Event ID 4655 – An IPsec Main Mode Security Association Ended
|Sub-Category||Audit IPsec Main Mode|
|Description||An IPsec Main Mode security association ended.|
Events generated by the Authenticated Internet Protocol (AuthIP) and the Internet Key Exchange protocol (IKE) during Main Mode negotiations are audited by the codes which fall under Audit IPsec Main Mode subcategory. Event 4655 falls under this category.
Example of 4655 log:
An IPsec QUick Mode negotiation failed.
Local Network Address: %1
Remote Network Address: %2
Keying Module Name: %3
Main Mode SA ID: %4
Why does event ID 4655 need to be monitored?
- Security events which fall under the Audit IPsec Main Mode subcategory are monitored primarily for IPsec Main Mode troubleshooting.
With in-depth reports, real-time alerts, and graphical displays, ADAudit Plus tracks all IPsec security associations, helping you meet your security, operational, and compliance needs with absolute ease.
Event 4655 applies to the following operating systems:
- Windows 10
- Windows Server 2016