What does Windows error code 13861 (ERROR_IPSEC_IKE_INVALID_POLICY) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: IKE encountered an invalid IPsec policy.

Previous	Next
ERROR_IPSEC_IKE_ADD_UPDATE_KEY_FAILED	ERROR_IPSEC_IKE_UNKNOWN_DOI

ERROR_IPSEC_IKE_INVALID_POLICY

ERROR_IPSEC_IKE_INVALID_POLICY (0x00003625) The policy configuration selected for negotiation is invalid or internally inconsistent. The issue can be caused by incompatible authentication and crypto settings, invalid peer selectors, or an incomplete policy deployment.

What to check

Review the active Main Mode and Quick Mode rules, not only the policy source file.
Confirm that the same policy intent is present on both peers: authentication method, algorithms, lifetime, and protected traffic selectors.
Check whether a more specific GPO or local rule is overriding the policy you expected to use.

Get-NetIPsecMainModeRule; Get-NetIPsecQuickModeRule

Microsoft: Get-NetIPsecMainModeRule

Microsoft: Get-NetIPsecQuickModeRule

Microsoft: IPsec/IKE system error codes

Looking for a different code? Search another status or error code.