What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Error 0x0000363C is the Win32 code ERROR_IPSEC_IKE_QM_LIMIT. It means an IPsec/IKE VPN negotiation has reached the quick-mode limit associated with a main-mode security association; Microsoft describes the condition as: “Reached maximum quick mode limit for the main mode. New main mode will be started.”
This is a VPN-tunnel and peer-policy problem, not a generic Windows Update, activation, display, printer, or malware message. The reliable fix is to identify which endpoint is repeatedly negotiating, retire stale security associations through the VPN product’s documented procedure, and make the phase-1 and phase-2 policies agree on both sides. Windows 11 and Windows 10 do not provide one universal command that changes this limit.
As an Amazon Associate I earn from qualifying purchases.
What error 0x0000363C means
Microsoft’s MS-ERREF Win32 error-code specification identifies hexadecimal 0x0000363C as ERROR_IPSEC_IKE_QM_LIMIT. The complete message is “Reached maximum quick mode limit for the main mode. New main mode will be started.” The wording identifies the protocol layer involved: Internet Protocol Security (IPsec) using Internet Key Exchange (IKE).
IKE creates security associations (SAs) before encrypted traffic can pass. A main-mode exchange establishes the IKE relationship between peers. Quick mode then negotiates the IPsec data-channel SAs that protect the selected traffic. The error indicates that the quick-mode associations tied to the current main mode have reached a limit. The protocol response is to start a new main mode rather than continue adding quick-mode associations to the exhausted one.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
That message does not, by itself, prove that Windows is damaged. It also does not identify a single numeric setting that every Windows installation shares. The limit, the way SAs are retired, and the controls available to an administrator depend on the VPN client, gateway, peer configuration, and deployment policy.
Why an IPsec tunnel reaches the quick-mode limit
Repeated rekey negotiations
Quick-mode SAs are replaced as they expire or approach their rekey margin. If a client or gateway repeatedly starts a new negotiation before the old association is retired, the number of active or recently created SAs can grow until the main-mode limit is reached. A peer that continually initiates negotiations can produce the same pattern.
Stale security associations
An interrupted tunnel, a device reboot, a failed rekey, or a network outage can leave one peer believing an SA still exists while the other peer has already discarded it. Subsequent attempts may create additional associations instead of cleanly replacing the stale one. The resulting buildup is a tunnel-state problem, not something that a normal disk cleanup resolves.
Free tools Windows power users keep installed
One-click scans. No signup required.
Policy mismatches
Both ends must agree on the phase-1 and phase-2 parameters. Differences in encryption or authentication algorithms, SA lifetimes, rekey margins, peer identity, or traffic selectors can cause a negotiation to fail and retry. Those retries can exhaust the quick-mode allowance even when each individual policy value looks reasonable in isolation.
Incorrect interpretation of the log source
The code may be displayed by a Windows VPN component, a third-party client, a firewall, a router, or an application that wraps the VPN library. A message shown by Windows is not proof that Windows is the endpoint making the wrong decision. Always identify which device logged the code and compare its timestamp with the remote peer.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Before changing the tunnel, capture the context
Collecting evidence first prevents a restart from erasing the clues needed to find the recurring cause. Record the following for the same failure window:
- Exact source. Note whether 0x0000363C appears in Windows Event Viewer, the VPN client’s diagnostic log, an appliance log, or an application status window. Copy the surrounding messages, not just the code.
- Windows details. Record whether the device runs Windows 11 or Windows 10, the edition and build shown under Settings > System > About, and whether the failure began after an update, reboot, sleep cycle, or network change.
- VPN identity. Write down the client or gateway product, its version, the tunnel name, the remote peer, and whether the connection is remote-access or site-to-site. Do not assume two tunnels using the same protocol share the same limits.
- Timing. Note when the tunnel last worked, when the first failure appeared, how often the message returns, and whether it follows a predictable rekey interval. Include the local time zone used by each log.
- Connection impact. Record whether all traffic fails, only selected subnets fail, or the tunnel reconnects briefly before dropping. Note whether existing sessions are interrupted when the error appears.
- Recent changes. List policy edits, certificate or identity changes, gateway firmware changes, client upgrades, ISP or firewall changes, and maintenance that could have left one peer with a different configuration.
Preserve the original logs before clearing anything. If the VPN product can export its configuration or SA state, save that export according to your organization’s security policy and remove secrets before sharing it.
Locate the failing negotiation on both peers
Check Windows and the VPN client
Open Event Viewer and review the VPN, IPsec, IKE, and related networking channels around the recorded timestamp. The exact channel names vary by Windows build and by the VPN software. Look for sequences rather than an isolated line: a rekey request, an authentication or proposal failure, an SA deletion, a timeout, and then a new negotiation. The sequence tells you whether the code follows repeated retries or appears after a clean restart.
Use the VPN client’s own diagnostic or connection-history view as well. Compare its tunnel name, peer address, and policy identifiers with the Windows event. A client may report a friendly connection name while the appliance identifies the same tunnel by an interface, profile, or peer ID.
