What does Windows error code 13864 (ERROR_IPSEC_IKE_DH_FAILURE) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: Diffie-Hellman key exchange failed during IKE negotiation.

Previous	Next
ERROR_IPSEC_IKE_INVALID_SITUATION	ERROR_IPSEC_IKE_INVALID_GROUP

ERROR_IPSEC_IKE_DH_FAILURE

ERROR_IPSEC_IKE_DH_FAILURE (0x00003628) The IKE peer exchange could not complete the Diffie-Hellman calculation needed to establish shared keying material. The common practical cause is a mismatch in allowed DH groups or a peer that cannot process the selected proposal.

What to check

Compare the allowed Main Mode/IKE proposals and DH groups on both endpoints.
Check software and firmware compatibility for the VPN gateway, especially after changing cryptographic policy.
Collect Main Mode audit events or a trace to determine which proposal was selected immediately before failure.

Get-NetIPsecMainModeRule

Microsoft: Get-NetIPsecMainModeRule

Microsoft: Audit IPsec Main Mode

Microsoft: IPsec/IKE system error codes

Looking for a different code? Search another status or error code.