RHEL7 VPN <-> Google Cloud VPN

I've been unable to get RHEL7.1 VPN working with Google Cloud VPN (https://cloud.google.com/compute/docs/vpn).

I get this message repeated in the logs:
initial parent SA message received on x.x.x.x:500 but no connection has been authorized with policy=IKEV2_ALLOW
sending unencrypted notification v2N_NO_PROPOSAL_CHOSEN to y.y.y.y:500

My /etc/ipsec.d/google-cloud-vpn.conf is:

conn google-tunnel
authby=secret
auto=start
type=tunnel
left=x.x.x.x
leftid=x.x.x.x
leftsourceip=x.x.x.x
leftsubnet=x.x.x.0/24
right=y.y.y.y
rightsubnet=y.y.0.0/16
rightsourceip=y.y.y.y
ike=aes-sha1
ikev2=insist
phase2alg=aes-sha1

Any ideas?