Windows error 13016 (ERROR_IPSEC_TUNNEL_FILTER

Status / error code:		Category:

Constant name:
Source:		Operating System:
Description: an equivalent tunnel-mode traffic filter already exists.

Previous	Next
ERROR_IPSEC_DEFAULT_QM_POLICY_NOT_FOUND	ERROR_IPSEC_TUNNEL_FILTER_NOT_FOUND

ERROR_IPSEC_TUNNEL_FILTER_EXISTS

Tunnel identity includes inner selectors and outer endpoints

ERROR_IPSEC_TUNNEL_FILTER_EXISTS indicates that adding a tunnel policy would create a filter equivalent to one already installed. Tunnel mode protects an entire inner IP packet and sends it between tunnel endpoints using an outer IP header. The duplicate test therefore involves both the traffic carried inside the tunnel and the configured local and remote tunnel endpoints.

Two rules with different display names can still compile to the same tunnel filters. Compare endpoint addresses, address families, direction, inner source and destination ranges, protocol conditions, provider context, and policy-store origin. Do not “fix” the collision by changing only the rule name; either update the existing tunnel policy or make the actual traffic selection distinct.

Tunnel-specific comparison points

Local and remote tunnel endpoints in the outer packet.
Inner source and destination selectors protected by the tunnel.
Main Mode and Quick Mode provider contexts attached to the tunnel.
Point-to-point or virtual-interface tunnel flags where applicable.

References

Looking for a different code? Search another status or error code.