What does Windows error code 13864 (ERROR_IPSEC_IKE_DH_FAILURE) mean?

 
Previous Next
ERROR_IPSEC_IKE_INVALID_SITUATION ERROR_IPSEC_IKE_INVALID_GROUP

ERROR_IPSEC_IKE_DH_FAILURE

ERROR_IPSEC_IKE_DH_FAILURE (0x00003628) The IKE peer exchange could not complete the Diffie-Hellman calculation needed to establish shared keying material. The common practical cause is a mismatch in allowed DH groups or a peer that cannot process the selected proposal.

What to check

  • Compare the allowed Main Mode/IKE proposals and DH groups on both endpoints.
  • Check software and firmware compatibility for the VPN gateway, especially after changing cryptographic policy.
  • Collect Main Mode audit events or a trace to determine which proposal was selected immediately before failure.
Get-NetIPsecMainModeRule

Microsoft: Get-NetIPsecMainModeRule

Microsoft: Audit IPsec Main Mode

Microsoft: IPsec/IKE system error codes

Looking for a different code? Search another status or error code.