| Previous | Next |
| ERROR_IPSEC_IKE_SIMULTANEOUS_REKEY | ERROR_IPSEC_IKE_CRITICAL_PAYLOAD_NOT_RECOGNIZED |
ERROR_IPSEC_IKE_DH_FAIL
ERROR_IPSEC_IKE_DH_FAIL means IKE could not complete a Diffie-Hellman computation needed to establish shared keying material. The cause can be incompatible proposal groups, malformed peer data, or crypto-provider failure.
The useful comparison is the exact group selected on each endpoint and the key-exchange payload that followed it. A successful network connection to the peer does not rule out this cryptographic negotiation failure.
What to check
- Compare Diffie-Hellman groups offered and accepted by both peers.
- Check the trace for a preceding proposal or key-exchange payload error.
- Verify that the effective IPsec/IKE policy did not remove the only mutually supported group.
Microsoft: Get-NetIPsecMainModeSA
Looking for a different code? Search another status or error code.