What does Windows error code 13882 (ERROR_IPSEC_IKE_MM_LIMIT) mean?

ERROR_IPSEC_IKE_MM_LIMIT

Too many established Main Mode associations exist for one peer

Main Mode creates the authenticated peer security association used as context for later Quick Mode negotiations. Windows documents one Main Mode SA between a pair of computers in the normal NetSecurity model, while multiple Quick Mode SAs can protect different traffic. This status indicates that the implementation limit for established Main Mode SAs to the peer has been exceeded.

Look for churn rather than simply increasing traffic volume. Rapid policy changes, unstable addressing, repeated authentication attempts, or software that deletes and recreates SAs can leave negotiation pressure concentrated on one peer. The active SA list and timestamps should show whether associations are accumulating or constantly cycling.

What to inspect

• Count Main Mode SAs grouped by remote address and authentication method.
• Check for frequent SA creation and termination events involving the same peer.
• Investigate rekey or management churn before restarting IKEEXT, because restart hides the association pattern.

Get-NetIPsecMainModeSA | Group-Object RemoteAddress

References

• Microsoft: Get-NetIPsecMainModeSA
• Microsoft: Get-NetIPsecQuickModeSA
• Microsoft: IPsec audit events