Fix 0X00003637 Error: IPsec IKE Invalid Lifetime Notify

The 30-Second Fix: Clear the Main Mode Registry Key

This error means the Windows IPsec stack isn't happy with the lifetime values the other end sent during IKE negotiation. The culprit here is almost always a stale registry entry for main mode SAs. Don't bother restarting the whole machine yet—that's overkill.

Open Regedit as admin and go to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent\Oakley

If you see a key called StrongCredentials or any custom lifetime entries like MainModeLifetimeMinutes or MainModeLifetimeDataSize, delete them. Don't touch the default ones—just the custom values you or some app added. Then reboot the Policy Agent service from an admin cmd:

net stop PolicyAgent
net start PolicyAgent

This clears the cached main mode SAs and forces a fresh negotiation. Test your VPN or IPsec connection right after. If it works, you're done. If not, move to the next step.

The 5-Minute Fix: Reset IPsec Policies with Netsh

The registry cleared nothing? Then the problem's likely a corrupted policy or a group policy that's got an invalid lifetime. Let's nuke the IPsec policies and rebuild them.

Open an elevated command prompt and run:

netsh ipsec static delete policy name=all
netsh ipsec static delete filterlist name=all
netsh ipsec static delete filteraction name=all

This wipes all static IPsec policies. Don't panic—Windows will recreate defaults. Then re-apply your VPN or IPsec connection. If you're using Windows built-in VPN, go to Settings > Network & Internet > VPN, delete your connection, and recreate it with the same settings.

For Windows Server users (2016, 2019, 2022), also run:

netsh ipsec dynamic delete all

This clears dynamic SAs. Then restart the PolicyAgent service again with the two net commands above. Nine times out of ten, this fixes the lifetime mismatch. If it doesn't, the problem's in the advanced policy settings.

The 15+ Minute Fix: Recreate Group Policy or Check Third-Party Software

Okay, the simple stuff didn't work. This means the lifetime mismatch is baked into a group policy or a third-party app like a VPN client or security suite.

Check Local Group Policy

Open gpedit.msc and go to Computer Configuration > Windows Settings > Security Settings > IP Security Policies on Local Computer. Look for any custom policy assigned. Double-click it, go to the Rules tab, edit the rule, and under Authentication Methods, check the advanced properties. Look for Key Exchange settings—you'll see lifetime options there.

Set the lifetime values to match your remote end. Typical values:

Lifetime (minutes): 480 (8 hours)
Lifetime (sessions): 0 (unlimited)
Data size (KB): 0 (unlimited)

If you see something weird like 5 minutes or 1000000 sessions, that's your problem. Change it, then assign the policy and run gpupdate /force from an admin cmd.

Third-Party VPN Clients

I've seen Cisco AnyConnect, Pulse Secure, and even OpenVPN cause this error by pushing bad lifetime values to Windows IPsec. Check your client settings for any IKE lifetime parameters and set them to match the remote server. Or temporarily disable the client and test with a simple L2TP/IPsec connection to see if the error vanishes.

Windows Firewall with Advanced Security

Sometimes connection security rules in WFAS have conflicting lifetimes. Open wf.msc, go to Connection Security Rules, and look for any rule that's set to Require Authentication or Require Encryption. Right-click, Properties, then Advanced tab. Ensure the Session Key Perfect Forward Secrecy is not checked unless the remote end supports it.

Also check Authentication Method—if it's set to Computer and User (Kerberos), try switching to Computer (Kerberos) for testing. Some devices can't handle the extra overhead.

Last Resort: Reset IPsec Stack Completely

If none of that works, reset the entire IPsec stack. Run these in order:

netsh int ip reset
netsh int ipv6 reset
netsh winsock reset

Reboot after each command. Yes, it's drastic, but I've seen it fix errors that nothing else could. After reboot, recreate your VPN connection from scratch.

Had this happen on a Windows 10 Pro machine connecting to a SonicWall TZ600. The SonicWall was set to a 28800-minute lifetime (20 days), but Windows default is 480 minutes. The 0X00003637 error popped every time after the initial authentication. Setting Windows to 480 fixed it immediately.

What NOT to Do

Don't disable Windows Firewall—it won't help and opens security holes.
Don't uninstall third-party antivirus. Just disable its firewall component temporarily.
Don't assume it's a certificate issue. The error code specifically says lifetime notify, not authentication.

If you're still stuck after all this, run netsh ipsec static show all and look for any custom lifetimes or filters you missed. Paste the output into a text file and compare it to a known-good machine's output. The mismatch will be obvious.