| Previous | Next |
| ERROR_IPSEC_IKE_ATTRIB_FAIL | ERROR_IPSEC_IKE_GENERAL_PROCESSING_ERROR |
ERROR_IPSEC_IKE_NEGOTIATION_PENDING
The keying exchange has not reached an established SA
This status is an in-progress result from the Windows IKE/AuthIP keying path. A policy match can trigger negotiation before protected traffic is allowed to use an IPsec security association. Main Mode establishes an authenticated peer relationship; Quick Mode then selects protection for matching IP traffic. A caller can therefore observe a pending state while messages, authentication, or key derivation are still being processed.
Treat the code as state, not as proof that the peer rejected the proposal. The useful distinction is whether the same negotiation later completes, fails with a more specific IKE status, or remains pending until a timeout. Repeatedly recreating policy while an exchange is active can make the trace harder to interpret.
What to inspect
- Compare active Main Mode and Quick Mode SAs before and after the event.
- Correlate Security audit events 4652 through 4655 with the peer address and negotiation time.
- If the state never resolves, capture the first later IKE error rather than treating PENDING as the root cause.
Get-NetIPsecMainModeSA
Get-NetIPsecQuickModeSAReferences
Looking for a different code? Search another status or error code.