| Previous | Next |
| ERROR_IPSEC_IKE_DOS_COOKIE_SENT | ERROR_IPSEC_IKE_CGA_AUTH_FAILED |
ERROR_IPSEC_IKE_SHUTTING_DOWN
Negotiation stopped because the local keying subsystem is exiting
The failure is local service lifecycle, not peer negotiation. IKE/AuthIP processing is shutting down, so new or in-flight exchanges can be terminated before they establish or refresh security associations. Certificate, proposal, and network troubleshooting are secondary until service state is stable.
Correlate the status with IKEEXT, Base Filtering Engine, firewall, and IPsec service events. Planned shutdown, service restart, system shutdown, policy-component failure, or administrative action can all remove SA state. After startup, confirm that policy is reloaded and new Main Mode and Quick Mode SAs can be negotiated.
What to inspect
- Identify what initiated the service or system shutdown.
- Check for surrounding IPsec service shutdown and startup audit events.
- Verify SA recovery after services return instead of repeatedly retrying the original connection during shutdown.
Get-Service IKEEXT, BFE
Get-NetIPsecMainModeSAReferences
- Microsoft: IPsec audit events
- Microsoft: Windows Filtering Platform API sets
- Microsoft: Get-NetIPsecMainModeSA
Looking for a different code? Search another status or error code.