> Source: [sk93633](https://support.checkpoint.com/results/sk/sk93633)

# sk93633 - BGP peer flapping

| Property | Value |
|----------|-------|
| Solution ID | sk93633 |
| Date Created | 2013-07-21 |
| Last Modified | 2015-09-01 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * BGP peer is flapping.

* */var/log/routing_messages* file shows the following messages:  

  `bgp_event: peer X.X.X.X (External AS ...) old state Established event RecvNotify new state Idlebgp_event: peer X.X.X.X (External AS ...) old state OpenConfirm event RecvKeepAlive new state Established`

* BGP routes from peer neighbor are down.

## Cause

According to BGP version 4 protocol specification, [RFC 4271](https://www.ietf.org/rfc/rfc4271.txt), a NOTIFICATION message is sent when an error condition is detected. The BGP connection is closed immediately in such event.

The peer will be re-established once a keep alive message is received from BGP neighbor.

The NOTIFICATION message, in addition to the fixed size BGP header, will contain fields with error data:

```
+-+-+-+-+-+-+-+--+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
| Error code | Error subcode | Data (variable) |
+-+-+-+-+-+-+-+--+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
```

Possible Error Codes and their Symbolic Names:

* 1 - Message Header Error
* 2 - OPEN Message Error
* 3 - UPDATE Message Error
* 4 - Hold Timer Expired
* 5 - Finite State Machine Error
* 6 - Cease

Traffic capture is recommended in order to see the exact error of BGP neighbor.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content