0XC0220032: IKE policy can't contain Extended Mode policy fix
This Windows error pops up when setting up VPN or IPsec rules. It means your IKE policy has an option that doesn't work with Extended Mode. The fix is simple: turn off Extended Mode.
When this error hits
You're setting up a VPN connection or a custom IPsec rule in Windows Firewall with Advanced Security (WFAS). Maybe you're on Windows 10 Pro 22H2 or Windows 11 23H2. You get this error: STATUS_FWP_EM_NOT_SUPPORTED (0XC0220032). The full message says something like "An IKE policy cannot contain an Extended Mode policy."
I first ran into this on a client's machine when they tried connecting to a third-party VPN that used aggressive mode. Windows just rejected it. This tripped me up the first time too.
What's going on
The error means your IPsec or IKE policy has both an Extended Mode (also called Aggressive Mode) phase and a standard Main Mode phase defined together. Windows doesn't allow that. It's like trying to use two different handshake rules at the same time — the system gets confused.
Extended Mode is an older, less secure way to negotiate IPsec. Windows supports it only for specific scenarios (like some VPNs), but you can't mix it with a normal IKE policy that uses Main Mode. The fix is to remove the Extended Mode setting from the policy, or create a separate rule that doesn't use Main Mode.
How to fix it
Step 1: Open Windows Firewall with Advanced Security
Press Win + R, type wf.msc, and hit Enter. This opens the firewall snap-in.
Step 2: Find your IPsec rule
In the left pane, click Connection Security Rules. Look for the rule that's causing the error. It might be the one you just created or an existing one. Double-click it.
Step 3: Check the Authentication Method
Go to the Authentication tab. If you see an option like Extended Mode (IKEv1) or Aggressive Mode selected, that's the problem. Windows will show a warning but still let you save it — which triggers the error later.
Step 4: Change the authentication method
Click Edit. Under the Advanced section, change the setting from Extended Mode (IKEv1) to Main Mode (IKEv1). Or, if you don't need Extended Mode at all, pick Computer and User (Kerberos) or Certificate — these don't use Extended Mode.
Important: Don't mix both modes. If your VPN needs Extended Mode, create a separate rule just for that traffic and don't include a Main Mode phase.
Step 5: Apply and test
Click OK twice to save. Now try your VPN or IPsec connection again. The error should be gone.
If it still fails
Sometimes the error comes from a Group Policy set by your IT department. Check these:
- Local Group Policy Editor — open
gpedit.msc, go to Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Object Access, and see if any IPsec policies are enforced. If so, talk to your admin. - Registry — look in
HKLM\SOFTWARE\Policies\Microsoft\Windows\IPsecfor anyExtendedModekeys. Delete them if you're comfortable. - VPN client software — some third-party VPN clients (like Cisco AnyConnect or Pulse Secure) install their own IPsec policies that conflict. Uninstall the client, clean the policies, then reinstall.
One more thing: if you're on Windows 10 or 11 Home edition, the Firewall with Advanced Security doesn't show Connection Security Rules properly. You'll need to use PowerShell. Run as admin and type:
Get-NetIPsecRule | Where-Object {$_.Phase1AuthSet -ne $null}This lists all rules. Find the one with Extended Mode and remove it using Remove-NetIPsecRule.
Final thought
This error is annoying but easy to fix once you know where to look. I've seen it mostly on Windows 10 22H2 and Windows 11 23H2 when people try to set up a VPN with non-Microsoft clients. Just remember: Main Mode and Extended Mode don't mix. Pick one.
Was this solution helpful?