> Source: [sk185071](https://support.checkpoint.com/results/sk/sk185071)

# sk185071 - BGP stuck in active state after enabling graceful restart when the peer is Juniper

| Property | Value |
|----------|-------|
| Solution ID | sk185071 |
| Date Created | 2026-06-18 |
| Last Modified | 2026-06-29 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * BGP stuck in Active state after enabling GR
* show bgp peer detailed shows Peer capabilities as N/a and our capabilities as unicast, below that same output we receive "UpdateMessageError - error with optional attributes"

## Cause

**From Checkpoint**   
\> show bgp peer \<IP\> detailed

State Active  
Peer Type eBGP Peer  
Remote AS 4755  
Local AS 2,401 (131473)  
**Peer Capabilities n/a**   
**Our Capabilities IPv4 Unicast, Graceful Restart, 4-Byte AS Extension**   
Authentication None  
Multihop Off  
Reachability Detection Off  
Graceful Restart Off (Not configured by remote peer)  
Received  
IPv4 Routes 0 (0 active)  
IPv6 Routes 0 (0 active)  
Notifications  
**Jun 3 12:40:39 UpdateMessageError - error with optional attribute**   
**Jun 3 12:40:07 UpdateMessageError - error with optional attribute**   
Jun 3 12:39:35 UpdateMessageError - error with optional attribute  

PCAP update message from Checkpoint  

Optional Parameters  
\> Optional Parameter: Capability  
v Optional Parameter: Capability  
Parameter Type: Capability (2)  
Parameter Length: 8  
v Capability: Graceful Restart capability  
Type: Graceful Restart capability (64)  
Length: 6  
v Restart Timers: 0x0168  
0... .... .... .... = Restart State: No  
.0.. .... .... .... = Graceful Notification: No  
.... 0001 0110 1000 = Time: 360  
AFI: IPv4 (1)  
**SAFI: Unicast (1)**   
v Flag: 0x80, Preserve forwarding state  
1... .... = Preserve forwarding state: Yes  

**From Juniper:**   

Optional Parameters  
\> Optional Parameter: Capability  
\> Optional Parameter: Capability  
\> Optional Parameter: Capability  
v Optional Parameter: Capability  
Parameter Type: Capability (2)  
Parameter Length: 12  
v Capability: Graceful Restart capability  
Type: Graceful Restart capability (64)  
Length: 10  
v Restart Timers: 0x4078, Graceful notification  
0... .... .... .... = Restart State: No  
.1.. .... .... .... = Graceful Notification: Yes  
.... 0111 1000 1000 = Time: 120  
AFI: IPv4 (1)  
**SAFI: Unicast (1)**   
v Flag: 0x80, Preserve forwarding state  
1... .... = Preserve forwarding state: Yes  
AFI: IPv4 (1)  
**SAFI: Multicast (2)**   

Juniper rejects the UPDATE message sent by Check Point because Check Point sends an MP_UNREACH_NLRI End-of-RIB marker for AFI=IPv4 SAFI=Multicast, but IPv4 Multicast capability does not appear to have been negotiated in the BGP OPEN exchange. As a result Juniper treats the attribute as invalid and generates NOTIFICATION "UPDATE Message Error / Optional Attribute Error (9)".  

Juniper will reject with Notification message:  

Border Gateway Protocol - NOTIFICATION Message  
Marker: ffffffffffffffffffffffffffffffff  
Length: 21  
Type: NOTIFICATION Message (3)  
**Major error Code: UPDATE Message Error (3)**   
Minor error Code (Update Message): Optional Attribute Error (9)  

The session resets were caused by a mismatch in BGP multiprotocol capabilities. The Juniper router is advertising support for **both IPv4 unicast and multicast** , while the Check Point only supports IPv4 unicast.  

During operation, Check Point sent an update related to IPv4 multicast, which is not properly negotiated between the peers in open messages. Juniper treated this as a protocol violation and reset the session.  

Check Point support BGP Multiprotocol Capabilities for IPv4 Unicast, for reference check R81.20 Gaia Advanced Routing Administration Guide:-  

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Gaia_Advanced_Routing_AdminGuide/Content/Topics-GARG/BGP-Configuring-in-Gaia-Portal-BGP-Remote-Peers.htm?tocpath=BGP%7CConfiguring%20BGP%20in%20Gaia%20Portal%7C_____4

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content