Fix ERROR_IPSEC_MM_FILTER_EXISTS (0X000032CE) in Windows

When This Error Shows Up

You're setting up IPsec on Windows Server (like 2019 or 2022) or maybe Windows 10 Pro. You open the Windows Firewall with Advanced Security, go to Connection Security Rules, and try to add a new main mode rule. Or you use PowerShell or netsh to create a main mode filter. And then—bam—this error: "The specified main mode filter already exists" with the code 0X000032CE.

I've seen this happen when someone tries to create a filter for the same source IP, destination IP, protocol, and port that's already in another rule. The error is Windows saying "hey, I already have this filter, can't add another."

Root Cause

Windows IPsec stores main mode filters in a hidden list. Each filter must be unique. If you've got two rules that use the exact same combination of source address, destination address, protocol, and port, you get this error.

The real problem is that Windows doesn't show you these filters easily. You might have an old rule left over from a previous setup, or a Group Policy pushed a duplicate. Or you just clicked "New Rule" twice without realizing it.

The Fix: Delete the Duplicate Filter

Step 1: Open Windows Firewall with Advanced Security

1. Press Win + R, type wf.msc, and hit Enter.
2. Click Connection Security Rules in the left pane.
3. Look through the list of rules. Find any rule that uses the same endpoints as the one you're trying to create. Right-click it and select Delete.
4. If you're not sure, delete all rules that aren't needed. You can always re-add them.

Step 2: Use netsh to List All Main Mode Filters

If the GUI doesn't show the filter, use the command line. Open Command Prompt as Administrator and run:

netsh ipsec static show mmsastats

This won't list the filters directly. Better to use:

netsh ipsec static show filterlist

Look for a filter list named something like "Main Mode Filter List" or whatever you named yours. If you see a duplicate, note the name. Then delete it:

netsh ipsec static delete filterlist name="Your Filter List Name"

Replace Your Filter List Name with the actual name (keep the quotes).

Step 3: Use PowerShell to Find and Remove Duplicates

PowerShell gives you more control. Run this to list all main mode filters:

Get-NetIPsecMainModeRule | Select-Object Name, DisplayName, Enabled

Look for the rule that matches your new filter. Then remove it:

Remove-NetIPsecMainModeRule -Name "NameOfTheRule"

If you're not sure which one, you can export the rules to a file first:

Get-NetIPsecMainModeRule | Export-Clixml C:\IPsecRules.xml

Then open that file in Notepad to see all the details.

Step 4: Clean Up and Retry

Once you've deleted the duplicate, try adding your new main mode filter again. If it still fails, reboot the machine—sometimes Windows caches the filter list.

If It Still Fails

Check Group Policy. If your computer is in a domain, a policy might be pushing the duplicate. Run gpresult /h C:\gpresult.html and open the file to see which policies apply. Look for IPsec settings.

Also check if the filter is in a different scope. A filter can exist for IPv4 and IPv6 separately. Make sure you're adding the right one.

Last resort: reset IPsec. Open PowerShell as Admin and run:

netsh ipsec static reset

This wipes all IPsec policies and filters. You'll lose all custom rules, so back them up first with netsh ipsec static export C:\backup.ipsec. Then after reset, re-import only what you need.

I know this error is annoying because it's not obvious where the duplicate lives. But once you clear out the old rule, you'll be fine. If you're still stuck, check the Windows Event Log under Applications and Services Logs > Microsoft > Windows > IPsec for more clues.