Check the remote gateway or firewall
Obtain the corresponding log entries from the other endpoint. Confirm that both logs show the same failure time and peer. Inspect whether the gateway is deleting old quick-mode SAs, refusing a proposal, or receiving new initiation requests before the prior exchange has finished. If only one side reports the code, the other side’s state and policy may explain why.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Count and timestamp SAs
Where the VPN product exposes current security associations, record the number, creation time, expiry time, and traffic selectors for the affected tunnel. Do not rely on a single count taken after a restart; capture the state before remediation if the product allows it. A rising count of short-lived SAs points toward rekey or policy churn, while one long-lived stale SA may indicate an interrupted cleanup.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Compare phase-1 and phase-2 policy
Compare the exported or documented settings line by line on both peers. The labels differ among products, but the concepts are the same.
| Policy area | What to compare | Why a difference matters | Safe action |
|---|---|---|---|
| Phase 1 (main mode) | IKE version, encryption, integrity or authentication method, key exchange parameters, peer identity, and main-mode lifetime | A peer may reject or repeatedly restart the IKE relationship instead of maintaining one stable main mode | Use a proposal supported by both peers and document the previous value before changing it |
| Phase 2 (quick mode) | IPsec encryption and integrity algorithms, perfect-forward-secrecy or equivalent keying choices where configured, and quick-mode lifetime | Each retry can create another data-channel SA when the proposal or lifetime cannot be agreed | Choose a matching proposal and verify the peer accepts it before applying the change broadly |
| Rekey margin | How early each side begins replacement and whether both sides initiate | Overlapping initiations can create rapid SA churn and leave old associations active | Coordinate the margin and initiator behavior with the remote administrator |
| Peer identity | Addresses, fully qualified names, certificates, pre-shared-key identity fields, and authentication mapping | A mismatch can cause authentication retries that look like a tunnel instability problem | Match the identity expected by each endpoint; do not weaken authentication just to stop the message |
| Traffic selectors | Local and remote networks, ports, protocols, and any narrow or split-tunnel rules | Different selectors can cause repeated quick-mode proposals for traffic the peer does not accept | Make the protected networks and selector order identical where the product requires it |
Change one related group at a time and record the before-and-after values. A proposal that is valid on one gateway may not be supported by the remote peer, so “stronger” or newer is not automatically compatible. If the tunnel is managed by another team, exchange the policy export or a redacted parameter list instead of relying on screenshots.
Manual remediation sequence
1. Stop unnecessary parallel attempts
Pause automated reconnects or duplicate VPN profiles only if your change policy permits it and if doing so will not strand users who need the tunnel. Confirm that a single intended client or gateway is responsible for the next test. Multiple clients, overlapping site-to-site definitions, or a monitoring system that immediately retries can repopulate the quick-mode associations while you are troubleshooting.
2. Retire stale SAs through the documented product procedure
Use the VPN client, firewall, or gateway’s supported action for disconnecting and clearing the affected tunnel’s security associations. Product interfaces may call this disconnect, clear SAs, flush tunnel state, or restart the IPsec service. Select only the affected peer when the interface allows it. A broad IPsec restart can drop unrelated tunnels and is not a substitute for understanding which SA is stale.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Perform the operation during an approved maintenance window. Existing connections using that tunnel can drop immediately, and a site-to-site restart can interrupt applications at both locations. If the product offers a graceful rekey or retire operation, prefer it over an abrupt service restart; if it does not, notify users and confirm that the remote administrator is ready to observe the reconnect.
3. Start one clean negotiation
After stale state is retired, bring up the tunnel once and watch both peers. Confirm that one main-mode relationship is established, that the expected quick-mode SAs appear, and that the selectors cover the required networks. Avoid repeatedly clicking Connect while the first negotiation is still pending. Save the new timestamps and compare them with the earlier failure sequence.
4. Align lifetimes and rekey behavior
If the error returns as the tunnel approaches rekey, compare the phase-1 and phase-2 lifetimes and rekey margins again. The values do not need to be identical in every implementation, but they must produce a handoff that both peers understand. Coordinate which side initiates replacement and ensure that the old SA is deleted after the new one is confirmed. Apply the smallest change that removes the mismatch, then observe more than one rekey cycle before making another adjustment.
5. Correct identities and traffic selectors
Check that the peer address or name, certificate or pre-shared-key identity, local and remote subnets, and any port or protocol restrictions match on both ends. A tunnel that connects for one subnet but fails when another application starts may be creating additional quick-mode proposals for selectors that the peer does not recognize. Correct the selector definition rather than repeatedly clearing SAs.
6. Test with controlled traffic
Once the tunnel is established, test a small set of known hosts in each protected network. Verify that the expected routes and applications work, then leave the connection under observation through the next scheduled rekey. Record whether the number of SAs remains stable, whether old associations expire, and whether either peer initiates unexpected negotiations.
