| Previous | Next |
| ERROR_IPSEC_IKE_INVALID_RESPONDER_LIFETIME_NOTIFY | ERROR_IPSEC_IKE_INVALID_CERT_KEYLEN |
ERROR_IPSEC_IKE_INVALID_MAJOR_VERSION
The IKE header version does not match the supported protocol
IKE messages carry major and minor version fields in the header. A recipient cannot process an exchange as IKEv1 or IKEv2 merely because it arrived on a familiar UDP port; the version encoded in the message determines the protocol state machine and payload rules. This status indicates that the received major version is not one the recipient can handle in that context.
First verify the packet that reached the host. NAT devices, load balancers, port sharing, or a non-IKE service can send unexpected data to the IKE endpoint. If the packet is genuine IKE, compare the configured keying protocol on both peers and any gateway profile that selects IKEv1 versus IKEv2.
What to inspect
- Inspect the IKE header version in a packet capture.
- Verify the peer profile is configured for the same IKE generation as the Windows endpoint.
- Do not treat this as a cipher-suite mismatch; version validation occurs at the protocol-header level.
References
- IETF RFC 2409: Internet Key Exchange v1
- IETF RFC 7296: IKEv2
- Microsoft Open Specifications: MS-IKEE product behavior
Looking for a different code? Search another status or error code.