| Previous | Next |
| STATUS_IPSEC_INTEGRITY_CHECK_FAILED | STATUS_IPSEC_AUTH_FIREWALL_DROP |
STATUS_IPSEC_CLEAR_TEXT_DROP
The policy decision was to reject clear-text traffic
STATUS_IPSEC_CLEAR_TEXT_DROP is a policy-enforcement result. Windows received traffic that matched a rule requiring IPsec protection, but the packet arrived without the required protection and was dropped. The status therefore does not say that ESP decryption or integrity verification failed; those stages were not available for clear-text traffic.
A useful diagnosis compares the policy decision with the traffic that actually arrived. The peer may have failed to negotiate, used a different selector, taken an unexpected route, or sent fallback clear text after its SA expired. Making the local policy permissive may restore connectivity but also changes the security guarantee that the rule was enforcing.
What to verify
- Identify the matching IPsec policy, layer, direction, and traffic selectors.
- Verify that the peer has a compatible policy and an established SA for the same traffic.
- Check route, NAT, and address-family changes that can bypass expected protection.
- Do not classify this as an ESP cryptographic failure.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: configuring IPsec with WFP
- RFC 4301: Security Architecture for IP
- Microsoft: Windows Filtering Platform object model
Looking for a different code? Search another status or error code.