HA VPN tunnels fail to establish with logs showing: "received NO_PROPOSAL_CHOSEN notify, no CHILD_SA built" and Cloud Console shows "Negotiation failure" and "BGP is down". You control both cloud and on‑prem VPN devices. What corrective action should you take?

The error message "received NOPROPOSALCHOSEN notify, no CHILDSA built" specifically indicates a failure in Phase 2 (CHILDSA) negotiation. This means the IKEv2 parameters for establishing the IPsec tunnel itself, such as encryption algorithms, authentication algorithms, and Perfect Forward Secrecy (PFS) groups, do not match between the Google Cloud HA VPN gateway and the on-premises device. Reviewing and correcting these Phase 2 settings on the on-premises firewall to align with Google Cloud's supported cipher suites is the direct solution. Updating the BGP session configuration (first incorrect option) is irrelevant to the "NOPROPOSALCHOSEN" error, which occurs before BGP can even establish. Creating a new Cloud VPN gateway in a different region (third incorrect option) would not resolve a configuration mismatch. Recreating the tunnel with different IKE version and pre-shared key (fourth incorrect option) addresses Phase 1 issues, but the error explicitly points to Phase 2.