How to fix error error-ipsec-ike-authorization-failure-with-optional-retry in Windows 11

Solution Steps

1. 1 First, simply try reconnecting to the VPN. Right-click the network icon in the system tray, select 'Network & Internet settings', then 'VPN', and click on your connection and 'Connect'. Sometimes the error is transient, and a retry works. If it fails again, proceed.
2. 2 Press Windows key + R, type 'services.msc' and press Enter. Find 'IPsec Policy Agent' in the list. Right-click it and select 'Restart'. This service manages IPsec policies. Restarting it can clear temporary glitches. Also restart 'IKE and AuthIP IPsec Keying Modules' (IKEEXT) service in the same way.
3. 3 Open Command Prompt as administrator (Win+X, then 'Windows Terminal (Admin)'). Type 'ipconfig /flushdns' and press Enter. This clears the DNS cache, which can sometimes cause authentication failures if the VPN server's hostname resolves incorrectly. Then type 'ipconfig /registerdns' and press Enter to re-register your DNS.
4. 4 Check your VPN client's authentication settings. If you're using the built-in Windows VPN, go to Settings > Network & Internet > VPN, click your connection, and select 'Advanced options'. Ensure the 'Authentication method' is set to 'Microsoft: Secured Password (EAP-MSCHAP v2)' or 'Microsoft: Smart Card or other certificate' depending on your company's setup. If it's wrong, change it and save.
5. 5 If the error persists, reset the IPsec and IKE settings using the commands from the previous fix: 'netsh int ipsec reset' and 'netsh int ike reset'. Then reboot your PC and try again.