| Previous | Next |
| ERROR_IPSEC_IKE_MM_LIMIT | ERROR_IPSEC_IKE_QM_LIMIT |
ERROR_IPSEC_IKE_NEGOTIATION_DISABLED
Policy intentionally prevents the keying exchange
This status is policy-driven. The IKE keying path received a policy result that says negotiation is disabled, so the failure occurs before trying to reconcile algorithms or authenticate the peer. A reachable remote endpoint cannot fix a local policy that tells Windows not to negotiate.
Inspect the effective active policy, not only the local rule an administrator remembers creating. Windows IPsec settings can come from policy stores and Group Policy, and merged rules can differ from the local persistent store. The triggering traffic selectors and endpoints must also match the rule you are examining.
What to inspect
- Enumerate effective IPsec and Main Mode rules in the active policy store.
- Check whether Group Policy or a management product replaced the expected rule.
- Verify the packet matches the intended local and remote address conditions before changing authentication or crypto proposals.
Get-NetIPsecRule -PolicyStore ActiveStore
Get-NetIPsecMainModeRule -PolicyStore ActiveStoreReferences
- Microsoft: New-NetIPsecMainModeRule
- Microsoft: Windows Filtering Platform API sets
- Microsoft: IPsec audit events
Looking for a different code? Search another status or error code.