VPC is not working; Received 'No Proposal Chosen' error message

Question

Scope: Created a static site-to-site VPC
Customer: Watchguard Firewall with up-to-date software

Problem: 
Used AWS instructions for watchguard and setup VPN Tunnel. 
1. Checked and re-checked Phase 1 and Phase 2 settings
2. Checked that device can ping the AWS Public IP Address of the Tunnel
3. Checked that UDP Port 500 allows traffic through it
The problem is that my remote site is not able to establish connection through the tunnel, in watchguard firewall logs i get the following error:

ERROR  0x02030014 Received 'No Proposal Chosen' message. Check VPN IKE diagnostic log messages on the remote gateway endpoint for more information.

Has anyone come across this?

Answer

Hello,

Firstly, the static VPC you are referring to is not a Static VPC, it is a Static VPN since the error message of no proposal chosen is for the VPN that you are trying to establish.

Coming to the error, this error occurs when there is a mis-match between the configuration parameters and the suggested parameters for Phase-1/2 might not match and this is causing the CGW device to send this error. Basically make sure the two options are matching on both the ends for the VPN to get established.

I would recommend to only check the parameters that are supported on both the ends and uncheck rest of the phase-1/phase-2 settings as mentioned in the link below.

Link- https://docs.aws.amazon.com/vpn/latest/s2svpn/VPNTunnels.html -- [1]

VPC is not working; Received 'No Proposal Chosen' error message

Conteúdo relevante