What does Windows error code 13801 (ERROR_IPSEC_IKE_AUTH_FAIL) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: IKE authentication credentials were rejected by the peer or local IPsec policy.

Previous	Next
ERROR_IPSEC_IKE_NEG_STATUS_BEGIN	ERROR_IPSEC_IKE_ATTRIB_FAIL

ERROR_IPSEC_IKE_AUTH_FAIL

ERROR_IPSEC_IKE_AUTH_FAIL means IKE reached the identity-authentication stage, but the credential offered by one side was not accepted. This can involve a machine certificate, Kerberos identity, pre-shared key, or the authentication method required by an IPsec connection-security rule.

What to check

Compare the authentication method configured on both peers and on the active connection-security rule.
For certificate authentication, verify the certificate subject/SAN, EKU, private key and trust chain on the local machine.
For Kerberos, verify domain connectivity, time synchronization and the expected computer identity before changing IPsec settings.

Get-NetIPsecMainModeSA
Get-NetIPsecQuickModeSA

Microsoft: IKE/AuthIP authentication methods

Microsoft: Audit IPsec Main Mode

Microsoft: IPsec IKE system error codes

Looking for a different code? Search another status or error code.