| Previous | Next |
| ERROR_IPSEC_IKE_QM_EXPIRED | ERROR_IPSEC_IKE_NEG_STATUS_END |
ERROR_IPSEC_IKE_TOO_MANY_FILTERS
Dynamic keying filters have grown beyond the accepted limit
Windows Filtering Platform separates filter-engine management from IKE/AuthIP and IPsec SA management. IKEEXT can add dynamic filters as negotiations and security requirements are materialized. This status means the number of dynamically added IKEEXT filters has become excessive.
Investigate filter churn and policy cardinality rather than only total network connections. Rapid creation of dynamic endpoints, overly broad rule generation, repeated negotiation failures, or a management component that continually changes policy can grow the dynamic set. A WFP state dump is useful only if collected before cleanup or restart removes the evidence.
What to inspect
- Count active IPsec SAs and identify peers or selectors that are being created repeatedly.
- Review effective rules for automation that expands large address sets into dynamic negotiations.
- Capture WFP and policy state before restarting IKEEXT or Base Filtering Engine.
Get-NetIPsecMainModeSA | Measure-Object
Get-NetIPsecQuickModeSA | Measure-ObjectReferences
- Microsoft: Windows Filtering Platform API sets
- Microsoft: Get-NetIPsecMainModeSA
- Microsoft: Get-NetIPsecQuickModeSA
Looking for a different code? Search another status or error code.