What does Windows error code 13909 (ERROR_IPSEC_IKE_NEG_STATUS_EXTENDED_END) mean?

ERROR_IPSEC_IKE_NEG_STATUS_EXTENDED_END

This constant marks the extended end of the IKE negotiation status range.

Windows assigns decimal 13909 and hexadecimal 0x00003655 to ERROR_IPSEC_IKE_NEG_STATUS_EXTENDED_END. The constant belongs to Windows IPsec, IKE, and AuthIP policy processing; its name is not enough to identify the affected directory object, DNS zone, policy, installer, package, or resource context.

Operational meaning

The key question is whether classifiers recognize the extended boundary without converting it into an IKE negotiation result. The value describes the extended upper marker for the IKE negotiation status range; it does not prove that the whole domain, DNS service, network, servicing stack, application package, or operating system has failed.

Likely impact: No negotiation remediation can be selected from a range delimiter alone. Record the scope that was actually tested instead of escalating from one rejected object or phase to a system-wide outage.

Where the result appears

• This result can appear while processing the extended upper marker for the IKE negotiation status range.
• This result can appear while adding or validating Main Mode or Quick Mode policy offers.
• This result can appear while classifying IKE negotiation status values returned by policy or VPN components.
• It can appear while a firewall, VPN, or IPsec management tool that exposes Win32 policy status.

Typical causes

• range enumeration leaks the sentinel.
• a version mismatch maps an unknown status to the final marker.
• generated code assumes every constant is returnable.
• telemetry validation accepts the boundary without an actual event.

Diagnostic sequence

1. capture it immediately after the failing or status-returning call and record whether the API uses Win32, DNS_STATUS, HRESULT conversion, or callback semantics.
2. identify the exact target involved in the extended upper marker for the IKE negotiation status range, including stable GUIDs, DNs, zone names, package identities, file hashes, policy names, or process identifiers as applicable.
3. prove the state boundary: classifiers recognize the extended boundary without converting it into an IKE negotiation result.
4. collect original provider status and SDK and OS versions before restarting services, deleting objects, rebuilding packages, or changing policy.
5. correlate classification logic and accepted range with IKEEXT operational events, Windows Filtering Platform events, IPsec security audits, policy export, peer configuration, and packet capture.
6. determine whether the result is a failure, warning, informational completion, continuation request, or marker constant before choosing retry behavior.
7. after changing one responsible condition, repeat the same smallest operation and verify both success and absence of unintended partial effects.

Evidence to preserve

• collect original provider status.
• collect SDK and OS versions.
• collect classification logic and accepted range.
• collect IKEEXT logs at the same time.
• collect whether a Security Association attempt existed.

Correlate this evidence with IKEEXT operational events, Windows Filtering Platform events, IPsec security audits, policy export, peer configuration, and packet capture. Preserve raw identifiers and the first detailed diagnostic: translating everything to 13909 can hide whether the cause was validation, topology, authorization, replication, policy, file I/O, packaging, or an intentional continuation state.

Recovery and retry

The recovery objective for it is to update the mapping for the current extended range and retain unknown real statuses verbatim rather than replacing them with the marker.

Retry only after the recorded boundary changes and prior completion is known. Read-only discovery for it can usually be repeated with bounded backoff; directory mutations, DNS updates, policy installation, servicing actions, and PRI writes require a state check first. Backoff for it cannot repair malformed input, unsupported structure, identity collision, missing authority, or incompatible package metadata.

Telemetry and support fields

• record ipsec_ike_neg_status_extended_end_operation — producing API, command, callback, or servicing phase.
• record ipsec_ike_neg_status_extended_end_target — stable object, zone, policy, package, file, or account identity.
• record ipsec_ike_neg_status_extended_end_state_before and ipsec_ike_neg_status_extended_end_requested_state.
• record ipsec_ike_neg_status_extended_end_first_status — earliest component-specific code before translation.
• record ipsec_ike_neg_status_extended_end_server, ipsec_ike_neg_status_extended_end_process, UTC timestamp, and correlation ID.

A support bundle for it should include decimal 13909, hexadecimal 0x00003655, the smallest reproducible request, target identity, effective configuration, and evidence from the owning Windows component. When documenting it, remove secrets from exported logs but keep SIDs, GUIDs, package-family names, record types, and hashes when they are needed to distinguish objects.

Difference from nearby results

ERROR_IPSEC_IKE_NEG_STATUS_END is the older boundary; this constant marks the extended range endpoint This distinction determines whether the correct next step is input correction, topology repair, continuation, policy review, package rebuild, or no error handling at all.

Practical validation scenario

A cross-version agent maps a newer IKE status to 13909. Updating its WinError table preserves the real code and removes the false marker event. A negative test should reproduce it with the responsible condition preserved; the recovery test should alter only that condition and confirm the intended final state.

Developer and administrator guidance

Developers should model it explicitly in the result domain instead of collapsing every nonzero value into “failed.” Administrators should capture evidence before destructive remediation and use the component that owns the extended upper marker for the IKE negotiation status range. Monitoring for it should suppress range markers and classify warning, informational, cancellation, and continuation values separately from terminal failures.

References

• Microsoft: exact Win32 system error range — official context relevant to it.
• Microsoft: Audit IPsec Main Mode — official context relevant to it.
• Microsoft: Windows Filtering Platform diagnostics — official context relevant to it.

Looking for a different code? Search another status or error code.