What does Windows error code 13904 (ERROR_IPSEC_IKE_PEER_DOESNT_SUPPORT_MOBIKE) mean?

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: The IKEv2 peer did not advertise the MOBIKE capability needed by this connection.

Previous	Next
ERROR_IPSEC_IKE_RATELIMIT_DROP	ERROR_IPSEC_IKE_AUTHORIZATION_FAILURE

ERROR_IPSEC_IKE_PEER_DOESNT_SUPPORT_MOBIKE

ERROR_IPSEC_IKE_PEER_DOESNT_SUPPORT_MOBIKE identifies a capability mismatch for MOBIKE, the IKEv2 mobility and multihoming extension. MOBIKE lets the outer addresses associated with an IKE SA and a tunnel-mode IPsec SA change when a client roams to another interface or a multihomed host moves traffic to a different path.

This status is about the outer transport path, not the virtual address inside the VPN. A peer can support ordinary IKEv2 while not advertising the MOBIKE_SUPPORTED capability. Whether the session may continue without MOBIKE depends on the effective connection policy and on whether mobility is actually required for that deployment.

What to verify

Inspect the IKE_AUTH exchange for the MOBIKE_SUPPORTED notification rather than inferring capability from a VPN client brand or version.
Determine whether the connection is expected to survive Wi-Fi, cellular, or public-address changes. If it is not, a profile that requires MOBIKE may be unnecessarily strict.
Confirm that both peers use IKEv2 and that NAT-traversal traffic on UDP 4500 is permitted where the implementation uses it.
Separate this from a certificate, EAP, or address-pool problem: those failures occur in different parts of the exchange.

For example, strongSwan documents MOBIKE as enabled by default for IKEv2 connections and uses UPDATE_SA_ADDRESS when route or address changes require a new outer path. The actual compatibility decision, however, must be taken from the trace and active policy of the affected peers.

References

Looking for a different code? Search another status or error code.