What does Windows error code 13900 (ERROR_IPSEC_IKE_REQUIRE_CP_PAYLOAD_MISSING) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: A required IKEv2 Configuration Payload was absent from the negotiation.

Previous	Next
ERROR_IPSEC_IKE_INNER_IP_ASSIGNMENT_FAILURE	ERROR_IPSEC_KEY_MODULE_IMPERSONATION_NEGOTIATION_PENDING

ERROR_IPSEC_IKE_REQUIRE_CP_PAYLOAD_MISSING

ERROR_IPSEC_IKE_REQUIRE_CP_PAYLOAD_MISSING means that the active Windows policy expected IKEv2 configuration information, but the required Configuration Payload (CP) was not present in the negotiation. CP is the protocol mechanism used to exchange data such as an internal tunnel address, DNS-related attributes, or other tunnel configuration.

This is not an address-pool exhaustion error. The key question is whether the peers agreed to exchange a CP at all. A static address configured on an interface does not by itself create a CP in IKEv2, and changing encryption or Diffie-Hellman settings will not add a missing CP.

What to compare on both peers

Whether the client is configured to request a virtual address or other IKEv2 configuration attributes.
Whether the responder is configured to return a CP for this connection type, identity, and address family.
The IKE_AUTH trace: look specifically for a CP payload and its CFG_REQUEST or CFG_REPLY type.
Whether the Windows rule requires a user or machine tunnel configuration that the non-Windows peer does not implement for this profile.

If the CP appears and the responder cannot allocate an address, investigate ERROR_IPSEC_IKE_INNER_IP_ASSIGNMENT_FAILURE instead. Keeping these two cases separate prevents a policy mismatch from being misdiagnosed as a depleted address pool.

References

Looking for a different code? Search another status or error code.