| Previous | Next |
| ERROR_IPSEC_MM_FILTER_NOT_FOUND | ERROR_IPSEC_TRANSPORT_FILTER_NOT_FOUND |
ERROR_IPSEC_TRANSPORT_FILTER_EXISTS
Transport mode protects the selected packet flow without an outer tunnel
ERROR_IPSEC_TRANSPORT_FILTER_EXISTS means policy installation attempted to add a transport-mode filter that the policy engine considers already present. In transport mode, ESP or AH protects the upper-layer payload of matching IP traffic while the original IP endpoints remain the packet endpoints; this differs from tunnel mode, which carries an inner packet between tunnel endpoints.
Compare the complete selector, not only the two addresses. Protocol, ports, direction, interface or profile conditions, and whether a rule is mirrored can make filters distinct. Conversely, two management objects can compile to the same effective selector and collide. Enumerating the effective WFP/IPsec policy is more reliable than assuming unique display names produce unique filters.
Selector fields that commonly hide the duplicate
- Local and remote address or subnet.
- Transport protocol and local or remote ports.
- Inbound versus outbound direction and mirrored-rule behavior.
- The policy store or GPO that supplied the effective filter.
References
- Microsoft: IPSEC_TRANSPORT_POLICY0
- Microsoft: policy and filters in Windows Filtering Platform
- RFC 4301: transport and tunnel modes
Looking for a different code? Search another status or error code.