| Previous | Next |
| ERROR_IPSEC_TRANSPORT_FILTER_PENDING_DELETION | ERROR_IPSEC_MM_POLICY_PENDING_DELETION |
ERROR_IPSEC_TUNNEL_FILTER_PENDING_DELETION
Associated tunnel objects are being dismantled
ERROR_IPSEC_TUNNEL_FILTER_PENDING_DELETION is returned while a tunnel-mode filter is in teardown. A tunnel policy is not a single text rule: Windows instantiates filters and provider contexts representing the outer endpoints, protected inner traffic, and negotiation policy. Those associations must be removed consistently before the same key or equivalent configuration can be installed again.
Treat the status as evidence of concurrent or incomplete policy mutation. Re-enumerate after the transaction completes instead of switching to transport-mode diagnostics or changing cryptographic proposals. When software manages tunnels through a dynamic WFP session, close the engine session to remove all session-owned objects together rather than issuing competing individual deletes.
What not to do
- Do not create a second tunnel with the same endpoints during teardown.
- Do not assume the filter is already absent merely because deletion started.
- Do not remove dependent provider contexts out of order.
- Do not retry indefinitely without checking the WFP session and transaction owner.
References
- Microsoft: associated objects in tunnel creation
- Microsoft: transactional WFP object management
- RFC 4301: tunnel-mode selectors and SAs
Looking for a different code? Search another status or error code.