IPsec VPN Phase 1 Proposal Mismatch: How to Fix 'No Acceptable Proposal'
An administrator is troubleshooting an IPsec VPN tunnel that fails to establish. The Phase 1 status shows 'init' and the debug output indicates 'no suitable proposal found'. The remote peer is a third-party VPN device. Which of the following is the MOST likely cause?
⚠ Common exam trap
Many candidates confuse 'no suitable proposal' with a pre-shared key mismatch, but the error occurs earlier in the IKE exchange before authentication begins, so it must be a proposal parameter mismatch.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The IKE version or encryption algorithm does not match between the peers
The 'no suitable proposal found' error in Phase 1 indicates that the IKE proposal parameters (such as encryption algorithm, hash algorithm, Diffie-Hellman group, or IKE version) do not match between the FortiGate and the third-party peer. Since the status is 'init', the peers have exchanged initial packets but cannot agree on a common proposal, which is a classic proposal mismatch issue. A pre-shared key mismatch would typically cause an authentication failure later in Phase 1, not a 'no suitable proposal' error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The pre-shared key is incorrect on one side
Why it's wrong here
A mismatched pre-shared key fails Phase 1 authentication after proposals are accepted, producing an authentication error rather than 'no suitable proposal found'. It is tempting because PSK mismatches are a common VPN fault, and would be correct if debug showed proposal negotiation succeeding then failing at authentication.
- ✗
The remote peer's IP address is not reachable
Why it's wrong here
Unreachable peer addresses produce Phase 1 timeouts, not a proposal mismatch; 'no suitable proposal found' means encryption, hash, authentication or DH group settings differ. It tempts because reachability is checked first in troubleshooting, yet the debug output already proves packets arrive and IKE negotiation begins.
- ✓
The IKE version or encryption algorithm does not match between the peers
Why this is correct
'No suitable proposal found' during Phase 1 means the peers could not agree on an IKE version, encryption, hash or DH group. With a third-party device, mismatched IKEv1/IKEv2 or algorithm settings are the most likely cause of the stuck init state.
- ✗
The firewall policy allowing the VPN traffic is missing
Why it's wrong here
A missing firewall policy would drop IKE packets entirely, leaving Phase 1 stuck without any proposal exchange, not producing 'no suitable proposal found'. This option is tempting because policy omissions do block VPNs, and would be correct if debug showed no IKE response at all from the peer.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 718 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.