NO_PROPOSAL_CHOSEN (IPsec/IKE) Networking Origin: Network OSI layer 6 · Presentation Last updated 5 Nov 2026

Networking: IKE: received NO_PROPOSAL_CHOSEN — IPsec peers can't agree on encryption, hash or DH group

The two VPN gateways offered encryption settings that have nothing in common, so the tunnel never comes up.

Exact message you may see received NO_PROPOSAL_CHOSEN notify errorIKE no proposal chosenIPsec phase 1 failed no proposal chosenno matching proposal found
Explore the map of this error Full error map →
Seen on: Linux Networking

Meaning

Match IKE phase 1 and phase 2 proposals on both ends (IKE version, encryption, integrity, DH group, lifetime, PFS), and check the pre-shared key and identities. Read the logs of both peers: the side that says NO_PROPOSAL_CHOSEN is the one that rejected what it received.

Common causes

  • Different encryption/hash/DH group in phase 1
  • Phase 2 transform set mismatch
  • IKEv1 vs IKEv2 mismatch
  • PFS enabled on one side only
  • Weak algorithms disabled by newer firmware

⚡ Quick fix

  1. Make phase 1 and 2 proposals identical on both gateways
  2. Use IKEv2 with modern ciphers (AES-GCM, DH 14+)
  3. Compare logs on both peers

Detailed fix by platform

Linux

  1. bash
    sudo ipsec statusall
sudo journalctl -u strongswan -n 100 | grep -iE "NO_PROPOSAL|proposal"

How to diagnose

  1. IKE version — Same?
  2. Ciphers/DH — Matching?
  3. PFS — Both sides?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Network. Errors that are often confused with or caused by this one (click to open):

arp -a shows (incomplete) — Networking: `arp -n` shows (incomplete) / Destination Host Unreachable — no ARP reply from the next hop (Networking)arp -a shows (incompl…Connections hang on large transfers (PMTU black hole) — Networking: SSH/HTTPS connects but hangs on large data — path MTU discovery black hole (Networking)Connections hang on l…Internal hostnames fail on VPN (split DNS / systemd-resolved) — Networking: VPN connected but internal names like db.corp.local don't resolve — split DNS / 127.0.0.53 stub resolver not using the VPN DNS (Networking)Internal hostnames fa…sslv3 alert handshake failure — OpenSSL: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure (SSL alert number 40) (SSL / TLS)sslv3 alert handshake…VPN connected but internal subnets unreachable — Networking: VPN is connected but I can't reach the internal network — missing routes, split tunnel or overlapping subnets (Networking)VPN connected but int…WireGuard: Handshake did not complete after 5 seconds — Networking: Handshake for peer did not complete after 5 seconds, retrying (try 2) — WireGuard tunnel never establishes (Networking)WireGuard: Handshake …Your Remote Desktop Services session has ended (network problem) — Networking: Your Remote Desktop Services session has ended. Possibly the network connection was lost / Remote Desktop disconnected, error code 0x904 (Networking)Your Remote Desktop S…NO_PROPOS…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.