NTSTATUS 0xC022001B (STATUS_FWP_INCOMPATIBLE_SA

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

The IPsec security-association context is not in the state required by this WFP call.

Previous	Next
STATUS_FWP_TRAFFIC_MISMATCH	STATUS_FWP_NULL_POINTER

STATUS_FWP_INCOMPATIBLE_SA_STATE

The IPsec SA context calls are out of lifecycle order

STATUS_FWP_INCOMPATIBLE_SA_STATE is an IPsec security-association context lifecycle error. WFP requires SA context calls to follow a documented sequence: create the context, obtain an SPI, then add inbound and outbound association information. Calling a later stage before its prerequisite leaves the context in an incompatible state.

Do not infer that the IKE exchange or all IPsec policy has failed. The diagnostic task is to identify the context ID and exact API sequence that produced it. Retrying the last call alone is not sufficient when the preceding stage was skipped, failed, or used another context.

What to trace

IPsecSaContextCreate0, IPsecSaContextGetSpi0, IPsecSaContextAddInbound0, and IPsecSaContextAddOutbound0 in order.
The SA context ID and result of each step.
Cleanup or retry code that may reuse a stale context after an earlier failure.
Whether inbound and outbound data are being attached to the intended context.

References

Looking for a different code? Search another status or error code.