IPsec VPN No Proposal Chosen: Phase 1 Mismatch Causes
A FortiGate admin is troubleshooting an IPsec VPN that fails to establish. The output of 'diagnose debug application ike -1' shows: 'IKE: No proposal chosen from x.x.x.x'. The admin checks the Phase1 configuration. Which of the following mismatches could cause this error? (Choose three.)
Quick Answer
The answer is encryption algorithm mismatch, authentication mismatch, or Diffie-Hellman group mismatch. These three settings define the Phase 1 proposal, and when the local FortiGate and the remote peer do not share at least one common combination of these parameters, the IKE negotiation fails with the “no proposal chosen” error. On the Fortinet NSE 4 Network Security Professional NSE4 exam, this question tests your ability to distinguish Phase 1 proposal mismatches from other configuration errors; a common trap is selecting “lifetime mismatch,” which actually causes a different IKE error (like “responder lifetime mismatch”) rather than a proposal rejection. To remember the three correct causes, use the mnemonic “EAD” — Encryption, Authentication, and Diffie-Hellman group — since these are the core components of any IKE Phase 1 proposal that must match exactly for the tunnel to establish.
⚠ Common exam trap
Watch out — candidates often confuse Phase 1 proposal mismatches (which cause 'No proposal chosen') with Phase 1 authentication failures (caused by PSK mismatch), leading them to incorrectly select the pre-shared key option.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Diffie-Hellman group mismatch (e.g., group 2 vs group 14)
The 'No proposal chosen' error indicates that the IKE SA parameters proposed by the initiator do not match any configured proposal on the responder. Since the error occurs during Phase 1, mismatches in mandatory parameters like Diffie-Hellman group, authentication method (hash algorithm), and encryption algorithm will directly cause this failure, as these are negotiated as part of the SA payload.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Diffie-Hellman group mismatch (e.g., group 2 vs group 14)
Why this is correct
DH group is also part of the proposal.
- ✗
Pre-shared key mismatch
Why it's wrong here
PSK mismatch causes authentication failure, not proposal mismatch.
- ✗
Lifetime mismatch (e.g., 86400 vs 3600)
Why it's wrong here
Lifetime mismatch typically results in negotiation succeeding but rekey issues.
- ✓
Authentication method mismatch (e.g., SHA1 vs SHA256)
Why this is correct
Hash algorithm is part of Phase1 proposal.
- ✓
Encryption algorithm mismatch (e.g., AES128 vs AES256)
Why this is correct
The encryption algorithm is part of the proposal; mismatch causes no common proposal.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate admin is troubleshooting an IPsec VPN tunnel that fails to establish. The remote site uses aggressive mode. The local FortiGate is configured for main mode. The admin sees 'no proposal chosen' in the IKE debug. What is the MOST likely cause?
medium- A.The pre-shared key is incorrect
- ✓ B.The IKE mode (main vs aggressive) does not match between peers
- C.The local firewall is blocking UDP port 500
- D.The Phase 2 encryption algorithm is not supported
Why B: The 'no proposal chosen' error in IKE debug indicates a mismatch in the IKE parameters proposed by the peers. Since the remote site uses aggressive mode and the local FortiGate is configured for main mode, the IKE mode mismatch prevents the peers from agreeing on a proposal. IKE main mode and aggressive mode use different packet formats and exchange sequences, so they cannot negotiate a common proposal even if all other parameters match.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.