Technical Tip: Explanation of 'set ignore-optional-capability' in BGP

During BGP session establishment (OPEN message exchange), each peer advertises optional capabilities (e.g., route-refresh, graceful-restart, multiprotocol extensions, 4-byte AS, additional-paths, vendor-specific capabilities, etc.).

According to RFC 4271, if a BGP speaker receives an unknown optional capability that it does not support, it must send a Notification message (Error Code 2, Subcode 4 – Unsupported Optional Parameter) and tear down the session.

When set ignore-optional-capability enable (default), FortiGate silently ignores any unknown optional capabilities instead of sending the Notification. The session continues to establish (ESTABLISHED state), and only the capabilities that both sides understand are used.

When set to disable, FortiGate follows strict RFC behavior: it rejects unknown capabilities with a notification.

• BGP neighbor stays in 'Active' or 'Connect' state indefinitely. Refer to the article to understand BGP states: Technical Tip: BGP neighbor adjacency states.
• Logs: BGP: %BGP-3-NOTIFICATION: sent to neighbor X.X.X.X 2/4 (Unsupported optional parameter).
• Session repeatedly flaps right after the open message exchange.

BGP debug logs can be checked to find BGP notification messages.

Debug commands to check the BGP debug logs on FortiGate:

diagnose ip router bgp all enable
diagnose ip router bgp level info
diagnose debug console timestamp enable
diagnose ip router bgp set-filter neighbor a.b.c.d  <----- a.b.c.d is replaced with BPG neighbor address.
diagnose debug enable

To disable the BGP debugging, the following commands are used:

diagnose ip router bgp all disable
diagnose ip router bgp level none
diagnose debug reset
diagnose debug disable

Configuration:

config router bgp

    set as 65001

    set router-id 192.0.2.1

    set ignore-optional-capability enable

        config neighbor

            edit "10.0.0.2"

                set remote-as 65002

            next

        end

    end

Verification commands:

get router bgp | grep ignore-optional-capability
show router bgp | grep ignore-optional-capability
diagnose bgp neighbor <ip> summary