Windows error 13860 (ERROR_IPSEC_IKE_ADD_UPDATE_KEY

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: IKE could not add or update a Security Association in the IPsec driver.

Previous	Next
ERROR_IPSEC_IKE_OUT_OF_MEMORY	ERROR_IPSEC_IKE_INVALID_POLICY

ERROR_IPSEC_IKE_ADD_UPDATE_KEY_FAILED

ERROR_IPSEC_IKE_ADD_UPDATE_KEY_FAILED (0x00003624) IKE finished enough negotiation to create or update a Security Association, but the handoff to the IPsec driver failed. Windows notes that prolonged negotiation and high load can contribute, but policy and driver state must also be checked.

What to check

Inspect IKEEXT and IPsec Policy Agent service events around the failure and verify both services are running.
Check active Main Mode and Quick Mode SAs for repeated rekeying, excessive stale associations, or policy churn.
If the error repeats under load, collect a trace before changing timeouts or weakening policy settings.

Get-NetIPsecMainModeSA; Get-NetIPsecQuickModeSA

Microsoft: Get-NetIPsecMainModeSA

Microsoft: Get-NetIPsecQuickModeSA

Microsoft: Netsh network tracing

Looking for a different code? Search another status or error code.