IKE: Main mode sent notification to peer: no proposal chosen

[shirlandjj1]

IKE: Main mode sent notification to peer: no proposal chosen

Have just upgraded from NG AI 55 to R60 NGX on NOKIA 1220 using IPSO 4.0 and since this, we receive the above error on a couple of externally managed gateways.

Does NGX change anything automatically as we have not changed any settings and neither have the other sites ?

[cathrobinson]

The default IKE settings seemed to change between R55 and NGX R60. We found this when testing, if the box is upgraded it behaves differently to if the box was buil from scratch. Go through your VPN traditional mode settings with a fine toothcomb, and compare them to the settings that the remote end is trying to talk on. From memory, it might be the hashing algorithm that changed - MD5 to SHA1?

Good luck!

[andrew]

Are the peers also Checkpoint? If not, some appliances, like SonicWall, give a better error explanation than Checkpoint when proposals don't match. We use SonicWalls for telecommuters and I often use their logs to troubleshoot VPN issues since CP is so non-descriptive.