7. Roll back if the change worsens the tunnel
Keep the original policy export, screenshots, and maintenance notes. If a proposal change prevents negotiation, restore the prior values on the side you control, clear the resulting failed state through the documented procedure, and coordinate the matching rollback on the peer. Do not stack several unrecorded changes; that makes it impossible to tell whether the original limit, a new mismatch, or a partial rollout is responsible.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choosing the least disruptive remediation
The appropriate action depends on what the logs show. Use this comparison before scheduling a change:
| Option | Where the change occurs | What it addresses | Expected interruption | Compatibility and rollback considerations |
|---|---|---|---|---|
| Clear or retire the affected SAs | VPN client, firewall, or gateway | Stale state or a buildup of old quick-mode associations | Active sessions may drop; a controlled reconnect is normally required | Usually the smallest policy change; follow the product’s documented scope and recovery steps |
| Restart only the affected tunnel | Either peer, preferably coordinated | A tunnel that cannot cleanly replace its current associations | Short outage for that tunnel while negotiation restarts | Confirm that unrelated tunnels are not included and that both administrators can monitor the result |
| Align phase-1 proposals | Windows client or VPN peer, as required | Main-mode negotiation retries caused by incompatible algorithms, identity, or lifetime | Usually requires a reconnect; duration depends on the deployment | Both peers must support the selected proposal; retain the previous configuration for rollback |
| Align phase-2 proposals and selectors | Both tunnel endpoints | Quick-mode retries caused by incompatible algorithms, lifetimes, or protected networks | Traffic may be interrupted while the tunnel is renegotiated | Change both sides as one coordinated operation and test every protected network |
| Escalate without changing policy | VPN vendor, gateway administrator, or Microsoft support | A recurring limit with unclear ownership or no documented control | No additional outage until the approved fix is scheduled | Provides the safest path when the product’s SA controls or limits are not documented |
There is no universally safe choice based on the error code alone. Clearing state is appropriate when logs show stale associations; changing lifetimes or proposals is justified only when the comparison demonstrates a mismatch or a rekey pattern. If the tunnel carries critical traffic, obtain a rollback plan and an outage estimate from the VPN administrator before touching either peer.
Recommended Free Tools
What not to do
- Do not treat the code as a Windows Update or activation error. Reinstalling Windows components, changing a product key, or resetting display and printer settings does not address an IPsec quick-mode limit.
- Do not paste registry edits or generic
netshcommands from an unsourced guide. The numeric defaults and commands sometimes quoted for this condition are deployment-specific and are not a Microsoft-verified universal way to change the limit. An incorrect edit can disable a working tunnel or affect other IPsec connections. - Do not assume a larger limit is the cure. If a peer is repeatedly initiating or failing policy checks, allowing more associations can hide the cause while increasing stale state.
- Do not clear every tunnel as a first response. A global flush can disconnect unrelated users and erase evidence needed to identify the offending peer.
- Do not weaken authentication or encryption merely to make the error disappear. Any proposal change must be approved by both endpoint owners and evaluated for compatibility and security.
- Do not keep reconnecting during a pending exchange. Parallel retries can create the very quick-mode buildup that triggered the message.
Windows 11 and Windows 10 considerations
The code has the same protocol meaning on Windows 11 and Windows 10: it identifies an IPsec/IKE quick-mode limit condition. The exact event wording, client controls, and available diagnostics can vary with the Windows build and the VPN software layered on top of it. For that reason, use the build number and client version in your escalation record rather than assuming that a procedure shown for one release applies unchanged to another.
Windows version alone also does not tell you where the corrective setting lives. A profile managed by an organization may receive its policy from a gateway, mobile-device-management system, or VPN client. In those cases, a local edit can be overwritten at the next policy refresh or can leave the two peers out of sync. Identify the policy owner before changing a setting.
When to escalate
Escalate to the VPN vendor, the gateway administrator, or Microsoft support when the condition recurs after a coordinated SA cleanup and policy comparison, when you cannot identify which endpoint owns the tunnel state, or when the product does not document how to retire associations safely. Escalation is also appropriate if the tunnel protects production traffic and a restart would exceed the approved outage window.
Send a concise evidence package:
- Windows edition and build, VPN client or gateway model and software version, and the affected tunnel or peer identifier.
- Logs from both endpoints covering the same time range, with the 0x0000363C entry and the preceding and following negotiation messages.
- SA counts, creation and expiry timestamps, and any evidence of repeated rekey attempts or stale associations.
- Redacted phase-1 and phase-2 policy exports, including algorithms, lifetimes, rekey margins, peer identities, and traffic selectors.
- A timeline of restarts, SA clears, policy changes, and test results, including which users or networks were interrupted.
Remove private keys, pre-shared secrets, personal data, and internal addresses that the recipient does not need. Keep an untouched copy of the original logs so a support engineer can reconstruct the first failure rather than only the post-restart state.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchQuick Recap
As an optional shortcut after you have captured the evidence, Outbyte PC Repair can attempt fixes for 100+ common Windows issues, clean temporary and cache files, and review settings that may add CPU, RAM, or disk load. It complements antivirus software rather than replacing it, runs on Windows 11, 10, 8, and 7, and offers a free trial by category for at least two days before a paid subscription. Results vary, and no utility repairs every crash or VPN protocol failure.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
