What does Windows error code 13811 (ERROR_IPSEC_IKE_QUEUE_DROP_MM) mean?

ERROR_IPSEC_IKE_QUEUE_DROP_MM

ERROR_IPSEC_IKE_QUEUE_DROP_MM identifies a queue-delay drop in the Main Mode portion of IKE. Main Mode creates the authenticated secure channel that Quick Mode later uses for traffic protection.

Queue pressure is often a consequence rather than the original fault. Identify the negotiations ahead of the dropped request and determine whether unreachable peers, policy churn, or repeated authentication failures are consuming Main Mode work.

What to check

• Check peer reachability and Main Mode audit events before focusing on application traffic.
• Investigate repeated negotiation storms, policy churn, or system resource pressure.
• Use a simultaneous trace on both endpoints to distinguish local queuing from peer non-response.

Microsoft: Audit IPsec Main Mode

Microsoft: Get-NetIPsecMainModeSA

Microsoft: Use Netsh to manage network traces