| Previous | Next |
| ERROR_IPSEC_IKE_BENIGN_REINIT | ERROR_IPSEC_IKE_INVALID_MAJOR_VERSION |
ERROR_IPSEC_IKE_INVALID_RESPONDER_LIFETIME_NOTIFY
Responder lifetime policy is below the accepted minimum
This is a negotiation-policy mismatch carried in a responder lifetime notification. The remote endpoint supplied a lifetime value that Windows considers below its configured minimum. It is not a generic certificate or cipher failure: the disagreement is specifically about how long the negotiated security association may remain valid.
IKE lifetimes drive rekey and expiration behavior. Different implementations or legacy policy templates can use incompatible values, and Windows may reject a responder value rather than silently accepting a lifetime outside local requirements. Compare policy on both peers and identify which side actually emitted the lifetime notification.
What to inspect
- Record Main Mode and Quick Mode lifetime settings on both peers.
- Check whether a third-party gateway applies a per-connection lifetime that differs from its displayed global policy.
- Change lifetime policy deliberately on the mismatched peer; do not disable authentication or select weaker crypto to address this code.
Get-NetIPsecMainModeCryptoSet
Get-NetIPsecQuickModeCryptoSetReferences
- IETF RFC 2409: Internet Key Exchange v1
- Microsoft: New-NetIPsecMainModeRule
- Microsoft: Get-NetIPsecQuickModeSA
Looking for a different code? Search another status or error code.