| Previous | Next |
| STATUS_IPSEC_INVALID_PACKET | STATUS_IPSEC_CLEAR_TEXT_DROP |
STATUS_IPSEC_INTEGRITY_CHECK_FAILED
Authentication of the protected packet failed
STATUS_IPSEC_INTEGRITY_CHECK_FAILED means the integrity protection associated with the IPsec security association did not validate the packet. It is stronger evidence than a generic parse failure: the receiver could process the packet far enough to perform the configured integrity check, but the authenticated result did not match.
Typical causes are peers using different key material or transform parameters, packets modified in transit, a stale SA after rekeying, or an implementation/interoperability defect. It is not solved by trusting the source address, because IPsec integrity is based on the negotiated SA and authenticated fields rather than on an address label alone.
What to verify
- Record the SPI, transform suite, direction, and last successful protected packet time.
- Compare rekey completion and active key material indirectly through SA state, not by logging secret keys.
- Rule out packet mangling and wrong endpoint or tunnel selection.
- Handle the packet as unauthenticated; do not feed its payload into higher-level protocol recovery.
References
- Microsoft Open Specifications: NTSTATUS values
- RFC 4303: Encapsulating Security Payload (ESP)
- RFC 4301: Security Architecture for IP
- Microsoft: configuring IPsec with WFP
Looking for a different code? Search another status or error code.