IPsec VPN fails with "No Proposal Chosen" error in NSX with mixed IPv4/IPv6 subnets

Products

• VMware NSX

Issue/Introduction

• A policy-based IPsec VPN is being established between an NSX Tier-1 Gateway and an external VPN Gateway using IPv6 for both local and remote subnets.
  
  
• Upon introducing IPv4 addresses into the local and remote subnet configurations, the VPN fails to negotiate for the IPv6 subnets (or vice versa).
  
  
• The VPN configuration returns a "No Proposal Chosen" error.

Environment

VMware NSX

Cause

Currently, VMware NSX does not support IPv4 and IPv6 dual-stack configurations for IPsec VPNs.

Resolution

To establish a successful IPsec VPN tunnel, configure the local and remote subnets to use either IPv4 or IPv6 independently. Do not mix both IP versions in the same policy-based VPN configuration.