Fix ERROR_IPSEC_IKE_NEGOTIATION_DISABLED (0X0000363B)

Quick answer: The 0x0000363B error means Windows has an IPsec policy or firewall rule blocking IKE negotiation. Check three things: the local IPsec policy (netsh ipsec), the Windows Firewall (allow UDP 500 and 4500), and the registry key HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent\AssumeUDPEncapsulationContextOnSendRule.

This error shows up when you try to connect to a VPN or another device using IPsec, and the remote side sends a policy that says "no negotiation allowed." Maybe the remote firewall is misconfigured, or the local IPsec policy is set to block all IKE traffic. I've seen this on Windows 10 version 22H2, Windows Server 2019, and even Windows 11 after a group policy update. The real trigger is often a corporate security setting that forgot to whitelist your VPN.

Step-by-step fix

These steps assume you're on Windows 10 or 11, or Windows Server 2016+. Run everything as Administrator.

Step 1: Check the local IPsec policy

1. Press Win + R, type secpol.msc, and hit Enter. The Local Security Policy window opens.
2. On the left, expand Security Settings and click IP Security Policies on Local Computer.
3. Look for any policy listed. If there's a policy named "Client (Respond Only)" or "Server (Request Security)", that's usually fine. But if you see a policy with "Block" or "NoNegotiation" in the name, that's your problem.
4. Right-click the policy that's assigned (the one with a green checkmark) and select Unassign. Wait a few seconds — you should see the checkmark disappear.
5. Close secpol.msc. Then open Command Prompt as administrator and run: gpupdate /force. This refreshes group policies. After it completes, test your VPN connection.

Expected outcome: If the local policy was the culprit, the error should vanish immediately. If not, move to Step 2.

Step 2: Verify Windows Firewall allows IKE traffic

IKE (Internet Key Exchange) uses UDP ports 500 and 4500. If the firewall blocks these, negotiation fails.

1. Open Windows Defender Firewall with Advanced Security (type wf.msc in Run).
2. Click Inbound Rules. Look for rules named Core Networking - IKE or IPsec. There should be at least two: one for UDP 500 and one for UDP 4500.
3. If they're disabled, right-click each and select Enable Rule.
4. If they don't exist, create them manually. Click New Rule, choose Port, select UDP, enter 500,4500 in "Specific local ports", allow the connection, and apply to Domain, Private, and Public profiles. Name it "IKE Allow".
5. Also check Outbound Rules — same thing. Enable or create matching outbound rules for UDP 500 and 4500.

Expected outcome: After saving, try connecting again. If the error persists, move to Step 3.

Step 3: Update the registry for NAT traversal

This is a common fix when you're behind a router or corporate firewall that uses NAT. Without this, IKE packets may be dropped.

1. Press Win + R, type regedit, and hit Enter.
2. Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent
3. Right-click the PolicyAgent folder, select New > DWORD (32-bit) Value. Name it AssumeUDPEncapsulationContextOnSendRule.
4. Double-click that new value. Set it to 2 (decimal). Click OK.
5. Close regedit. Restart the IPsec Policy Agent service. Open Services.msc, find IPsec Policy Agent, right-click, choose Restart.

Expected outcome: After the restart, your VPN should connect. The 0x0000363B error should be gone.

Alternative fixes if the main steps fail

Sometimes the problem isn't local — it's the remote end. Try these:

• Contact your VPN admin. Ask them to check their IPsec policy. They might have a rule that disables negotiation for your IP. A common fix on the server side is to add an exception for your client's IP address.
• Try a different VPN protocol. If your VPN supports L2TP/IPsec, switch to SSTP or OpenVPN. That bypasses IKE entirely.
• Reset the IPsec stack. Run these commands in an elevated Command Prompt: netsh ipsec reset then netsh int ip reset. Restart the PC afterward. This clears all custom policies and defaults everything.
• Disable third-party firewall or antivirus. Temporarily turn off software like McAfee, Norton, or ZoneAlarm. Some of these override Windows Firewall and block IKE ports. If the connection works with them off, you need to add exceptions for UDP 500 and 4500 in that software.

Prevention tip

Once you fix it, prevent it from coming back. Group policies from your company might reapply the IPsec block. To stop that, ask your IT team to whitelist your VPN endpoint in their central IPsec policy. If you're on your own machine, create a scheduled task that runs gpupdate /force and then net start PolicyAgent every time you log in. That way, even if a policy overwrites your settings, the service restarts fresh. Also, keep a backup of your registry tweak — save the .reg file so you can reapply it in seconds.

I've seen this error pop up after a Windows Update (KB5021233 on Windows 10, for example) reset the IPsec policy. If the fix worked before and suddenly broke again, check for recent updates and reapply Step 3.