Fix IPsec IKE Process Err Natoa 0x00003645

Quick answer

Set DisableIKENATTraversal to 1 in the registry under HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent, then restart the IPsec service. That usually clears the error.

Why this happens

This error appears when a Windows machine tries to establish an IPsec tunnel through a NAT device and fails to process the NAT-OA payload. NAT-OA (NAT Original Address) is part of IKE's NAT traversal (NAT-T) extension, which lets two VPN peers discover each other's real addresses behind a router. When something goes wrong—like a firewall blocking UDP port 4500, or a router that mishandles the NAT-T payload—Windows throws 0x00003645.

I've seen this on Windows 10 and Windows Server 2016/2019, usually when a user is behind a home router or a corporate firewall that doesn't play nice with NAT-T. Sometimes it's a misconfigured VPN server that doesn't support NAT-T correctly. You might see the error in the Event Viewer under System with source IPsec.

The quick fix is to disable NAT-T altogether if you don't need it. Most VPNs work fine without it because they use other methods like PPTP or L2TP/IPsec. But if you rely on IKEv2, you'll need to keep NAT-T—so first try the registry tweak that forces Windows to handle NAT-OA differently.

Fix steps

Press Win + R, type regedit, and hit Enter. You'll get a User Account Control prompt—click Yes.
Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PolicyAgent. You might need to expand the tree: HKEY_LOCAL_MACHINE → SYSTEM → CurrentControlSet → Services → PolicyAgent.
Right-click on the right pane, select New → DWORD (32-bit) Value. Name it DisableIKENATTraversal.
Double-click the new value, set it to 1, and click OK. If you want to re-enable NAT-T later, change it back to 0.
Close Regedit. Now restart the IPsec service. Open an elevated Command Prompt (right-click Start → Command Prompt (Admin)). Type net stop policyagent then net start policyagent. You'll see the service stop and start messages.
Try your VPN connection again. If it connects, you're done.

After step 4, you might see a warning that the service needs to be restarted—don't ignore it. The registry change won't take effect until the service restarts.

If that didn't work: try these alternatives

Sometimes the issue is the router, not Windows. Here are other things to try in order:

Check firewall rules: Make sure UDP 500 and UDP 4500 are open on both the client and server. On the Windows firewall, run the command netsh advfirewall firewall add rule name="IPsec NAT-T" dir=in action=allow protocol=UDP localport=4500 in an admin command prompt.
Disable IPsec Hardware Offload: Some NICs have IPsec offload that breaks NAT-T. Go to Device Manager → Network adapters → right-click your adapter → Properties → Advanced tab. Look for "IPsec Offload" or "Hardware IPsec" and set it to Disabled. Then reboot.
Update your router firmware: If you're using a Linksys or Netgear home router, NAT-T bugs are common in older firmware. Check the manufacturer's site for an update.
Switch to IKEv2: If you can, change the VPN protocol to IKEv2 instead of IKEv1. IKEv2 has better NAT-T support. In Windows 10, you can add a VPN connection and pick "IKEv2" as the type.

Prevention tip

Once you've fixed the immediate problem, stop it from coming back. The registry change persists, but if you later update Windows, the setting might get reset. So check the registry value after major updates.

Better yet, avoid NAT-T altogether. Use a VPN that supports L2TP/IPsec or SSTP, which handle NAT more gracefully. I've had fewer issues with SSTP on Windows machines, especially behind corporate firewalls.

If you must keep NAT-T, make sure your VPN server is configured to send the NAT-OA payload correctly. On a Windows Server, you can check the IPsec policy and verify that the "NAT-T" option is enabled in the security association settings.

And keep an eye on your router—if it has a "VPN Passthrough" setting, make sure it's turned on. That's the most common cause I see for this error on home networks.