Phone Lines icon GFI Support Home

Articles in this section

See more

IPSec tunnel error "None of the proposed crypto suites was acceptable"

Author: Vladyslav Velychko Updated

Overview

While trying to configure the IPSec VPN tunnel with another firewall, the following error is returned:

None of the proposed crypto suites was acceptable

none_crypto_suites_acceptable.png

The state of a tunnel appears as Connecting.

The error logs report a similar entry:

IPsec: Failed to establish connection with remote endpoint x.x.x.x: None of the proposed crypto suites was acceptable

This article provides information on how to resolve such an issue.

Solution

This error indicates that the crypto suites from the remote host did not match the acceptable suites in Kerio Control.

Make sure to configure the same ciphers on both sides: Kerio Control and the remote firewall.

  1. In Kerio Control Webadmin navigate to Interfaces > double-click on VPN tunnel to open the properties > click Change > verify the Default or configure Custom ciphers.
    For more information, please refer to Establishing IPSec VPN tunnel with another firewall.Screen_Shot_2020-12-30_at_4.45.47_PM.png
  2. Make sure the ciphers are matching on the remote site as well. Please refer to your vendor's docs for detailed information.Screen_Shot_2020-12-30_at_4.48.01_PM.png

 

 

Another reason for issues while establishing a tunnel between two Kerio Control Firewalls could be related to the IKE versions of the firewalls. It's possible that one of the firewalls is ikev1 and the other is ikev2. Updating the IKE versions so both firewalls are ikev2 will fix the issue. Please refer to article Enabling IKEv2 Support in Kerio Control for detailed steps.

Related articles