| Previous | Next |
| ERROR_IPSEC_IKE_INVALID_FILTER | ERROR_IPSEC_IKE_ADD_UPDATE_KEY_FAILED |
ERROR_IPSEC_IKE_OUT_OF_MEMORY
The keying module failed before protocol logic could complete
An allocation failure is local resource exhaustion in the IKE/AuthIP processing path. It is different from a peer proposal mismatch or authentication rejection: the local keying module could not obtain memory needed to continue state-machine work, payload processing, or SA management.
Do not assume that total free RAM alone explains the event. A transient allocation failure can coincide with extreme negotiation churn, process or kernel resource pressure, or a broader system failure. The useful evidence is whether other services report memory pressure at the same time and whether IKE is creating unusually large numbers of negotiations or dynamic filters.
What to inspect
- Check system resource events and committed memory at the exact failure time.
- Count active Main Mode and Quick Mode SAs and look for rapid repeated negotiation to the same peers.
- If reproducible, capture system and WFP state before restarting services, because a restart destroys the pressure pattern.
Get-NetIPsecMainModeSA | Measure-Object
Get-NetIPsecQuickModeSA | Measure-ObjectReferences
- Microsoft: Windows Filtering Platform API sets
- Microsoft: Get-NetIPsecMainModeSA
- Microsoft: Get-NetIPsecQuickModeSA
Looking for a different code? Search another status or error code.