| Previous | Next |
| ERROR_IPSEC_IKE_COEXISTENCE_SUPPRESS | ERROR_IPSEC_IKE_PEER_DOESNT_SUPPORT_MOBIKE |
ERROR_IPSEC_IKE_RATELIMIT_DROP
ERROR_IPSEC_IKE_RATELIMIT_DROP is a protective admission-control result: Windows dropped an incoming request to create a new IKE Security Association because requests from that peer IP address exceeded the configured rate limit. It does not, by itself, prove that the peer's certificate, shared secret, or IKE proposal is wrong.
The relevant identity at this stage is usually the observed outer source address. That matters when many legitimate clients share one public address behind NAT, but repeated failures from one source can also be caused by a reconnect loop, an incompatible peer that restarts IKE_SA_INIT, or hostile traffic.
How to investigate without weakening protection first
- Correlate the event with the source address, source port, timestamp, and the number of concurrent clients behind the same NAT gateway.
- Check whether the client retries an IKE_SA_INIT request immediately after receiving a cookie, a timeout, or another rejection.
- Capture the initial exchange on both sides and verify that UDP 500 and, where NAT traversal is used, UDP 4500 are not being intermittently filtered or remapped.
- Review the active IPsec policy and DoS-protection settings before increasing limits or disabling throttling.
IKEv2 defines a COOKIE notification so a responder under load can require a retry that proves the initiator can receive packets at its claimed address. A local Windows rate-limit drop is not necessarily that standard cookie exchange, but both mechanisms exist to avoid allocating expensive state for uncontrolled requests.
References
Looking for a different code? Search another status or error code.