Fix ERROR_IPSEC_IKE_INVALID_FILTER 0X00003622

You're setting up a VPN or IPsec tunnel on Windows, hit connect, and instead of a secure connection you get ERROR_IPSEC_IKE_INVALID_FILTER (0X00003622). Frustrating, I know.

But here's the thing: this error is actually straightforward to fix once you know what's causing it. The filter that defines your IPsec traffic is malformed, incomplete, or conflicting with another policy. Let's walk through the fix.

Step-by-Step Fix for 0X00003622

Open the IPsec policy console.
Press Win + R, type wf.msc, and hit Enter. That opens Windows Defender Firewall with Advanced Security. You can also get there from Server Manager if you're on Windows Server. Once it opens, you should see a tree on the left with "IPsec Policies on Local Computer."
Check for duplicate or conflicting filters.
Expand "IPsec Policies on Local Computer." You might see more than one policy. This is the most common cause of 0X00003622 — two policies trying to filter the same traffic in different ways. Right-click each policy and select Properties. Under the Rules tab, look for two or more rules with overlapping IP ranges or ports. If you find duplicates, delete the one you don't need. After deleting, click Apply. You should see the rule disappear from the list immediately.
Verify each filter's source and destination.
Still in the policy properties, click the Rules tab, select a rule, and click Edit. Then click the IP Addresses tab. For each filter, the source and destination must be valid IP addresses, subnets, or predefined sets like "Any" or "My IP Address." If you see a blank field, an invalid IP such as 0.0.0.0 where it shouldn't be, or a hostname that doesn't resolve, that's your culprit. Correct it and click OK, then Apply. You should see the policy refresh without errors.
Check for orphaned filters.
Sometimes a filter remains after its policy is deleted. Open an elevated Command Prompt and run:
```
netsh ipsec static show all
```
Scan the output for filters that don't belong to any policy. If you spot one, note its name and remove it with:
```
netsh ipsec static delete filter filterlist=<FilterListName> filter=<FilterName>
```
Replace <FilterListName> and <FilterName> with the actual names from the output. After running it, you should get a confirmation message. If you don't, check the names for typos.
Restart the IPsec service.
Press Win + R, type services.msc, and hit Enter. Find IPsec Policy Agent, right-click it, and choose Restart. If it's not running, start it. You should see the service status change to "Running" and stay there.
Test the connection.
Try your VPN or IPsec connection again. If it still fails, move to the variations section below.

Why This Fix Works

The IPsec driver validates every filter before it allows IKE negotiations to start. When a filter has an invalid address, a duplicate entry, or a conflict, the driver returns ERROR_IPSEC_IKE_INVALID_FILTER and drops the connection. By removing duplicates, correcting addresses, and clearing orphaned filters, you give the driver a clean set to work with. Restarting the IPsec Policy Agent forces it to reload the configuration from scratch, so any cached bad data is flushed. That's why the fix works.

Less Common Variations

1. Third-party VPN or firewall software

Some VPN clients and endpoint security tools install their own IPsec filters. If you recently installed or updated one, it might have added a conflicting filter. Check the vendor's documentation for how to view and remove their filters. Sometimes uninstalling and reinstalling the software fixes it.

2. Group Policy conflicts

If your machine is domain-joined, a Group Policy might be pushing an IPsec policy that conflicts with a local one. Run gpresult /h report.html in an elevated Command Prompt and open the report. Look under Computer Configuration > Windows Settings > Security Settings > IP Security Policies. If you see a policy there that duplicates a local one, talk to your domain admin. You can't override domain policies locally, so they'll need to adjust it.

3. Corrupted IPsec configuration

Rare, but it happens. If nothing else works, back up your IPsec policies with netsh ipsec static exportpolicy, then reset the IPsec configuration with netsh ipsec static delete all. Reboot, then import your policies back with netsh ipsec static importpolicy. You should see the policies reappear in the console.

Prevention

Keep these habits to avoid seeing 0X00003622 again:

Always test IPsec policy changes in a lab or on a non-production machine first.
Document every filter you create — source, destination, protocol, and port. Future you will thank present you.
Regularly audit IPsec policies with netsh ipsec static show all to catch duplicates early.
Don't mix manual IPsec policies with third-party VPN software unless you've confirmed they don't conflict.
Keep Windows updated. Microsoft has fixed several IPsec filter validation bugs in cumulative updates over the years.

That's it. Most people fix this in under ten minutes once they find the bad filter. If you're still stuck, double-check that every filter has a valid source and destination — that's the root cause nine times out of ten.