What does Windows error code 13894 (ERROR_IPSEC_IKE_INVALID_MM_FOR_QM) mean?

 
Previous Next
ERROR_IPSEC_IKE_PROCESS_ERR_NATOA ERROR_IPSEC_IKE_QM_EXPIRED

ERROR_IPSEC_IKE_INVALID_MM_FOR_QM

The child traffic negotiation is incompatible with its parent SA

Quick Mode runs in the context of an established Main Mode SA. Windows documents that the Main Mode relationship supplies the authenticated peer channel within which Quick Mode negotiates the protection suite for IP traffic. This status means the selected Main Mode parameters are not valid for the requested Quick Mode negotiation.

Compare the parent Main Mode SA with the rule and selectors that triggered Quick Mode. Policy merge, multiple Main Mode rules, authentication requirements, or an old parent SA established before policy change can leave a child negotiation associated with an unsuitable parent context.

What to inspect

  • Associate the failing Quick Mode attempt with its Main Mode SA and remote peer.
  • Compare active Main Mode parameters with the current effective IPsec rule and crypto sets.
  • If policy changed, remove stale SAs through supported management and let the peers negotiate a fresh parent context.
Get-NetIPsecMainModeSA
Get-NetIPsecQuickModeSA
Get-NetIPsecRule -PolicyStore ActiveStore

References

Looking for a different code? Search another status or error code.