| Previous | Next |
| ERROR_IPSEC_IKE_INVALID_PAYLOAD | ERROR_IPSEC_IKE_SOFT_SA_TORN_DOWN |
ERROR_IPSEC_IKE_LOAD_SOFT_SA
A soft SA is negotiation state, not yet durable protected traffic state
Windows distinguishes IKE negotiation state from established IPsec data-path security associations. This status records the loading of a soft SA, an intermediate object used while the keying subsystem coordinates security parameters and installation. It should not be read as evidence that application traffic is already protected by a completed Quick Mode SA.
The practical check is whether the temporary state is followed by an established Main Mode or Quick Mode SA, or instead by teardown and a more specific negotiation error. The WFP API separates IKE/AuthIP policy and SAs from IPsec policy and SAs, which is the architectural reason that a keying-stage status can appear before packet protection becomes active.
What to inspect
- Correlate the load with the peer and policy rule that triggered negotiation.
- Verify whether a Quick Mode SA appears afterward for the expected traffic selectors.
- If soft SAs repeatedly load and disappear, inspect the later failure or rekey event rather than the load status itself.
Get-NetIPsecMainModeSA
Get-NetIPsecQuickModeSAReferences
- Microsoft: Windows Filtering Platform API sets
- Microsoft: Get-NetIPsecMainModeSA
- Microsoft: Get-NetIPsecQuickModeSA
Looking for a different code? Search another status or error code.