| Previous | Next |
| ERROR_IPSEC_IKE_MM_EXPIRED | ERROR_IPSEC_IKE_CERT_CHAIN_POLICY_MISMATCH |
ERROR_IPSEC_IKE_PEER_MM_ASSUMED_INVALID
The peer stopped responding and the parent SA is no longer trusted
Windows assumed the Main Mode SA was invalid because the remote peer stopped responding. This is different from a cryptographic authentication failure: the association may have been valid earlier, but liveness or retransmission behavior no longer supports continuing to use it.
Network loss, peer restart, stateful firewall timeout, NAT rebinding, or an asymmetric route can all make an existing SA appear dead. Compare this code with packet retransmissions and with whether the peer still holds matching SA state. A local SA can survive briefly after the remote endpoint has already discarded its half.
What to inspect
- Check bidirectional reachability for IKE and protected traffic, not only ICMP echo.
- Compare active SA state on both peers after the event.
- Look for peer reboot, NAT mapping changes, or firewall idle-state expiration before changing cryptographic proposals.
Get-NetIPsecMainModeSAReferences
- Microsoft: Get-NetIPsecMainModeSA
- Microsoft Open Specifications: MS-IKEE product behavior
- IETF RFC 2409: Internet Key Exchange v1
Looking for a different code? Search another status or error code.