An HA VPN tunnel to a branch firewall keeps dropping and reconnecting every few minutes. Tunnel logs show phase 1 failing with a proposal mismatch. What is the most likely cause?
Show answer and explanation
Answer: C
Repeated tunnel drops with phase 1 proposal failures indicate that IKE negotiation is not agreeing. Both peers must match on IKE version, encryption and integrity algorithms, Diffie-Hellman group and lifetimes, along with the shared secret. If the branch device proposes a setting that the gateway does not accept, or the reverse, each attempt fails and the tunnel cycles. The fix is to align the phase 1 and phase 2 parameters on both ends. Routing and firewall problems do not produce these negotiation errors.
Why the other options are wrong
- A. A gateway that had run out of addresses would fail to add tunnels or interfaces. It would not produce a tunnel that negotiates and then drops repeatedly, so this does not explain the logs.
- B. Route advertisements affect which destinations use the tunnel once it is up. A large route table does not cause phase 1 proposal errors, so it is not the explanation here.
- D. Firewall rules filter traffic after a tunnel is established. The logs show negotiation failing before any data flows, so a firewall is not the cause of the repeated drops.
Exam tip. A phase 1 proposal mismatch in the logs means comparing IKE settings on both ends first.