write access is not required for any session configuration objects.
bfdSessIndexNext MUST NOT use the value zero as a valid index; zero indicates no entries are available for creation.
bfdSessReqMinEchoRxInterval value must be zero(0) if this is a multihop BFD session.
For a singleHop(1) session with GTSM protection enabled, bfdSessGTSMTTL SHOULD be set to the maximum TTL value allowed for a single hop (default 255).
For contiguous ranges of sessions transitioning to up(4) or down(2)/adminDown(1) at roughly the same time, the device SHOULD issue a single notification per contiguous range to minimize notification volume.
GTSM MUST be enabled on a singleHop(1) BFD session if no authentication is in use, as specified by bfdSessGTSM which defaults to true.
If an unsupported InetAddressType value is attempted in a SET operation on bfdSessSrcAddrType or bfdSessDstAddrType, the agent MUST return an inconsistentValue error.
The 32-bit performance counters (e.g., bfdSessPerfCtrlPktIn) MUST be equal to the least significant 32 bits of their corresponding Counter64 objects (e.g., bfdSessPerfCtrlPktInHC), following RFC 2863 rules.
The bfdSessIpMapTable SHOULD contain those BFD sessions that are of type 'IP'.
When bfdOperStatus is down(2), all entries in bfdSessTable MUST have their bfdSessOperStatus as down(2). When bfdOperStatus is adminDown(3), all entries MUST have bfdSessOperStatus as adminDown(3).
BFD notifications bfdSessUp and bfdSessDown are generated when contiguous ranges of session entries transition state, carrying two bfdSessDiag instances indicating the low and high index range. For a single session, both instances MUST be identical.
bfdSessAuthenticationType, bfdSessAuthenticationKeyID (range -1..255, where -1 means no key ID), and bfdSessAuthenticationKey together define BFD session authentication. Key update must be done atomically using a SET containing all affected objects in the same varBindList to avoid session drops.
The BFD-STD-MIB module (OID { mib-2 222 }) defines managed objects for configuring and monitoring BFD sessions per RFC 5880, RFC 5881, RFC 5883, and RFC 7130, covering BFD versions 0 and 1. The MIB is organized into bfdScalarObjects, bfdSessTable, bfdSessPerfTable, bfdSessDiscMapTable, and bfdSessIpMapTable.
The bfdSessDiscMapTable maps a local discriminator value (bfdSessDiscriminator) to the corresponding bfdSessIndex, providing a direct lookup from discriminator to session table entry.
The bfdSessionTable (bfdSessTable) contains per-session BFD state including discriminators, UDP ports, address information, timer intervals, authentication parameters, and operational status. Each entry is indexed by bfdSessIndex and supports row creation via RowStatus.
The bfdSessIpMapTable maps the tuple (bfdSessInterface, bfdSessSrcAddrType, bfdSessSrcAddr, bfdSessDstAddrType, bfdSessDstAddr) to a bfdSessIndex, and SHOULD contain only BFD sessions of type 'IP'.
The bfdSessPerfTable is an AUGMENT to bfdSessTable and provides per-session performance counters for BFD control and echo packets (in, out, drop), session up/down timestamps, and discontinuity tracking via bfdSessPerfDiscTime.
IANA assigned the OID { mib-2 222 } to bfdMIB, recorded in the 'SMI Network Management MGMT Codes' registry.
Deployment of SNMP versions prior to SNMPv3 is NOT RECOMMENDED. SNMPv3 with cryptographic security (authentication and privacy) is RECOMMENDED for protecting access to this MIB module.
Implementation SHOULD NOT allow changes to session-defining objects (bfdSessVersionNumber, bfdSessType, bfdSessDestinationUdpPort, bfdSessMultipointFlag, bfdSessInterface, bfdSessSrcAddrType, bfdSessSrcAddr, bfdSessDstAddrType, bfdSessDstAddr) when bfdSessState is up(4).
Implementations SHOULD disallow access to bfdSessAuthenticationType, bfdSessAuthenticationKeyID, and bfdSessAuthenticationKey as they hold BFD session security methods and keys and are highly sensitive.
Improper manipulation of bfdAdminStatus or bfdSessAdminStatus (setting to disabled, adminDown, or down) can cause significant disruption of connectivity, constituting a denial-of-service attack on portions of the Internet reachable via BFD peers.
bfdSessAdminStatus transitions control the BFD session state machine: enabled(1) starts the state machine with initial state down(2); disabled(2) stops it (may first transition to adminDown); adminDown(3) causes the state machine to transition to adminDown(1) and remain; down(4) causes transition to down(2) and remain.