Windows error 13888 (ERROR_IPSEC_IKE_UNEXPECTED_MESSAGE

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: IKE received a message ID outside the expected exchange.

Previous	Next
ERROR_IPSEC_IKE_CERT_CHAIN_POLICY_MISMATCH	ERROR_IPSEC_IKE_INVALID_AUTH_PAYLOAD

ERROR_IPSEC_IKE_UNEXPECTED_MESSAGE_ID

The packet does not belong to the state-machine exchange being processed

IKE uses message identifiers to correlate packets with exchanges and to distinguish new work from retransmission or unrelated traffic. This status means the received identifier was not expected for the current SA and exchange state. It is more specific than a generic malformed-packet error.

Stale packets, retransmission after one side discarded state, simultaneous rekey, NAT or load-balancer path changes, and implementation defects can all create message/state mismatches. Packet order and the cookies or SPIs identifying the parent SA are essential context; examining the message ID alone is insufficient.

What to inspect

Capture the full IKE header and identify the parent SA, exchange type, and message ID sequence.
Check whether either peer restarted or deleted the SA before the unexpected packet arrived.
Look for duplicate paths or middleboxes that can delay and replay old UDP traffic.

References

Looking for a different code? Search another status or error code.