| Previous | Next |
| ERROR_IPSEC_DEFAULT_MM_AUTH_NOT_FOUND | ERROR_IPSEC_TUNNEL_FILTER_EXISTS |
ERROR_IPSEC_DEFAULT_QM_POLICY_NOT_FOUND
The rule has no resolvable Phase 2 protection proposal
ERROR_IPSEC_DEFAULT_QM_POLICY_NOT_FOUND means Windows cannot locate the default Quick Mode policy needed to negotiate ESP or AH protection for matching traffic. Main Mode may still authenticate the peers successfully, but without a Quick Mode proposal the system cannot create the data-plane security associations that protect packets.
Check whether the rule inherited a generated default or explicitly references a named crypto set. Policy-store merges can make an object visible in active policy while leaving it unavailable to a write operation in the original store. If Main Mode audit events show success but no Quick Mode SA appears, inspect the rule-to-crypto-set association before changing peer certificates or firewall ports.
Signs that the problem is policy resolution
- Main Mode SAs can exist while Quick Mode SA creation never starts.
- The associated Quick Mode set is absent from the rule’s source store.
- A GPO or local-policy migration copied the rule without its crypto set.
- Changing algorithms on the peer cannot repair a missing local object.
References
- Microsoft: Quick Mode crypto-set lookup
- Microsoft: monitoring Quick Mode SAs
- RFC 4301: Security Policy Database and SAs
Looking for a different code? Search another status or error code.