FortiGate still returns NO_PROPOSAL_CHOSEN

Forum|Forum|1 month ago
June 11, 2026
5 replies
84 views

FortiOS 70G: 7.6.7
FortiClient EMS-pushed IPsec SAML
SAML response success
Group claim correct
UDP/4500 reaches 70G
IKE proposal contains matching AES256/SHA1 and AES256/SHA256 with DH14
FortiGate still returns NO_PROPOSAL_CHOSEN

FortiClient

Anthony_E

Staff

Hi,

Could you please check this KB article?:

Anthony

Best Regards

Anthony_E

Staff

Or

Best Regards

sjoshi

Staff

Hi @FerryvanDijk

Please share the full ike debug by filtering with the destination remote IP address.

Refer below article on collecting ike debug

Thanks, Salon

FerryvanDijkAuthor

New Member

2026-06-15 08:54:15.337505 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: incoming proposal:
2026-06-15 08:54:15.337514 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: proposal id = 1:
2026-06-15 08:54:15.337521 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: protocol = IKEv2:
2026-06-15 08:54:15.337528 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: encapsulation = IKEv2/none
2026-06-15 08:54:15.337535 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: type=ENCR, val=AES_CBC (key_len = 256)
2026-06-15 08:54:15.337542 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: type=INTEGR, val=AUTH_HMAC_SHA2_256_128
2026-06-15 08:54:15.337550 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: type=PRF, val=PRF_HMAC_SHA
2026-06-15 08:54:15.337557 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: type=PRF, val=PRF_HMAC_SHA2_512
2026-06-15 08:54:15.337564 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: type=PRF, val=PRF_HMAC_SHA2_384
2026-06-15 08:54:15.337571 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: type=PRF, val=PRF_HMAC_SHA2_256
2026-06-15 08:54:15.337578 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: type=DH_GROUP, val=MODP2048.
2026-06-15 08:54:15.337587 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: proposal id = 2:
2026-06-15 08:54:15.337594 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: protocol = IKEv2:
2026-06-15 08:54:15.337605 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: encapsulation = IKEv2/none
2026-06-15 08:54:15.337611 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: type=ENCR, val=AES_CBC (key_len = 256)
2026-06-15 08:54:15.337617 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: type=INTEGR, val=AUTH_HMAC_SHA2_256_128
2026-06-15 08:54:15.337622 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: type=PRF, val=PRF_HMAC_SHA
2026-06-15 08:54:15.337628 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: type=PRF, val=PRF_HMAC_SHA2_512
2026-06-15 08:54:15.337634 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: type=PRF, val=PRF_HMAC_SHA2_384
2026-06-15 08:54:15.337640 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: type=PRF, val=PRF_HMAC_SHA2_256
2026-06-15 08:54:15.337645 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: type=DH_GROUP, val=MODP2048.
2026-06-15 08:54:15.337651 ike V=root:0: cache rebuild start
2026-06-15 08:54:15.337682 ike V=root:0:RBK-REMOTE-SAML: cached as dynamic
2026-06-15 08:54:15.337689 ike V=root:0: cache rebuild done
2026-06-15 08:54:15.337698 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: my proposal, gw RBK-REMOTE-SAML:
2026-06-15 08:54:15.337706 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: proposal id = 1:
2026-06-15 08:54:15.337711 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: protocol = IKEv2:
2026-06-15 08:54:15.337717 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: encapsulation = IKEv2/none
2026-06-15 08:54:15.337723 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: type=ENCR, val=AES_CBC (key_len = 256)
2026-06-15 08:54:15.337728 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: type=INTEGR, val=AUTH_HMAC_SHA2_256_128
2026-06-15 08:54:15.338319 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: type=PRF, val=PRF_HMAC_SHA2_256
2026-06-15 08:54:15.338329 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: type=DH_GROUP, val=MODP2048.
2026-06-15 08:54:15.338335 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: lifetime=86400
2026-06-15 08:54:15.338344 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: no proposal chosen
2026-06-15 08:54:15.338485 ike V=root:d8f8fbf386d0bf02/0000000000000000 Negotiate SA Error: peer SA proposal not match local policy
2026-06-15 08:54:15.338523 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: no proposal chosen, send error response
2026-06-15 08:54:15.338535 ike 0:d8f8fbf386d0bf02/0000000000000000:71262: out D8F8FBF386D0BF020000000000000000292022200000000000000024000000080000000E
2026-06-15 08:54:15.338566 ike V=root:0:d8f8fbf386d0bf02/0000000000000000:71262: sent IKE msg (NO_PROPOSAL_CHOSEN): 92.67.151.94:4500->89.205.200.81:63750, len=36, vrf=0, id=d8f8fbf386d0bf02/0000000000000000, oif=3

FortiGate-70G # 2026-06-15 08:55:33.473117 ike V=root:0: comes 64.62.197.86:44123->92.67.151.94:500,ifindex=3,vrf=0,len=60....
2026-06-15 08:55:33.473158 ike V=root:0: IKEv1 exchange=Quick id=e47a591f78c99d7f/a00b8ef0ea9ff883:e22a74c1 len=60 vrf=0
2026-06-15 08:55:33.473168 ike 0: in E47A591F78C99D7FA00B8EF0EA9FF88308102001E22A74C10000003C769E59D6F8553E22991A4DB1CD29CAD877C65C332739F106A2BF6F1D2F5BF52E
2026-06-15 08:55:33.473181 ike V=root:0: no established IKE SA for exchange-type Quick from 64.62.197.86:44123->92.67.151.94 3 cookie e47a591f78c99d7f/a00b8ef0ea9ff883, drop