IPsec VPN Phase 1 Proposal Mismatch: How to Fix 'No Acceptable Proposal'
An administrator is troubleshooting an IPsec VPN tunnel that fails to establish Phase 1. The debug output shows 'no acceptable proposal'. Which TWO configuration parameters should be checked to resolve this issue?
Quick Answer
The answer is the Diffie-Hellman group and the encryption algorithm. When an IPsec VPN Phase 1 proposal mismatch triggers a 'no acceptable proposal' error, it means the two peers cannot agree on a common set of security parameters during the Internet Key Exchange (IKE) negotiation. The Fortinet NSE 7 Advanced Security NSE7 exam frequently tests this by asking which two of the four Phase 1 attributes—encryption, authentication, Diffie-Hellman group, or key lifetime—are most commonly misconfigured, with the Diffie-Hellman group and encryption algorithm being the primary culprits because they are often set to incompatible values across different vendors or firmware versions. A common trap is assuming key lifetimes are the issue, but mismatched lifetimes typically cause rekey failures, not initial proposal rejection. Remember the memory tip: "DH and Encrypt are the first to inspect" when you see 'no acceptable proposal' in your debug output.
⚠ Common exam trap
A common mix-up: candidates confuse Phase 1 and Phase 2 parameters, incorrectly selecting local/remote subnets (a Phase 2 setting) when the error occurs during Phase 1 negotiation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encryption algorithm
The 'no acceptable proposal' error indicates that the two IPsec peers cannot agree on a Phase 1 proposal. The encryption algorithm and Diffie-Hellman group are both mandatory parameters in the IKE proposal that must match exactly between peers. If either parameter differs, the negotiation fails with this error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Encryption algorithm
Why this is correct
Mismatched encryption algorithms cause proposal failure.
- ✓
Diffie-Hellman group
Why this is correct
Mismatched DH groups cause proposal failure.
- ✗
IKE version
Why it's wrong here
IKE version mismatch typically results in no response, not proposal failure.
- ✗
Pre-shared key
Why it's wrong here
Pre-shared key mismatch causes authentication failure, not 'no acceptable proposal'.
- ✗
Local and remote subnets
Why it's wrong here
Subnets are Phase 2 parameters, not Phase 1.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator is troubleshooting an IPsec VPN tunnel that fails to establish. The Phase 1 status shows 'init' and the debug output indicates 'no suitable proposal found'. The remote peer is a third-party VPN device. Which of the following is the MOST likely cause?
hard- A.The pre-shared key is incorrect on one side
- B.The remote peer's IP address is not reachable
- ✓ C.The IKE version or encryption algorithm does not match between the peers
- D.The firewall policy allowing the VPN traffic is missing
Why C: The 'no suitable proposal found' error in Phase 1 indicates that the IKE proposal parameters (such as encryption algorithm, hash algorithm, Diffie-Hellman group, or IKE version) do not match between the FortiGate and the third-party peer. Since the status is 'init', the peers have exchanged initial packets but cannot agree on a common proposal, which is a classic proposal mismatch issue. A pre-shared key mismatch would typically cause an authentication failure later in Phase 1, not a 'no suitable proposal' error.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.