What does Windows error code 13897 (ERROR_IPSEC_IKE_NEG_STATUS_END) mean?

ERROR_IPSEC_IKE_NEG_STATUS_END

This constant marks a historical end of the IKE negotiation status range.

ERROR_IPSEC_IKE_NEG_STATUS_END is Win32 error 13897 (0x00003649) in Windows IPsec, IKE, and AuthIP policy processing.

Likely impact: Treating the boundary as a failure creates false incidents and unnecessary tunnel resets.

Typical causes

• an old range check emits its end sentinel.
• status-table enumeration includes marker values.
• a wrapper cannot distinguish constants from returned errors.
• telemetry normalization substitutes the boundary for an unknown status.

Troubleshooting steps

1. Verify that software uses the constant only as a range delimiter and does not report it as a peer failure.
2. Collect call stack that produced 13897 and raw status before translation.
3. Correlate range-check source and SDK version with IKEEXT operational events, Windows Filtering Platform events, IPsec security audits, policy export, peer configuration, and packet capture.

Useful evidence

• Collect nearby IKEEXT diagnostic.
• Collect peer and tunnel identity if a real negotiation occurred.

Recovery and retry

Correct the status mapping and preserve the original real error; do not change IPsec policy solely because this boundary value was logged.

Related errors

ERROR_IPSEC_IKE_NEG_STATUS_BEGIN marks the lower boundary; this value marks an older end boundary

Example

An SDK table walker sends every defined symbol to monitoring, including 13897. Filtering marker constants leaves only actionable IKE statuses.

References

• Microsoft: exact Win32 system error range
• Microsoft: Audit IPsec Main Mode
• Microsoft: Windows Filtering Platform diagnostics