What does Windows error code 13909 (ERROR_IPSEC_IKE_NEG_STATUS_EXTENDED_END) mean?

ERROR_IPSEC_IKE_NEG_STATUS_EXTENDED_END

This constant marks the extended end of the IKE negotiation status range.

ERROR_IPSEC_IKE_NEG_STATUS_EXTENDED_END is Win32 error 13909 (0x00003655) in Windows IPsec, IKE, and AuthIP policy processing.

Likely impact: No negotiation remediation can be selected from a range delimiter alone.

Typical causes

• range enumeration leaks the sentinel.
• a version mismatch maps an unknown status to the final marker.
• generated code assumes every constant is returnable.
• telemetry validation accepts the boundary without an actual event.

Troubleshooting steps

1. Verify that classifiers recognize the extended boundary without converting it into an IKE negotiation result.
2. Collect original provider status and SDK and OS versions.
3. Correlate classification logic and accepted range with IKEEXT operational events, Windows Filtering Platform events, IPsec security audits, policy export, peer configuration, and packet capture.

Useful evidence

• Collect IKEEXT logs at the same time.
• Collect whether a Security Association attempt existed.

Recovery and retry

Update the mapping for the current extended range and retain unknown real statuses verbatim rather than replacing them with the marker.

Related errors

ERROR_IPSEC_IKE_NEG_STATUS_END is the older boundary; this constant marks the extended range endpoint

Example

A cross-version agent maps a newer IKE status to 13909. Updating its WinError table preserves the real code and removes the false marker event.

References

• Microsoft: exact Win32 system error range
• Microsoft: Audit IPsec Main Mode
• Microsoft: Windows Filtering Platform diagnostics