The BGP Hold Timer Trap

Your BGP session establishes. Three minutes later it dies. Then it does it again. And again. The log says NOTIFICATION code 4 subcode 0. Hold Timer Expired.

Here is what happened. During the OPEN exchange, both sides negotiate the hold timer. The lower value wins. If router A offers 180 and router B offers 9, the negotiated hold timer is 9 seconds.

The KEEPALIVE interval is hold/3. So with a 9-second hold, the KEEPALIVE interval is 3 seconds. If either side sends its KEEPALIVE even slightly late, the hold timer fires and the session drops.

The math that matters

Router A: timers bgp 60 180
Router B: timers bgp 3 9

Negotiated hold = min(180, 9) = 9 seconds
KEEPALIVE interval = 9 / 3 = 3 seconds

With a 3-second KEEPALIVE interval, any scheduling delay, CPU spike, or slow queue causes a miss. The session flaps every three minutes because it takes that long for the reconnect + OPEN + negotiate cycle to complete before it fails again.

The fix

configure terminal
router bgp 65001
timers bgp 60 180
end

Both sides need to agree on sane timers. 60/180 is the Cisco default and works for most peerings. If you need faster detection, use BFD instead of aggressive BGP timers.

Try it yourself

Open Lab 03: The Hold Timer Trap in the RouterBaba simulator. The misconfigured timers are already in place. Fix them. Watch the session stabilize.