| Previous | Next |
| ERROR_IPSEC_MM_AUTH_IN_USE | ERROR_IPSEC_DEFAULT_MM_AUTH_NOT_FOUND |
ERROR_IPSEC_DEFAULT_MM_POLICY_NOT_FOUND
Main Mode establishes the authenticated key-management channel
ERROR_IPSEC_DEFAULT_MM_POLICY_NOT_FOUND means the configuration refers to a default Main Mode policy that is not available in the expected store. In Windows terminology, Main Mode selects algorithms and establishes the authenticated key-management SA; Quick Mode then negotiates protection for specific data traffic. A Quick Mode policy cannot substitute for the missing Main Mode object.
Inspect effective policy and its source before recreating defaults. Domain policy can replace local settings, and management software can query ActiveStore while accidentally writing to PersistentStore. Recreating a local default may have no effect when the active rule is supplied by Group Policy. Audit events for Main Mode negotiation help distinguish a missing configuration object from a peer-side cryptographic mismatch.
Configuration versus negotiation failure
- Confirm that a default Main Mode crypto set exists in the rule’s originating store.
- Check the resultant policy after Group Policy processing.
- Do not diagnose certificates or preshared keys until the policy object can be resolved.
- Use Main Mode audit events only after policy installation succeeds.
References
- Microsoft: Main Mode crypto sets and policy stores
- Microsoft: IPsec Main Mode auditing
- RFC 2409: IKE Phase 1 and Quick Mode terminology
Looking for a different code? Search another status or error code.