NSE4 IKEv2 Phase 2 Traffic Selector Practice Question
An administrator configures a dial-up IPsec VPN with IKEv2 to allow remote users to connect. The Phase 1 is set to use certificate-based authentication (PKI). Users can establish Phase 1, but Phase 2 fails with 'no proposal chosen'. The administrator checks the Phase 2 proposal: AES256-SHA256, and the remote network is 10.0.0.0/8 (the corporate LAN). What is the MOST likely cause?
⚠ Common exam trap
The trap is that candidates often attribute Phase 2 failures to algorithm mismatches, but in IKEv2 dial-up VPNs, 'no proposal chosen' commonly results from an incorrect Phase 2 traffic selector. Specifically, the remote network (client subnet) on the server side must be set to 0.0.0.0/0 for dial-up clients, not the corporate LAN subnet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The remote network in Phase 2 is set to 10.0.0.0/8
The most likely cause is that the remote network (client subnet) in the Phase 2 configuration on the VPN gateway is set to 10.0.0.0/8 instead of the correct value (0.0.0.0/0) for dial-up clients. Since Phase 1 succeeds, authentication and encryption settings are correct. The 'no proposal chosen' error in Phase 2 indicates a traffic selector mismatch: the server expects the client's IP to be within the 10.0.0.0/8 range, but the client's actual IP typically falls outside that subnet. Therefore, the Phase 2 negotiation fails.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The remote network in Phase 2 is set to 10.0.0.0/8
Why this is correct
The remote network in Phase 2 should be 0.0.0.0/0 for dial-up, because the client's real IP is dynamic. Setting it to 10.0.0.0/8 means the FortiGate expects the client's IP to be in that range, which it is not.
- ✗
The remote network in Phase 2 is set to 0.0.0.0/0
Why it's wrong here
Setting the Phase 2 remote network to 0.0.0.0/0 is the correct configuration for a dial-up IPsec VPN, not the cause of the problem. Because the remote client's real IP is dynamic and unknown in advance, the traffic selector must match any source address. A specific subnet like 10.0.0.0/8 would cause the FortiGate to expect an address in that range, leading to a Phase 2 mismatch. Thus, this option is not a misconfiguration and cannot be the reason the VPN fails.
- ✗
The Phase 1 encryption algorithm is mismatched
Why it's wrong here
The Phase 1 encryption algorithm being mismatched is not the issue because the administrator is using IKEv2 and the dial-up tunnel successfully establishes the IKE security association (SA) during Phase 1. If the encryption algorithms differed, the IKE SA negotiation would fail immediately, preventing any further negotiation. Since Phase 1 is already successful, the encryption algorithms must match. Therefore, this cannot be the reason the VPN is not working.
- ✗
The authentication type requires EAP instead of certificate
Why it's wrong here
For IKEv2 dial-up VPNs, certificate authentication is fully valid and does not require EAP (Extensible Authentication Protocol). The successful Phase 1 negotiation confirms that the authentication method and credentials are acceptable to both peers. EAP would only be necessary if the peer were configured to use it exclusively, but that is not a requirement for certificate-based authentication. Since the Phase 1 is up, the authentication method is not the source of the Phase 2 failure.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.