What does Windows error code 13867 (ERROR_IPSEC_IKE_DECRYPT) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: IKE failed while decrypting a protocol payload from the peer.

Previous	Next
ERROR_IPSEC_IKE_ENCRYPT	ERROR_IPSEC_IKE_POLICY_MATCH

ERROR_IPSEC_IKE_DECRYPT

ERROR_IPSEC_IKE_DECRYPT (0x0000362B) Windows received an encrypted IKE payload that it could not decrypt. This often follows a mismatch in negotiated state, stale peer state, packet corruption, or an intermediary that causes packets from different exchanges to be mixed.

What to check

Check whether both peers recently rekeyed, restarted, or changed policy while the exchange was in progress.
Inspect NAT, load balancer, and asymmetric-routing conditions that can disturb IKE state.
Use a trace from both ends to compare cookies, message IDs, and the selected proposal.

netsh trace start capture=yes scenario=InternetClient

Microsoft: Netsh network tracing

Microsoft: Audit IPsec Main Mode

Microsoft: IPsec/IKE system error codes

Looking for a different code? Search another status or error code.