NTSTATUS 0xC0220039 (STATUS_FWP_INVALID_CIPHER

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

The IPsec cipher transform is invalid.

Previous	Next
STATUS_FWP_INVALID_AUTH_TRANSFORM	STATUS_FWP_INCOMPATIBLE_CIPHER_TRANSFORM

STATUS_FWP_INVALID_CIPHER_TRANSFORM

The IPsec cipher transform is not valid

These status values come from the Windows Filtering Platform path. For STATUS_FWP_INVALID_CIPHER_TRANSFORM, wFP classifies traffic through layers, filters, provider contexts, sublayers, and callouts; IPsec policy is also configured through WFP at IKE/AuthIP-related layers.

Cipher transforms define encryption algorithms and related parameters. This status means the transform object itself is invalid for WFP/IPsec policy installation.

For STATUS_FWP_INVALID_CIPHER_TRANSFORM, when this appears during IPsec or AuthIP negotiation, compare the Main Mode, Quick Mode, Extended Mode, transform, tunnel endpoint, DNS name, and authentication-method policy actually installed in WFP.

What to inspect

Check cipher algorithm, key length, and transform type.
Confirm the transform is valid for ESP, AH, or the intended IPsec path.
Do not fix this by changing firewall rules; fix the IPsec transform policy.

References for STATUS_FWP_INVALID_CIPHER_TRANSFORM

Looking for a different code? Search another status or error code.