Windows Security Log Event ID 4654

Operating Systems Windows 2008 R2 and 7
Windows 2012 R2 and 8.1
Windows 2016 and 10
Category
 • Subcategory
Logon/Logoff
 • IPsec Quick Mode
Type Failure
Corresponding events
in Windows 2003
and before
 
Discussions on Event ID 4654
Ask a question about this event

4654: An IPsec Quick Mode negotiation failed

On this page

An IPsec Quick Mode negotiation failed

See Fields for differences in R2.

Free Security Log Resources by Randy

Description Fields in 4654

The following two fields appear only in Server 2008 R2 and Windows 7:

  • Virtual Interface Tunnel ID: %20
  • Traffic Selector ID: %21

Supercharger Enterprise


 

Examples of 4654

An IPsec Quick Mode negotiation failed.

Local Endpoint:
   Network Address: %1
   Network Address mask: %2
   Port:   %3
   Tunnel Endpoint:  %4

Remote Endpoint:
   Network Address: %5
   Address Mask:  %6
   Port:   %7
   Tunnel Endpoint:  %8
   Private Address:  %10

Additional Information:
   Protocol:  %9
   Keying Module Name: %11
   Mode:   %14
   Role:   %16
   Quick Mode Filter ID: %18
   Main Mode SA ID: %19

Failure Information:
   State:   %15
   Message ID:  %17
   Failure Point:  %12
   Failure Reason:  %13


Server 2008 R2:

An IPsec quick mode negotiation failed.

Local Endpoint:
 Network Address: %1
 Network Address mask: %2
 Port:   %3
 Tunnel Endpoint:  %4

Remote Endpoint:
 Network Address: %5
 Address Mask:  %6
 Port:   %7
 Tunnel Endpoint:  %8
 Private Address:  %10

Additional Information:
 Protocol:  %9
 Keying Module Name: %11
 Virtual Interface Tunnel ID: %20
 Traffic Selector ID: %21
 Mode:   %14
 Role:   %16
 Quick Mode Filter ID: %18
 Main Mode SA ID: %19

Failure Information:
 State:   %15
 Message ID:  %17
 Failure Point:  %12
 Failure Reason:  %13

Keep me up-to-date on the Windows Security Log.
Email*:
*We will NOT share this

Top 10 Windows Security Events to Monitor

Free Tool for Windows Event Collection



 

Additional Resources