Why IPsec VPN Phase 1 Fails with No Proposal Chosen in Main Mode
A network administrator configures an IPsec VPN between two FortiGates using IKEv1 main mode. The Phase 1 negotiation fails with the error 'no proposal chosen'. The administrator checks both sides and confirms the IKE version, encryption algorithm (AES256), authentication (SHA256), and Diffie-Hellman group (14) match. Which additional parameter is MOST likely mismatched?
Quick Answer
The answer is a mismatch in the local and remote identifiers. Even when IKE version, encryption (AES256), authentication (SHA256), and Diffie-Hellman group (14) are identical on both FortiGates, IKEv1 main mode requires the peer’s identity—typically the IP address or FQDN—to match what is configured as the remote ID on the opposite side. If the local ID on one FortiGate does not correspond to the remote ID expected by the other, the Phase 1 negotiation fails with the “no proposal chosen” error, because main mode exchanges identities before establishing a secure channel. On the Fortinet NSE 4 exam, this is a classic trap: candidates often verify only the cryptographic parameters and overlook the identity configuration, which is a separate field in the Phase 1 settings. A common memory tip is to think “main mode means main ID match”—if the IDs don’t align, the tunnel won’t form, regardless of perfect crypto alignment.
⚠ Common exam trap
Candidates often assume 'no proposal chosen' always means a cryptographic parameter mismatch (encryption, hash, DH group), but FortiGate (and other vendors) can also return this error when the identity payload does not match the expected peer ID, especially in IKEv1 main mode where identity is exchanged after the proposal is accepted.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Local and remote identifiers (local ID / remote ID)
In IKEv1 main mode, the Phase 1 negotiation includes an exchange of identity (ID) payloads after the Diffie-Hellman exchange. If the local or remote identifiers (local ID / remote ID) do not match what is expected on the peer, the FortiGate will reject the proposal with a 'no proposal chosen' error, even if all other Phase 1 parameters (encryption, authentication, DH group, IKE version) are identical. The pre-shared key is verified later in Phase 1 (during authentication), so a mismatch there would cause a different error (e.g., 'authentication failed'), not 'no proposal chosen'.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Pre-shared key
Why it's wrong here
A pre-shared key mismatch would typically result in a different error, such as 'authentication failed'.
- ✗
IKE version (IKEv2)
Why it's wrong here
The administrator confirmed IKE version matches (IKEv1).
- ✗
Phase 2 encryption algorithm
Why it's wrong here
Phase 1 negotiation occurs before Phase 2; the error is during Phase 1.
- ✓
Local and remote identifiers (local ID / remote ID)
Why this is correct
In main mode, identifiers are exchanged. A mismatch of local or remote ID can cause 'no proposal chosen'.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate administrator is configuring IPsec VPN between two sites. The Phase 1 negotiation fails with the error 'no proposal chosen'. Which two settings must match on both VPN peers?
medium- A.Pre-shared key and local ID
- B.Dead peer detection interval and retry count
- C.Remote gateway IP and Phase 2 selectors
- ✓ D.Encryption algorithm and authentication algorithm
Why D: The 'no proposal chosen' error during IPsec Phase 1 negotiation indicates that the two VPN peers cannot agree on a common set of security parameters for the IKE (Internet Key Exchange) SA. The encryption algorithm (e.g., AES-256, 3DES) and authentication algorithm (e.g., SHA-256, MD5) are mandatory components of the Phase 1 proposal; if they do not match on both peers, the IKE negotiation fails immediately.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.