diff --git a/bridge/src/main/kotlin/net/corda/bridge/services/config/FirewallConfigurationImpl.kt b/bridge/src/main/kotlin/net/corda/bridge/services/config/FirewallConfigurationImpl.kt
index 5aec4fe745..9e731b1160 100644
--- a/bridge/src/main/kotlin/net/corda/bridge/services/config/FirewallConfigurationImpl.kt
+++ b/bridge/src/main/kotlin/net/corda/bridge/services/config/FirewallConfigurationImpl.kt
@@ -1,6 +1,7 @@
 package net.corda.bridge.services.config
 
 import com.typesafe.config.Config
+import com.typesafe.config.ConfigException
 import com.typesafe.config.ConfigRenderOptions
 import net.corda.bridge.FirewallCmdLineOptions
 import net.corda.bridge.services.api.*
@@ -17,6 +18,8 @@ fun Config.parseAsFirewallConfiguration(): FirewallConfiguration {
         parseAs<FirewallConfigurationImpl>()
     } catch (ex: UnknownConfigurationKeysException) {
 
+        FirewallCmdLineOptions.logger.info("Attempting to parse using old format")
+
         // Previously `proxyConfig` was known as `socksProxyConfig`
         data class Version3BridgeOutboundConfigurationImpl(val artemisBrokerAddress: NetworkHostAndPort,
                                                    val alternateArtemisBrokerAddresses: List<NetworkHostAndPort>,
@@ -80,14 +83,20 @@ fun Config.parseAsFirewallConfiguration(): FirewallConfiguration {
             }
         }
 
-        // Note: "Ignore" is needed to disregard any default properties from "firewalldefault.conf" that are not applicable to V3 configuration
-        val oldStyleConfig = parseAs<Version3BridgeConfigurationImpl>(UnknownConfigKeysPolicy.IGNORE::handle)
-        val newStyleConfig = oldStyleConfig.toConfig()
 
-        val configAsString = newStyleConfig.toConfig().root().render(ConfigRenderOptions.defaults())
-        FirewallCmdLineOptions.logger.warn("Old style config used. To avoid seeing this warning in the future, please upgrade to new style. " +
-                "New style config will look as follows:\n$configAsString")
-        newStyleConfig
+        try {
+            // Note: "Ignore" is needed to disregard any default properties from "firewalldefault.conf" that are not applicable to V3 configuration
+            val oldStyleConfig = parseAs<Version3BridgeConfigurationImpl>(UnknownConfigKeysPolicy.IGNORE::handle)
+            val newStyleConfig = oldStyleConfig.toConfig()
+
+            val configAsString = newStyleConfig.toConfig().root().render(ConfigRenderOptions.defaults())
+            FirewallCmdLineOptions.logger.warn("Old style config used. To avoid seeing this warning in the future, please upgrade to new style. " +
+                    "New style config will look as follows:\n$configAsString")
+            newStyleConfig
+        } catch (oldFormatEx: ConfigException) {
+            FirewallCmdLineOptions.logger.error("Old format parsing failed as well.")
+            throw ex
+        }
     }
 }
 
diff --git a/bridge/src/test/kotlin/net/corda/bridge/ConfigTest.kt b/bridge/src/test/kotlin/net/corda/bridge/ConfigTest.kt
index c37fd22113..5533634a2c 100644
--- a/bridge/src/test/kotlin/net/corda/bridge/ConfigTest.kt
+++ b/bridge/src/test/kotlin/net/corda/bridge/ConfigTest.kt
@@ -5,8 +5,10 @@ import net.corda.bridge.services.api.FirewallMode
 import net.corda.core.identity.CordaX500Name
 import net.corda.core.internal.div
 import net.corda.core.utilities.NetworkHostAndPort
+import net.corda.nodeapi.internal.config.UnknownConfigurationKeysException
 import net.corda.nodeapi.internal.protonwrapper.netty.ProxyVersion
 import net.corda.testing.core.SerializationEnvironmentRule
+import org.assertj.core.api.Assertions
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertNull
 import org.junit.Rule
@@ -174,4 +176,13 @@ class ConfigTest {
         assertEquals("proxyUser", config.outboundConfig!!.proxyConfig!!.userName)
         assertEquals("pwd", config.outboundConfig!!.proxyConfig!!.password)
     }
+
+    @Test
+    fun `Load invalid option config`() {
+        val configResource = "/net/corda/bridge/invalidoption/firewall.conf"
+
+        Assertions.assertThatThrownBy { createAndLoadConfigFromResource(tempFolder.root.toPath(), configResource) }
+                .isInstanceOf(UnknownConfigurationKeysException::class.java)
+                .hasMessageContaining("invalidOption")
+    }
 }
\ No newline at end of file
diff --git a/bridge/src/test/resources/net/corda/bridge/invalidoption/firewall.conf b/bridge/src/test/resources/net/corda/bridge/invalidoption/firewall.conf
new file mode 100644
index 0000000000..cdf35fa1d2
--- /dev/null
+++ b/bridge/src/test/resources/net/corda/bridge/invalidoption/firewall.conf
@@ -0,0 +1,19 @@
+firewallMode = SenderReceiver
+outboundConfig : {
+    artemisBrokerAddress = "localhost:11005"
+    proxyConfig : {
+        version = SOCKS5
+        proxyAddress = "localhost:12345"
+        userName = "proxyUser"
+        password = "pwd"
+    }
+}
+
+invalidOption = "fooBar"
+
+inboundConfig : {
+    listeningAddress = "0.0.0.0:10005"
+}
+networkParametersPath = network-parameters
+
+healthCheckPhrase = "ISpeakAMQP!"
\ No newline at end of file