What does Windows error code 13861 (ERROR_IPSEC_IKE_INVALID_POLICY) mean?

ERROR_IPSEC_IKE_INVALID_POLICY

ERROR_IPSEC_IKE_INVALID_POLICY (0x00003625) The policy configuration selected for negotiation is invalid or internally inconsistent. The issue can be caused by incompatible authentication and crypto settings, invalid peer selectors, or an incomplete policy deployment.

Export or enumerate the effective policy at the failing endpoint before making changes. A syntactically valid rule can still combine authentication, crypto, lifetime, or selector values that cannot form a usable negotiation.

What to check

• Review the active Main Mode and Quick Mode rules, not only the policy source file.
• Confirm that the same policy intent is present on both peers: authentication method, algorithms, lifetime, and protected traffic selectors.
• Check whether a more specific GPO or local rule is overriding the policy you expected to use.

Get-NetIPsecMainModeRule; Get-NetIPsecQuickModeRule

Microsoft: Get-NetIPsecMainModeRule

Microsoft: Get-NetIPsecQuickModeRule

Microsoft: IPsec/IKE system error codes