On SRX platforms configured for CGNAT, committing NAT pool configuration changes involving large address ranges may result in transient BFD and BGP flaps. The issue is typically observed during NAT pool programming when aggressive BFD timers are configured.

-BFD sessions flap immediately after committing NAT pool configuration changes.

-BGP sessions reset due to BFD Down events.

-Issue is observed when configuring large NAT pool ranges (for example, /19, /20, /21).

-Smaller NAT pool ranges (for example, /24 or smaller) do not exhibit the issue.

-BFD sessions typically recover automatically after the event.

-PFE logs may report scheduler warnings indicating extended processing by the PFE Manager thread.

Example NAT Pool Configuration Triggering the Issue:

[edit security nat source pool NP-PBA-N44 address]

user@srx# set x.x.x.x/19

user@srx# commit

commit complete

Where x.x.x.x represents the NAT pool address being configured. 

PFE Scheduler Messages Observed During Commit

edit security nat source pool NP-PBA-N44 address]

user@srx# exit

[edit]

user@srx# commit    

Message from syslogd@srx at May 27 03:31:50.472 2026 ...

srx fpc0 SCHED: Thread 65 (PFE Manager) ran for 1297 ms without yielding

Message from syslogd@srx at May 27 03:31:50.472 2026 ...

srx fpc0 Scheduler Oinker

Message from syslogd@srx at May 27 03:31:50.473 2026 ...

srx fpc0 Frame 0: sp = 0x4ea98e50, pc = 0x583ceb

Immediately after the commit, the following events were observed:

- BGP NOTIFICATION received with subcode indicating BFD Down.

- BFD session transitioned from UP -> DOWN with reason: “Received DOWN from PEER”.

- BFD session automatically recovered and transitioned back to UP state.

Conditions:

• SRX configured for CGNAT
• BFD enabled toward directly connected peers
• NAT pool configuration changes involving large address ranges
• Aggressive BFD timers configured (for example, 300 ms × 4 multiplier)

Cause:

Large NAT pool updates can temporarily increase PFE processing time during commit operations. Under aggressive BFD timer settings, the transient processing delay can impact BFD packet handling, causing BFD detection timers to expire and resulting in temporary BFD and BGP session flaps.

Verify BFD session status:

show bfd session

show log messages | match bfd

show log messages | match BGP

Upgrade to a Junos OS release containing the fix:

• 25.4R2
• 26.2R2
• 26.3R1

Workaround:

If an upgrade is not immediately possible:

• Use less aggressive BFD timers where operationally acceptable.
• Avoid committing large NAT pool changes during production hours.
• Consider staging large NAT pool updates during maintenance windows.

Note:

• Observed with large NAT pool configurations used in CGNAT deployments
• BFD flaps are transient and typically recover automatically after NAT programming completes