What does Windows error code 13814 (ERROR_IPSEC_IKE_MM_DELAY_DROP) mean?

ERROR_IPSEC_IKE_MM_DELAY_DROP

ERROR_IPSEC_IKE_MM_DELAY_DROP means the authenticated Main Mode negotiation took too long. It can result from peer silence, packet loss, slow certificate or Kerberos validation, or local service pressure.

Measure where Main Mode stopped instead of treating the timeout as the root cause. The last successful packet and the corresponding authentication event usually reveal whether the delay is network, certificate, Kerberos, or local-service related.

What to check

• Correlate the delay with certificate revocation checks, domain-controller reachability, and packet loss.
• Compare the Main Mode trace on both peers to identify the last successfully processed IKE message.
• Check for high concurrency or repeated connection attempts creating IKE work queues.

Microsoft: Audit IPsec Main Mode

Microsoft: Use Netsh to manage network traces

Microsoft: Get-NetIPsecMainModeSA