| Previous | Next |
| ERROR_IPSEC_IKE_DECRYPT | ERROR_IPSEC_IKE_UNSUPPORTED_ID |
ERROR_IPSEC_IKE_POLICY_MATCH
ERROR_IPSEC_IKE_POLICY_MATCH (0x0000362C) The local and remote configuration did not produce a compatible policy match. The mismatch may involve peer identity, protected traffic selectors, authentication, algorithms, or rule scope.
What to check for ERROR_IPSEC_IKE_POLICY_MATCH
- Compare both peers’ Main Mode authentication and crypto proposals.
- Compare Quick Mode selectors, including local and remote subnets, ports, and protocols.
- Check which active connection-security rule Windows selected rather than assuming the intended rule won precedence.
Get-NetIPsecMainModeRule; Get-NetIPsecQuickModeRuleMicrosoft: Get-NetIPsecMainModeRule
Microsoft: Get-NetIPsecQuickModeRule
Microsoft: IPsec/IKE system error codes
Where the result is returned
This result is Win32 system error 13868 (0x0000362C) from winerror.h. AllStat describes it as “Policy match error”. The code is useful only together with the API that failed, because multiple Windows components can reuse system-error values while imposing different retry and cleanup rules.
Diagnostic sequence
- Call GetLastError immediately after the failing API and save this result, the function name, all relevant flags, and the target path, handle, service, device, account, or policy object.
- Capture the component log that owns the ipsec / ike / policy / match operation and retain the original numeric value before a framework converts it to an HRESULT or exception.
- compare preconditions with the API documentation and reproduce with a minimal request before changing system-wide configuration.
Retry this result only after the resource or state named in “Policy match error” has changed. For invalid parameters, unsupported formats, missing objects, policy restrictions, and access failures, correct the input or configuration instead of immediately repeating the same call.
Looking for a different code? Search another status or error code.