Windows error 13849 (ERROR_IPSEC_IKE_POLICY

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: A policy change invalidated security associations formed under the previous policy.

Previous	Next
ERROR_IPSEC_IKE_PEER_CRL_FAILED	ERROR_IPSEC_IKE_NO_MM_POLICY

ERROR_IPSEC_IKE_POLICY_CHANGE

ERROR_IPSEC_IKE_POLICY_CHANGE (0x00003619) This event means an IPsec policy update made existing security associations obsolete. It is expected during a planned policy rollout, but repeated occurrences can interrupt traffic when GPO or another management system keeps changing the rules.

What to check

Check the time of the event against Group Policy refreshes, MDM changes, firewall policy deployment, and VPN configuration updates.
Compare the prior and current Main Mode and Quick Mode proposals to identify the change that forced rekeying.
If outages recur, avoid overlapping policy writers and roll out a stable policy revision consistently to both peers.

Get-NetIPsecMainModeSA; Get-NetIPsecQuickModeSA

Microsoft: Get-NetIPsecMainModeSA

Microsoft: Get-NetIPsecQuickModeSA

Microsoft: Audit IPsec Main Mode

Looking for a different code? Search another status or error code.