| Previous | Next |
| ERROR_IPSEC_IKE_INVALID_MM_FOR_QM | ERROR_IPSEC_IKE_TOO_MANY_FILTERS |
ERROR_IPSEC_IKE_QM_EXPIRED
The data-protection SA reached the end of its usable lifetime
Quick Mode security associations protect user traffic after negotiation. This status records expiration driven by the IPsec path, so it is different from Main Mode expiry and from a peer becoming silent. A Quick Mode SA can expire because its lifetime or other driver-managed lifecycle condition has been reached.
Normal IPsec operation rekeys or creates new SAs as old ones expire. The diagnostic issue is whether replacement succeeds before protected traffic is disrupted. Frequent expirations may be expected with short lifetimes, but repeated expiry followed by failed rekey points to negotiation, policy, or peer-state problems.
What to inspect
- Inspect Quick Mode SA lifetime and protection-suite details before the SA disappears.
- Check whether a replacement Quick Mode SA is established for the same selectors.
- Correlate traffic interruption with rekey failure rather than treating normal expiry as the root cause.
Get-NetIPsecQuickModeSA
Get-NetIPsecMainModeSAReferences
- Microsoft: Get-NetIPsecQuickModeSA
- Microsoft: Get-NetIPsecMainModeSA
- IETF RFC 4301: IPsec security architecture
Looking for a different code? Search another status or error code.