A data center edge must survive a brief SD-WAN Controller outage and software upgrade without dropping existing overlay data flows. Which OMP graceful restart and timer behavior preserves forwarding during short control-plane interruptions?

The correct behavior works because OMP graceful restart explicitly decouples control-plane peering loss from data-plane forwarding, letting the edge retain installed OMP routes and TLOC forwarding state for the negotiated grace period while controllers restart or upgrade, then resynchronize without churn if adjacency returns in time. Shortening hold timers for rapid relearn is legitimate tuning for fast convergence, but conceptually it fails here because minimizing hold time forces premature expiration and withdrawal of still-valid routes during a brief interruption, causing the drops the scenario forbids. BFD-based rapid failover is widely deployed to detect transport failure and shift traffic to an alternate path quickly, but conceptually it solves path liveness rather than retention of control-plane routing state, so it cannot preserve existing flows when the controller is merely unreachable and keeping routes is required. Extended OMP route dampening is commonly used to suppress flapping advertisements and stabilize upgrades, but conceptually it penalizes and withholds routes instead of retaining them, which reduces availability across the upgrade window rather than bridging it. As an exam caveat, separate retention mechanisms with bounded timers from detection-removal mechanisms, since a stem emphasizing upgrade plus no loss signals preservation, not faster teardown. As a practical check, verify graceful restart is enabled on peers, confirm grace-period values, and test with a controlled controller restart while monitoring traffic continuity and OMP route age.