What does Windows error code 13905 (ERROR_IPSEC_IKE_AUTHORIZATION_FAILURE) mean?

ERROR_IPSEC_IKE_AUTHORIZATION_FAILURE

ERROR_IPSEC_IKE_AUTHORIZATION_FAILURE means that Security Association establishment was rejected by authorization policy. It is important not to reduce this to a generic authentication failure. Authentication establishes who the peer or user is; authorization decides whether that identity, the requested traffic, and the active policy are allowed to create the requested SA.

In Windows, IPsec policy is implemented through Windows Filtering Platform layers. Negotiation policy is evaluated for IKE/AuthIP, and later layers can use remote machine or user identity for authorization. Consequently, a valid certificate or Kerberos exchange can still be followed by an authorization rejection.

What to compare

• The effective IPsec rules and authentication sets on both endpoints, including policy delivered by GPO or another policy store.
• The peer identity actually established during negotiation, and whether the rule authorizes that computer, user, group, certificate issuer, or mapped account.
• The requested traffic selectors and connection scope. A policy can authorize one protected flow while rejecting another.
• Active main-mode and quick-mode SAs. Their presence or absence helps identify whether the rejection occurred before protected traffic was established.

Get-NetIPsecMainModeSA
Get-NetIPsecQuickModeSA

This status does not name one mandatory IKEv2 Notify payload. Use the local event data, the effective Windows policy, and a trace from both peers before changing certificates or cryptographic proposals.

References

• Microsoft: IPsec policy and authorization layers in WFP
• Microsoft: monitoring Main Mode Security Associations
• RFC 7296: IKE_AUTH error handling

Looking for a different code? Search another status or error code.