The answer is a mismatch in the IPsec SA lifetime configuration. This is the correct choice because the error "IPsec phase 2 negotiation failed no suitable proposal" occurs when the two peers cannot agree on a Phase 2 parameter during rekey, even though the tunnel initially establishes. In this scenario, identical IKE and IPsec crypto profiles are configured, but if one firewall has an explicit IPsec SA lifetime (e.g., 3600 seconds) and the other uses a default value (e.g., 10800 seconds), the lifetimes become mismatched, causing intermittent drops when the shorter-lived SA expires and renegotiation fails. On the PCNSA exam, this tests your understanding that Phase 2 proposals must match exactly, including lifetime values, and that default values vary by platform—a common trap is assuming identical crypto profiles guarantee a match. Remember the memory tip: "Phase 2 fails? Check the lifetime—if one is set and one is default, the tunnel will default to trouble."
PCNSA Core Concepts Practice Question
This PCNSA practice question tests your understanding of core concepts. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A security administrator is troubleshooting a site-to-site IPsec VPN between two Palo Alto Networks firewalls. The Phase 1 proposal includes AES-256, SHA-256, and DH Group 14 with a lifetime of 28800 seconds. The Phase 2 proposal includes AES-256, SHA-256, and PFS with DH Group 14. The tunnel is established and traffic is flowing, but intermittently the tunnel drops and re-establishes. The logs show the following error: 'Phase 2 negotiation failed because no suitable proposal found.' Both firewalls have identical IKE gateway and IPsec crypto profile configurations. Which option is the most likely cause of this issue?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
The DH group used in Phase 2 is not supported by the firewall model.
Why wrong: Incorrect: DH Group 14 is widely supported.
B
The IPsec SA lifetime is not configured on one of the firewalls, causing a mismatch.
Correct: If the IPsec SA lifetime is not explicitly set, the firewall uses a default value that may differ from the peer's configured value, leading to proposal mismatch.
C
The Phase 2 proposal uses a different DH group than Phase 1.
Why wrong: Incorrect: PFS uses DH group 14, but the error is not about DH group mismatch.
D
The Phase 1 lifetime is shorter than the Phase 2 lifetime.
Why wrong: Incorrect: Phase 1 lifetime is typically longer than Phase 2; the error is not lifetime-related.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The IPsec SA lifetime is not configured on one of the firewalls, causing a mismatch.
The error 'Phase 2 negotiation failed because no suitable proposal found' indicates a mismatch in the IPsec SA parameters. Even though both firewalls have identical IKE gateway and IPsec crypto profile configurations, if one firewall has an IPsec SA lifetime configured (e.g., 3600 seconds) and the other does not (defaulting to a different value, such as 10800 seconds), the lifetimes will not match, causing intermittent rekey failures. This is the most likely cause because the tunnel initially establishes but drops when rekeying occurs due to the lifetime mismatch.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The DH group used in Phase 2 is not supported by the firewall model.
Why it's wrong here
Incorrect: DH Group 14 is widely supported.
✓
The IPsec SA lifetime is not configured on one of the firewalls, causing a mismatch.
Why this is correct
Correct: If the IPsec SA lifetime is not explicitly set, the firewall uses a default value that may differ from the peer's configured value, leading to proposal mismatch.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
The Phase 2 proposal uses a different DH group than Phase 1.
Why it's wrong here
Incorrect: PFS uses DH group 14, but the error is not about DH group mismatch.
✗
The Phase 1 lifetime is shorter than the Phase 2 lifetime.
Why it's wrong here
Incorrect: Phase 1 lifetime is typically longer than Phase 2; the error is not lifetime-related.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates assume identical IKE gateway and IPsec crypto profile configurations guarantee matching proposals, but they overlook that the IPsec SA lifetime is a separate parameter that must be explicitly set to the same value on both peers, and a default value mismatch is a common cause of intermittent rekey failures.
Detailed technical explanation
How to think about this question
IPsec SA lifetimes must match exactly between peers for successful rekeying; if one side has a lifetime of 28800 seconds and the other has a different value (e.g., default 3600 seconds), the initiator will attempt rekey at its lifetime expiry, but the responder will reject the proposal because the lifetime attribute in the proposal does not match its configured value. In Palo Alto Networks firewalls, the IPsec crypto profile includes the 'Lifetime' field (in seconds), and if left unconfigured, it defaults to 10800 seconds (3 hours) for IKEv1 or 3600 seconds (1 hour) for IKEv2, leading to mismatches when the other peer has a custom value like 28800 seconds.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the PCNSA exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Core Concepts — This question tests Core Concepts — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The IPsec SA lifetime is not configured on one of the firewalls, causing a mismatch. — The error 'Phase 2 negotiation failed because no suitable proposal found' indicates a mismatch in the IPsec SA parameters. Even though both firewalls have identical IKE gateway and IPsec crypto profile configurations, if one firewall has an IPsec SA lifetime configured (e.g., 3600 seconds) and the other does not (defaulting to a different value, such as 10800 seconds), the lifetimes will not match, causing intermittent rekey failures. This is the most likely cause because the tunnel initially establishes but drops when rekeying occurs due to the lifetime mismatch.
What should I do if I get this PCNSA question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This PCNSA practice question is part of Courseiva's free Palo Alto Networks certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNSA exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.