Fix 0x00003615 IPsec Soft SA Torn Down Error

This error hits during IPsec VPN rekey. It means Windows dropped a soft security association before the new one was ready. Fix it by adjusting IKE timeout or driver settings.

When You'll See This Error

You're connecting to a corporate VPN—usually L2TP/IPsec or IKEv2—from Windows 10, 11, or Server 2019/2022. The connection works fine for ten or fifteen minutes, then suddenly drops. You check the VPN event log or get a pop-up saying "ERROR_IPSEC_IKE_SOFT_SA_TORN_DOWN" with code 0x00003615. Sometimes the VPN reconnects automatically, sometimes it doesn't. It's always during a rekey—when the security association (SA) expires and Windows tries to negotiate a new one.

What's Really Happening

IPsec has a weird design: before the old SA expires, Windows creates a temporary "soft" SA to keep traffic flowing while the new one is negotiated. If the new SA negotiation takes too long—or the remote VPN server doesn't respond fast enough—Windows kills the soft SA. That tears down the tunnel. The error literally means "the soft SA was given up on."

The root cause is almost always one of two things:

Timeout mismatch – Your Windows machine waits longer than the remote server for the rekey response. The soft SA times out first.
Dead Peer Detection (DPD) misconfiguration – The DPD keep-alive intervals are too short or too long, causing the soft SA to be abandoned during rekey.

Most IT folks chase firewall rules or certificates, but the real fix is adjusting Windows' IKE retransmission timeout. Let's do that.

Fix It in 4 Steps

Step 1: Open Registry Editor

Press Win + R, type regedit, and hit Enter. Yes to the UAC prompt. You need admin rights.

Step 2: Create the IKE Extensions Key

In Registry Editor, go to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IKEEXT

Right-click the IKEEXT folder in the left pane, choose New > Key. Name it Parameters (if it doesn't exist already).

Step 3: Add the Retransmission Timeout

Inside the Parameters key, right-click in the right pane, choose New > DWORD (32-bit) Value. Name it MaxRetransmissionTimeoutSeconds.

Double-click it, set Base to Decimal, and type 30. Click OK.

Now create a second DWORD: name it RetransmissionAttempts, set it to Decimal, value 5.

Step 4: Reboot and Test

Close Registry Editor and restart your computer. After reboot, connect your VPN again. Let it run for thirty minutes. The 30-second retransmission timeout and 5 attempts give Windows enough room to complete the rekey without killing the soft SA.

What If It Still Fails?

Two things to check:

VPN server dead peer detection – On the remote VPN server (e.g., Windows RRAS, pfSense, or a hardware VPN), make sure DPD timeout is set to at least 60 seconds. Some devices send DPD probes every 10 seconds, which can interrupt the IKE negotiation.
Third-party VPN client – If you're using a custom client (like Cisco AnyConnect, SonicWALL, or OpenVPN), the soft SA error can come from the client itself. Update the client or check its IKE timeout settings.

In rare cases, this error is caused by a misconfigured IPsec policy. Go to secpol.msc and look at your IP Security Policies on Local Computer. If you have custom Quick Mode filters that specify a tight SA lifetime (like 5 minutes), increase it to 60 minutes.

Skip the wild goose chase with certificates and firewalls—90% of the time it's the IKE timeout. The registry fix above covers it.