| Previous | Next |
| STATUS_HV_NOT_PRESENT | STATUS_IPSEC_SA_LIFETIME_EXPIRED |
STATUS_IPSEC_BAD_SPI
The packet cannot be associated with an inbound SA
STATUS_IPSEC_BAD_SPI is raised when the Security Parameters Index carried by an IPsec packet does not select a valid inbound security association for the packet. An SPI is an identifier inside the ESP or AH processing model; it is not a TCP or UDP port and it is not a user-visible connection ID.
This is different from STATUS_IPSEC_WRONG_SA. A bad SPI means the lookup itself did not find a usable SA. A wrong-SA result means a candidate SA was found, but its traffic selectors or other characteristics did not fit the received packet. Common evidence includes a stale peer after rekeying, asymmetric policy deployment, a NAT or tunnel endpoint mismatch, or traffic arriving on an interface that the policy did not anticipate.
What to verify
- Capture the SPI, outer IP addresses, IP protocol, direction, and time of the packet.
- Compare active IPsec SAs on both peers before changing broad firewall rules.
- Check for recent rekey, tunnel failover, NAT traversal changes, or service restart.
- Do not try to repair the condition by replaying the same packet after its SA has been removed.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: configuring IPsec with WFP
- RFC 4301: Security Architecture for IP
- RFC 4303: Encapsulating Security Payload (ESP)
Looking for a different code? Search another status or error code.