IPsec VPN Phase 2 Failure: How to Fix 'No Proposal Chosen'
An administrator is troubleshooting an IPsec VPN tunnel that fails to establish. Phase 1 seems to complete, but Phase 2 fails with 'no proposal chosen'. The administrator checks the Phase 2 configuration and sees the following settings: 'Local address: 10.0.0.0/24, Remote address: 192.168.0.0/24, Proposal: aes256-sha1, Enable Perfect Forward Secrecy (PFS): Disabled'. Which TWO changes would most likely resolve the issue? (Choose two.)
Quick Answer
The answer is to verify that the Phase 2 selectors match exactly on both sides and to check for a Perfect Forward Secrecy (PFS) mismatch. This is correct because the "no proposal chosen" error in IPsec VPN Phase 2 troubleshooting indicates that the two peers cannot agree on the security parameters for the data channel, even though Phase 1 authentication succeeded. The most common causes are mismatched local and remote subnet selectors—such as one side using 10.0.0.0/24 while the other expects a different range—or a PFS mismatch, where one side requires PFS but the other has it disabled. On the Fortinet NSE 7 Advanced Security exam, this scenario tests your ability to diagnose Phase 2 failures beyond simple encryption mismatches, often hiding the real issue in selector or PFS settings. A common trap is assuming only the encryption algorithm matters, but the exam emphasizes that selectors must be mirror images. Memory tip: "Selectors mirror, PFS agree—no proposal chosen? Check these three."
⚠ Common exam trap
The trap here is that candidates often focus on encryption algorithms or lifetimes when 'no proposal chosen' appears, but the most common root causes are PFS mismatch and selector mismatch, not the cipher suite itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable PFS on FortiGate
When PFS is enabled on one side but disabled on the other, Phase 2 will fail with 'no proposal chosen'. PFS requires both peers to agree on the Diffie-Hellman (DH) group used for generating new keying material. If the remote peer requires PFS and the FortiGate has it disabled, the proposal mismatch causes the failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable PFS on FortiGate
Why this is correct
If the remote side requires PFS, FortiGate must enable it to match.
- ✓
Verify that the Phase 2 selectors match exactly on both sides
Why this is correct
Correct. Mismatched selectors (subnets) are a common cause of Phase 2 failure.
- ✗
Change the local address to 10.0.0.0/8
Why it's wrong here
Changing selector without knowing remote requirements could cause more issues.
- ✗
Add aes256-sha256 to the Phase 2 proposal
Why it's wrong here
Without knowing remote proposal, adding another may not help if PFS mismatch exists.
- ✗
Increase the Phase 2 lifetime
Why it's wrong here
Lifetime mismatch usually causes rekey issues, not proposal failure.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator is troubleshooting an IPsec VPN tunnel that establishes phase 1 but fails phase 2. Which TWO commands are MOST useful to diagnose the phase 2 failure? (Choose two.)
medium- A.diagnose sys session list
- B.show vpn ipsec phase2-interface
- C.get system performance status
- ✓ D.diagnose vpn ike config
- ✓ E.diagnose debug application ike 255
Why D: The 'diagnose vpn ike config' command (D) displays the IKE configuration that the FortiGate is actually using for phase 2 negotiations, including proxy IDs, encryption algorithms, and lifetimes. This helps identify mismatches between the local and peer configurations that cause phase 2 to fail. The 'diagnose debug application ike 255' command (E) enables verbose IKE debugging, which logs every phase 2 exchange, including error messages like 'no proposal chosen' or 'mismatched proxy ID', directly pinpointing the failure reason.
Variation 2. An administrator is troubleshooting an IPsec VPN tunnel that establishes phase 1 but fails to establish phase 2. The phase 2 configuration shows 'set proposal aes128-sha256' on both sides. Which TWO configuration items should the administrator verify?
medium- ✓ A.PFS (Perfect Forward Secrecy) settings
- B.The local authentication method (certificate vs pre-shared key)
- C.The encryption algorithm for phase 2
- ✓ D.The local and remote subnets defined in phase 2 (proxy IDs)
- E.The pre-shared key
Why A: PFS ensures that if one session key is compromised, previous and future session keys remain secure by using a Diffie-Hellman exchange in phase 2. If PFS is enabled on one side but not the other, or if the DH groups do not match, phase 2 will fail even when the encryption and authentication proposals are identical. Since the phase 2 proposal 'aes128-sha256' matches on both sides, the mismatch likely lies in PFS settings.
Variation 3. An administrator is troubleshooting an IPsec VPN where phase 1 is up but phase 2 fails. Which two debug commands would be MOST helpful in diagnosing the phase 2 issue? (Choose TWO.)
medium- A.diagnose sys session list
- B.diagnose debug application ipsec -1
- ✓ C.diagnose vpn ipsec phase2-config
- D.get vpn ipsec tunnel details
- ✓ E.diagnose debug application ike -1
Why C: 'diagnose vpn ipsec phase2-config' displays the phase 2 configuration parameters (e.g., proxy IDs, encryption/authentication algorithms, and SA lifetimes) that must match between peers. Option E is correct because 'diagnose debug application ike -1' enables real-time IKEv1/IKEv2 debugging, which shows the exact phase 2 negotiation messages (e.g., Quick Mode exchanges) and any error codes or mismatches. Together, they allow you to identify configuration mismatches or negotiation failures that prevent phase 2 from establishing.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.