NTSTATUS 0xC022003D (STATUS_FWP_INVALID_TUNNEL

Status / error code:

Category:

Constant name:

Source:

Facility:

Operating System:

Description:

The IPsec tunnel endpoint configuration is invalid.

Previous	Next
STATUS_FWP_DUPLICATE_AUTH_METHOD	STATUS_FWP_L2_DRIVER_NOT_READY

STATUS_FWP_INVALID_TUNNEL_ENDPOINT

The tunnel endpoint does not define a valid IPsec tunnel

These status values come from the Windows Filtering Platform path. For STATUS_FWP_INVALID_TUNNEL_ENDPOINT, wFP classifies traffic through layers, filters, provider contexts, sublayers, and callouts; IPsec policy is also configured through WFP at IKE/AuthIP-related layers.

Tunnel-mode IPsec requires valid local and remote tunnel endpoints. This status means the endpoint configuration cannot describe a usable tunnel.

For STATUS_FWP_INVALID_TUNNEL_ENDPOINT, when this appears during IPsec or AuthIP negotiation, compare the Main Mode, Quick Mode, Extended Mode, transform, tunnel endpoint, DNS name, and authentication-method policy actually installed in WFP.

What to inspect

Check local and remote endpoint addresses and address families.
Ensure tunnel endpoints match the policy layer and traffic selectors.
Look for empty, wildcard, or mismatched IPv4/IPv6 endpoint fields.

References for STATUS_FWP_INVALID_TUNNEL_ENDPOINT

Looking for a different code? Search another status or error code.