Palo Alto Networks Certified Network Security Engineer (PCNSE)Core ConceptsMedium
A network engineer is troubleshooting a site-to-site IPsec VPN tunnel between a Palo Alto Networks firewall and a third-party VPN gateway. Phase 1 of the IKE negotiation is failing. The firewall logs indicate 'No proposal chosen'. Which configuration parameter is most likely mismatched between the two devices?
- AThe pre-shared key.
- BThe NAT-Traversal setting.
- CThe IKE Crypto Profile (Phase 1).
- DThe Proxy IDs (Phase 2).
Show answer & explanationAnswer & explanation
Correct answer: C. The IKE Crypto Profile (Phase 1).
The error message 'No proposal chosen' specifically indicates that the IKE Crypto Profiles (Phase 1) do not have any common parameters (e.g., encryption algorithm, authentication algorithm, DH group) that both devices can agree upon. Phase 1 parameters must match exactly for the security association to be established.
Why the other options are wrong
- A. A mismatched pre-shared key would result in an authentication failure, typically indicated by messages like 'authentication failed' or 'invalid authentication data', not 'No proposal chosen'.
- B. NAT-Traversal issues usually manifest as connection failures after Phase 1, or specific NAT-T related errors, not 'No proposal chosen'.
- D. Proxy IDs (Phase 2 selectors) are negotiated after Phase 1 is successfully established. Errors related to Proxy IDs would occur during Phase 2, not Phase 1, and would typically be 'No common SA proposal' or 'traffic selectors mismatch'.
IKE Crypto Profile Mismatch
An IKE Crypto Profile mismatch occurs when two VPN peers cannot agree on common parameters for Phase 1 (IKE SA negotiation), such as encryption, authentication, or Diffie-Hellman group, leading to negotiation failure.
- Affects IKE Phase 1 negotiation.
- Common error message: 'No proposal chosen'.
- All parameters (encryption, authentication, DH group) must match or have compatible options.
Memory trick: IKE Phase 1 is the Handshake: Agreement on Rules, then Authentication.