| Previous | Next |
| STATUS_FWP_INCOMPATIBLE_CIPHER_TRANSFORM | STATUS_FWP_DUPLICATE_AUTH_METHOD |
STATUS_FWP_INVALID_TRANSFORM_COMBINATION
The IPsec transform set is not a valid combination
These status values come from the Windows Filtering Platform path. For STATUS_FWP_INVALID_TRANSFORM_COMBINATION, wFP classifies traffic through layers, filters, provider contexts, sublayers, and callouts; IPsec policy is also configured through WFP at IKE/AuthIP-related layers.
IPsec policy is a set of related transforms, not a list of independent algorithms. This status means the selected authentication, cipher, mode, or proposal components cannot be used together.
For STATUS_FWP_INVALID_TRANSFORM_COMBINATION, when this appears during IPsec or AuthIP negotiation, compare the Main Mode, Quick Mode, Extended Mode, transform, tunnel endpoint, DNS name, and authentication-method policy actually installed in WFP.
What to inspect
- Inspect the full transform combination, not only the failing algorithm.
- Compare local and peer proposals.
- Check whether AH, ESP, transport, tunnel, or AuthIP-specific settings were mixed incorrectly.
References for STATUS_FWP_INVALID_TRANSFORM_COMBINATION
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: WFP error codes
- Microsoft: IPsec configuration through WFP
Looking for a different code? Search another status or error code.