| Previous | Next |
| ERROR_IPSEC_IKE_UNEXPECTED_MESSAGE_ID | ERROR_IPSEC_IKE_DOS_COOKIE_SENT |
ERROR_IPSEC_IKE_INVALID_AUTH_PAYLOAD
The authentication proposal cannot be accepted as a valid offer set
This status concerns the authentication payload or offer set itself, not merely failed verification of otherwise valid credentials. Windows could not accept the received authentication offers in the current negotiation. That can reflect unsupported methods, structurally invalid combinations, or offers that do not fit the active keying protocol and policy context.
Compare the actual proposals exchanged on the wire with the Phase 1 and, where applicable, Phase 2 authentication sets. Windows can offer certificate, Kerberos, NTLM, pre-shared-key, and other policy-specific methods through NetSecurity objects; the ordering and applicable rule matter.
What to inspect
- Record the authentication methods actually offered by both peers.
- Verify the active rule is linked to the expected authentication set.
- Do not rotate certificates or passwords until you know the failure is credential verification rather than an invalid offer payload.
Get-NetIPsecPhase1AuthSet
Get-NetIPsecPhase2AuthSetReferences
Looking for a different code? Search another status or error code.