| Previous | Next |
| WSA_IPSEC_NAME_POLICY_ERROR | ERROR_IPSEC_QM_POLICY_NOT_FOUND |
ERROR_IPSEC_QM_POLICY_EXISTS
The conflict is a policy object, not an active security association
ERROR_IPSEC_QM_POLICY_EXISTS means a create or copy operation collided with an existing Quick Mode policy object. Quick Mode policy describes the protection proposals used for data traffic after peer authentication; it is different from a currently negotiated Quick Mode security association. Deleting an active SA therefore does not remove the configuration object that caused this error.
Check the same policy store that the failing operation targeted. Windows separates the persistent local store, Group Policy stores, and the combined read-only ActiveStore. A name can appear once in the target store even when another object with a similar display name is visible from a different source. If the intent is to change proposals, modify the existing set; if it is to clone one, assign a new unique name.
Useful checks before retrying creation
- Enumerate Quick Mode crypto sets in the explicit target policy store, not only the active resultant policy.
- Compare the stable object name as well as the localized display name.
- Trace the policy-store source when Group Policy and local configuration overlap.
- Do not treat established SAs from
Get-NetIPsecQuickModeSAas the object being created.
References
- Microsoft: enumerate Quick Mode cryptographic sets and policy stores
- Microsoft: active Quick Mode security associations
- RFC 4301: IPsec policy and security associations
Looking for a different code? Search another status or error code.