| Previous | Next |
| STATUS_FWP_INCOMPATIBLE_AUTH_METHOD | STATUS_FWP_EM_NOT_SUPPORTED |
STATUS_FWP_INCOMPATIBLE_DH_GROUP
The Diffie-Hellman group cannot be used with this policy
These status values come from the Windows Filtering Platform path. For STATUS_FWP_INCOMPATIBLE_DH_GROUP, wFP classifies traffic through layers, filters, provider contexts, sublayers, and callouts; IPsec policy is also configured through WFP at IKE/AuthIP-related layers.
Diffie-Hellman group selection belongs to key negotiation. This status means the group is not compatible with the policy type or negotiated transform set, rather than merely being unknown text.
For STATUS_FWP_INCOMPATIBLE_DH_GROUP, when this appears during IPsec or AuthIP negotiation, compare the Main Mode, Quick Mode, Extended Mode, transform, tunnel endpoint, DNS name, and authentication-method policy actually installed in WFP.
What to inspect
- Inspect Main Mode proposal settings and DH group.
- Compare local and peer IPsec policy capabilities.
- Check whether legacy and modern cryptographic suites were mixed.
References for STATUS_FWP_INCOMPATIBLE_DH_GROUP
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: WFP error codes
- Microsoft: IPsec configuration through WFP
Looking for a different code? Search another status or error code.