| Previous | Next |
| ERROR_IPSEC_IKE_NEG_STATUS_EXTENDED_END | ERROR_IPSEC_SA_LIFETIME_EXPIRED |
ERROR_IPSEC_BAD_SPI
The receiver cannot map the packet to a valid security association
IPsec uses the Security Parameters Index together with destination and protocol information to select the inbound security association. ESP carries the SPI in its header. This status means the packet referenced an SPI that does not match a valid local SA, so the receiver lacks the keys and processing parameters needed for that packet.
A bad SPI often appears after one peer has deleted or rekeyed an SA while the other still sends traffic under the old association. Peer restart, asymmetric state cleanup, delayed packets, or NAT/load-balancer path changes can create the same symptom. The SPI value and active inbound SA table are the critical evidence.
What to inspect
- Record the packet SPI, destination, IPsec protocol, and sequence number.
- Compare the SPI with active SAs on the receiving host and the outbound SA on the sender.
- Check for recent rekey, SA deletion, or peer restart before blaming packet corruption.
Get-NetIPsecQuickModeSAReferences
- IETF RFC 4301: IPsec security architecture
- IETF RFC 4303: Encapsulating Security Payload
- Microsoft: Get-NetIPsecQuickModeSA
Looking for a different code? Search another status or error code.