nerdexam
Google

PROFESSIONAL-CLOUD-NETWORK-ENGINEER · Question #198

You are attempting to establish a HA VPN to your on-premises network; however, the VPN connection is not establishing successfully. You have full administrative control over the Google Cloud…

The correct answer is B. Compare and review the Phase 2 settings on the on-premises firewall. Make sure the settings. The error received NO_PROPOSAL_CHOSEN notify, no CHILD_SA built indicates a mismatch in Phase 2 settings during IPsec negotiation. This happens when the encryption or hashing algorithms, Diffie-Hellman groups, or other Phase 2 parameters configured on the on-premises firewall…

Submitted by certguy· Apr 18, 2026Configuring network services

Question

You are attempting to establish a HA VPN to your on-premises network; however, the VPN connection is not establishing successfully. You have full administrative control over the Google Cloud networking environment and the on-premises firewalls that are acting as the VPN devices. The Google Cloud console shows "Negotiation failure" and "BGP is down". You check Cloud Logging by using a query for resource.type="vpn_gateway" and resource.labels.gateway_id="TUNNEL_ID_NUMBER". Logs Explorer shows frequent log entries: log name: .../logs/cloud.googleapis.com%2Fipsec_events" type: "vpn_gateway" textPayload: "received NO_PROPOSAL_CHOSEN notify, no CHILD_SA built" You need to troubleshoot the VPN failure and take corrective action based on the Cloud Logging entries. What should you do?

Options

  • AUpdate the Google Cloud BGP session configuration to match the BGP peer ASN on the on-
  • BCompare and review the Phase 2 settings on the on-premises firewall. Make sure the settings
  • CCreate a new Cloud VPN gateway in a region closer to the peer VPN gateway.
  • DCompare the Phase 1 settings and recreate the Cloud VPN tunnel by choosing a different IKE

How the community answered

(33 responses)
  • A
    3% (1)
  • B
    79% (26)
  • C
    6% (2)
  • D
    12% (4)

Explanation

The error received NO_PROPOSAL_CHOSEN notify, no CHILD_SA built indicates a mismatch in Phase 2 settings during IPsec negotiation. This happens when the encryption or hashing algorithms, Diffie-Hellman groups, or other Phase 2 parameters configured on the on-premises firewall do not match those configured for the HA VPN on Google Cloud. 1. Phase 2 Settings (Child SA): These settings determine the parameters for securing the actual traffic. They must match on both sides of the VPN (on-premises and Google Cloud) for the connection to establish successfully. 2. Supported Cipher Suites: HA VPN has specific supported cipher suites for Phase 2, which must be adhered to when configuring the on-premises firewall. 3. Action: Review and update the Phase 2 settings on the on-premises firewall to ensure they match Google Cloud's HA VPN requirements.

Topics

#VPN troubleshooting#IPSec VPN#IKE Phase 2#Cloud Logging

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full PROFESSIONAL-CLOUD-NETWORK-ENGINEER Practice