| Previous | Next |
| ERROR_IPSEC_BAD_SPI | ERROR_IPSEC_WRONG_SA |
ERROR_IPSEC_SA_LIFETIME_EXPIRED
Traffic is still using security state whose lifetime has ended
Security associations have finite lifetimes so keys and traffic-protection state are replaced. This status means the receiver got a packet that selected an SA whose lifetime had already expired. It is a data-path condition, not merely a record that rekey should begin.
Compare rekey timing on both peers. One side can continue transmitting with an old outbound SA after the receiver has expired the matching inbound SA, especially when rekey messages are lost or policy lifetimes differ. Short bursts can also be delayed packets from the previous SA.
What to inspect
- Compare SA creation and lifetime values on both endpoints.
- Check whether a new Quick Mode SA exists and whether the sender switched to its new SPI.
- Inspect packet timing to distinguish delayed old packets from sustained transmission on expired state.
Get-NetIPsecQuickModeSAReferences
- IETF RFC 4301: IPsec security architecture
- Microsoft: Get-NetIPsecQuickModeSA
- IETF RFC 4303: Encapsulating Security Payload
Looking for a different code? Search another status or error code.