| Previous | Next |
| FWP_E_TRAFFIC_MISMATCH | FWP_E_NULL_POINTER |
FWP_E_INCOMPATIBLE_SA_STATE
FWP_E_INCOMPATIBLE_SA_STATE means IPsec security-association APIs were called out of their required lifecycle order. The WFP documentation requires creating the context, obtaining an SPI, and then adding inbound and outbound associations in order.
What to check
- Record the exact SA context state at every API call and reject duplicate or out-of-order transitions in the caller.
- Make cleanup idempotent so a failed setup does not leave a stale context that a retry incorrectly reuses.
- Capture IKE/IPsec events while reproducing the problem if policy negotiation is also involved.
netsh wfp capture start cab=on file=C:\Temp\wfpdiag.cabMicrosoft: capture IPsec events with netsh wfp
Looking for a different code? Search another status or error code.