ERROR_IPSEC_IKE_INVALID_AUTH_ALG: meaning and diagnosis

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The IKE peer proposed an invalid or unsupported authentication algorithm.

Previous	Next
ERROR_IPSEC_IKE_INVALID_ENCRYPT_ALG	ERROR_IPSEC_IKE_INVALID_SIG

ERROR_IPSEC_IKE_INVALID_AUTH_ALG

ERROR_IPSEC_IKE_INVALID_AUTH_ALG (0x00003632) The authentication/integrity algorithm offered in the IKE negotiation does not match the local policy or supported implementation. It is not solved by changing firewall ports; the peer proposals must be aligned.

Record the proposal that Windows rejected and compare it with the effective policy after Group Policy processing. The configured UI value alone may not show which integrity algorithm was actually offered on the wire.

What to check

Compare the integrity/authentication algorithms configured on both peers.
Check whether the connection uses a legacy template that no longer matches the current security baseline.
Use an IKE trace to identify the exact proposal rejected by Windows.

Get-NetIPsecMainModeRule

Microsoft: Get-NetIPsecMainModeRule

Microsoft: Netsh network tracing

Microsoft: IPsec/IKE system error codes

Looking for a different code? Search another status or error code.