> Source: [sk162540](https://support.checkpoint.com/results/sk/sk162540)

# sk162540 - BGP fails to establish due to "unrecognized Graceful Restart Restart Flag" error

| Property | Value |
|----------|-------|
| Solution ID | sk162540 |
| Date Created | 2019-09-30 |
| Last Modified | 2021-01-13 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * BGP fails to establish after a peer fails or flaps.
* Check Point device returns a BGP error: "`unrecognized Graceful Restart Restart Flag`".
* Disabling graceful restart resolves the issue.
* A similar output to the one below can be seen in Wireshark or BGP trace as per [sk101399](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk101399).

  ```
  
  Sep 3 16:00:29.350467 BGP RECV 1.1.1.5+179 -> 1.1.1.1
  Sep 3 16:00:29.350467 BGP RECV message type 1 (Open) length 59
  
  Sep 3 16:00:29.350467 BGP RECV version 4 as 64555 holdtime 90 id 2.2.2.2
  
  Sep 3 16:00:29.350467 mp capability - afi=IPv4, safi=Unicast
  
  Sep 3 16:00:29.350467 cisco-route-refresh
  
  Sep 3 16:00:29.350467 route-refresh
  
  Sep 3 16:00:29.350467 graceful-restart
  
  Sep 3 16:00:29.350467 restart flag 4 time 120
  
  Sep 3 16:00:29.350467 unknown capability:cap 65, caplen 4
  
  Sep 3 16:00:29.350467
  
  Sep 3 16:00:29.350467 bgp_get_open(2699): peer 1.1.1.5 (External AS 64555) unrecognized Graceful Restart Restart Flag
  
  Sep 3 16:00:29.350467 NOTIFICATION sent to 1.1.1.5 (External AS 64555): code 2 (OpenMessageError) subcode 4 (unsupported option code) data
  
  Sep 3 16:00:29.350467 bgp_send: sending 21 bytes to 1.1.1.5 (External AS 64555)
  
  Sep 3 16:00:29.350467
  
  Sep 3 16:00:29.350467 BGP SEND 1.1.1.1 -> 1.1.1.5+179
  
  Sep 3 16:00:29.350467 BGP SEND message type 3 (Notification) length 21
  
  Sep 3 16:00:29.350467 BGP SEND Notification code 2 (OpenMessageError) subcode 4 (unsupported option code)
  
  Sep 3 16:00:29.350467
  
  Sep 3 16:00:29.350467 bgp_peer_close: closing peer 1.1.1.5 (External AS 64555), state is 4 (OpenSent)
  ```

## Cause

The peer device has sent a graceful restart with a subcode of 4. As per the [RFC](https://tools.ietf.org/html/rfc4724) (refer to page 4):

"The remaining bits are reserved and MUST be set to zero by the sender and ignored by the receiver."

Check Point does not accept values other than 0 or 8 (0000 or 1000).

## Solution

This problem was fixed. The fix is included in:

* **[Check Point R80.10](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk111841&partition=General&product=All%22)**

Check Point recommends to always upgrade to the most recent version.

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue in R77.30.   
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.   
For faster resolution and verification please collect [CPinfo](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) files from the Security Management and Security Gateways involved in the case.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content