Windows error 13864 (ERROR_IPSEC_IKE_DH

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: ERROR_IPSEC_IKE_DH_FAILURE means the IKE peer exchange could not complete the Diffie-Hellman calculation for shared keying material.

Previous	Next
ERROR_IPSEC_IKE_INVALID_SITUATION	ERROR_IPSEC_IKE_INVALID_GROUP

ERROR_IPSEC_IKE_DH_FAILURE

ERROR_IPSEC_IKE_DH_FAILURE (0x00003628) The IKE peer exchange could not complete the Diffie-Hellman calculation needed to establish shared keying material. The common practical cause is a mismatch in allowed DH groups or a peer that cannot process the selected proposal.

If both peers advertise a common group, inspect the key-exchange values and crypto-provider events before weakening policy. This distinguishes a malformed exchange or local computation failure from a simple list-of-groups mismatch.

What to check

Compare the allowed Main Mode/IKE proposals and DH groups on both endpoints.
Check software and firmware compatibility for the VPN gateway, especially after changing cryptographic policy.
Collect Main Mode audit events or a trace to determine which proposal was selected immediately before failure.

Get-NetIPsecMainModeRule

Microsoft: Get-NetIPsecMainModeRule

Microsoft: Audit IPsec Main Mode

Microsoft: IPsec/IKE system error codes

Looking for a different code? Search another status or error code.