| Previous | Next |
| ERROR_IPSEC_KEY_MODULE_IMPERSONATION_NEGOTIATION_PENDING | ERROR_IPSEC_IKE_RATELIMIT_DROP |
ERROR_IPSEC_IKE_COEXISTENCE_SUPPRESS
The keying stack suppressed one SA to resolve protocol coexistence
Microsoft documents an IKE/AuthIP coexistence extension for peers that support both IKEv1 and AuthIP. The mechanism allows negotiation of AuthIP use over an IKEv1-capable relationship. This status records deletion caused by the coexistence suppression check, so it is not a normal lifetime expiry or peer timeout.
Look for parallel or near-simultaneous negotiations between the same endpoints. When both keying paths are possible, Windows can suppress one security association to avoid keeping incompatible or redundant state. The remaining SA and the selected keying module show whether the connection recovered normally.
What to inspect
- Identify whether the surviving association uses IKEv1 or AuthIP.
- Correlate simultaneous Main Mode negotiations for the same local and remote endpoints.
- Do not treat the deleted SA as proof of network loss; verify the coexistence-selected SA before changing policy.
Get-NetIPsecMainModeSAReferences
- Microsoft Open Specifications: IKE/AuthIP co-existence
- Microsoft Open Specifications: AuthIP overview
- Microsoft: Get-NetIPsecMainModeSA
Looking for a different code? Search another status or error code.