Fix ERROR_IPSEC_IKE_MM_LIMIT 0X0000363A VPN Error

You're setting up a new VPN tunnel to a remote office, or maybe just reconnecting after a network hiccup, and bam — you get this error: ERROR_IPSEC_IKE_MM_LIMIT (0X0000363A). The exact text reads: "Maximum number of established MM SAs to peer exceeded." This usually pops up when you or the remote server has too many active main mode security associations (MM SAs) with the same peer. It's common on Windows Server boxes that handle lots of site-to-site VPNs or when a single peer keeps reconnecting without cleaning up old SAs.

Think of an MM SA like a handshake agreement between two devices. Each handshake takes up a slot. Windows has a default limit of 64 main mode SAs per peer. Once you hit that, any new connection gets rejected with this error. It's not a bug — it's a safety net. But if you're getting it, it means something's stacking up those handshakes without releasing them.

Root Cause in Plain English

The core issue is straightforward: the remote peer (or your own box) has reached the maximum number of allowed main mode SAs. This can happen for a few reasons:

Stale SAs not timing out — IPsec SAs have a lifetime (usually 480 minutes by default). If the peer drops offline, the SA lingers until it expires.
Aggressive reconnection — Some VPN clients or routers try to reconnect rapidly, creating new SAs before old ones expire.
Misconfigured Quick Mode (phase 2) — Sometimes a bug in the VPN policy triggers a new main mode negotiation every time Quick Mode fails, piling up SAs.
You're just busy — Maybe you genuinely have 65+ active tunnels to the same peer. Then you need more slots.

On Windows, the limit is set per peer. So if you connect to one remote gateway from many clients, you might hit the cap faster than you'd think.

How to Fix It — Step by Step

We'll start with the simplest fix: flush the old SAs. If that doesn't work, we bump up the limit. These steps work on Windows Server 2012 R2 through 2022, and Windows 10/11.

Step 1: Open an elevated Command Prompt

Click Start, type cmd, right-click "Command Prompt", and choose "Run as administrator." You'll see a UAC prompt — click Yes. This is required because we're modifying system networking settings.

Step 2: Check current MM SA count

Run this command to see how many main mode SAs exist for the peer causing trouble:

netsh ipsec dynamic show mmasa

You'll see a table listing peer IPs and SA counts. Look for the peer you're having issues with. If the count is 64 or more, that's your smoking gun. If you see 0, it could be a different peer or the limit hit on the remote side.

Step 3: Delete the stale SAs

To wipe all main mode SAs for a specific peer, use this command, replacing PEER_IP with the actual IP:

netsh ipsec dynamic delete mmasa peeraddr=PEER_IP

After you run it, the command returns nothing if it worked — that's normal. Immediately try your VPN connection again. If it connects, you're done. If it fails again right away, you might have a flapping connection that's recreating SAs faster than you can delete them. Move to Step 4.

Step 4: Increase the MM SA limit per peer

Windows doesn't let you change this through the GUI. You need a registry tweak. This sets the maximum number of main mode SAs allowed per peer. Default is 64. I usually set it to 256 or 512 — that's plenty for most setups.

Press Win + R, type regedit, hit Enter.
Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent
Right-click in the right pane, choose New > DWORD (32-bit) Value.
Name it: MaxMMSAperPeer
Double-click it, set Base to Decimal, and type the new limit (e.g., 256).
Click OK, close Registry Editor.
Reboot the machine, or restart the IPsec Policy Agent service:
```
net stop PolicyAgent && net start PolicyAgent
```

After the service restarts, the new limit is active. Try your VPN connection again.

Step 5: (Optional) Reduce SA lifetime

If you have many short-lived connections, reducing the main mode SA lifetime helps them expire faster. This is set in your VPN policy. Open Windows Firewall with Advanced Security, go to Connection Security Rules, find your rule, edit it, and under the "Authentication" tab, set the main mode SA lifetime to something like 120 minutes instead of 480. This forces cleanup more often without needing a reboot.

What to Check If It Still Fails

If you've flushed SAs, raised the limit, and you're still hitting this error, it's probably on the remote side. Their device — router, firewall, or server — also has a limit. Most enterprise VPN gateways (like Cisco ASA, Palo Alto, or Fortinet) have their own MM SA caps. You'll need to log into the remote device and either clear its SAs or increase its limit there. On a Cisco ASA, the command is clear crypto ipsec sa peer . On a Windows peer, you'd repeat the same steps on that machine.

Also check for duplicate IPs or flapping connections. If the same device keeps dropping and reconnecting, you might have a physical network issue — bad cable, duplex mismatch, or a dying NIC. Run a continuous ping to the peer while watching the SA count. If it climbs steadily, you've got a reconnection loop. Fix the underlying connectivity first.

One last thing: if this is a site-to-site VPN and you're using NAT traversal, make sure both sides agree on the NAT keepalive interval. Mismatched settings can cause SAs to time out prematurely or stack up. Keep it simple — set both to 20 seconds and see if that helps.