What does Windows error code 13884 (ERROR_IPSEC_IKE_QM_LIMIT) mean?

ERROR_IPSEC_IKE_QM_LIMIT

Quick Mode association pressure forces a new Main Mode context

Windows can maintain many Quick Mode SAs beneath a peer relationship established by Main Mode. The Quick Mode SAs protect actual IP traffic and can differ by address family or traffic selectors. This status means the implementation reached the Quick Mode limit associated with the current Main Mode SA and will start a new Main Mode negotiation.

It is therefore a lifecycle and capacity signal, not necessarily a peer rejection. Large numbers of selectors, short lifetimes, high rekey frequency, or rapidly changing dynamic policy can increase Quick Mode SA creation. Determine whether the new Main Mode exchange succeeds and whether Quick Mode counts are expected for the workload.

What to inspect

• Count Quick Mode SAs associated with each Main Mode SA.
• Check SA lifetimes and selector cardinality for excessive rekey or per-flow policy expansion.
• If a new Main Mode negotiation fails, diagnose that later failure separately from the QM limit status.

Get-NetIPsecMainModeSA
Get-NetIPsecQuickModeSA

References

• Microsoft: Get-NetIPsecMainModeSA
• Microsoft: Get-NetIPsecQuickModeSA
• IETF RFC 4301: IPsec security architecture

Looking for a different code? Search another status or error code.