A financial firm runs voice over dual internet and MPLS tunnels and needs sub-second detection of brownouts plus continuous measurement of loss, latency and jitter for SLA steering. Probes must run on every tunnel without user traffic. Which BFD on tunnels design should the engineer configure to feed path-quality measurement?

BFD runs automatically inside every IPsec tunnel between WAN Edges and cannot be disabled. Its hello packets are synthetic probes, so they measure each tunnel whether or not user traffic is flowing. The probes serve two jobs: the hello interval and multiplier set how fast a dead or browned-out tunnel is declared down (they can be tuned to sub-second values), and the loss, latency and jitter calculated from the same probes are averaged over the poll interval and compared with SLA classes in application-aware routing. Enabling fast BFD timers on each IPsec tunnel therefore gives both fast detection and continuous path-quality data. Treating BFD as up/down detection with SNMP polling for quality fails because the path-quality figures come from the BFD probes themselves, and SNMP polling would not feed SLA steering. Limiting the design to MPLS tunnels fails because the internet tunnels would go unmeasured, so voice could not be compared across both transports. Passive flow telemetry fails because it only sees live packets and goes blind during silence, while the requirement is probing without user traffic. In practice, check show sdwan bfd sessions on every tunnel and confirm the SLA loss, latency and jitter values update continuously for both internet and MPLS.