Windows error 13846 (ERROR_IPSEC_IKE_INVALID

Status / error code:		Category:

Constant name:
Source:	Operating System:
Description: IKE received an invalid cookie from the peer.

Previous	Next
ERROR_IPSEC_IKE_SOFT_SA_TORN_DOWN	ERROR_IPSEC_IKE_NO_PEER_CERT

ERROR_IPSEC_IKE_INVALID_COOKIE

ERROR_IPSEC_IKE_INVALID_COOKIE (0x00003616) An invalid IKE cookie usually means the response does not match the negotiation state Windows expected. It can result from a stale or replayed exchange, a NAT/load-balancer path that changes peer state, or an incompatible IKE implementation.

What to check

Capture the negotiation on both peers and verify that the packets belong to the same source, destination, and Security Association exchange.
Check NAT, load balancers, and VPN gateways for asymmetric routing or state loss.
Compare IKE version and peer configuration before treating this as a certificate issue.

netsh trace start capture=yes scenario=InternetClient

Microsoft: Netsh network tracing

Microsoft: Audit IPsec Main Mode

Microsoft: IPsec/IKE system error codes

Looking for a different code? Search another status or error code.