| Previous | Next |
| ERROR_IPSEC_IKE_AUTHORIZATION_FAILURE_WITH_OPTIONAL_RETRY | ERROR_IPSEC_IKE_NEG_STATUS_EXTENDED_END |
ERROR_IPSEC_IKE_STRONG_CRED_AUTHORIZATION_AND_CERTMAP_FAILURE
ERROR_IPSEC_IKE_STRONG_CRED_AUTHORIZATION_AND_CERTMAP_FAILURE preserves two diagnostic signals. Windows could not authorize the Security Association because a sufficiently strong PKINIT-based credential was not available, and certificate-to-account mapping might also be involved. The combined name is not proof that both checks failed; it tells the investigator to examine both paths.
Certificate-to-account mapping is more than certificate-chain validation. In an IKE/AuthIP policy that uses mapping, the certificate is associated with a user or computer account in Active Directory so that Windows can obtain an access token and evaluate group-based authorization. A certificate can therefore be trusted and have a usable private key while still failing to identify the account required by the active rule.
Separate the two checks
- Credential strength: verify the selected certificate or smart-card credential, private-key access, trust, revocation, and the PKINIT requirements of the deployment.
- Account mapping: verify that mapping is enabled where the rule requires it, the certificate identifies the intended user or computer, and the resulting account is active and authorized.
- Policy scope: ensure that a machine credential is not being evaluated against a rule intended for a user identity, or the reverse.
- Evidence: correlate the Windows IPsec and identity events with the IKE trace from the same failed attempt.
Compared with ERROR_IPSEC_IKE_STRONG_CRED_AUTHORIZATION_FAILURE, this code adds certificate-to-account mapping as a possible second fault domain. Changing only the VPN address pool, traffic selector, or ESP cipher will not resolve either of those identity checks.
References
- Microsoft: certificate-to-account mapping in IKE/AuthIP
- Microsoft: planning certificate-based authentication and mapping
- RFC 4556: PKINIT
Looking for a different code? Search another status or error code.