| Previous | Next |
| ERROR_IPSEC_SA_LIFETIME_EXPIRED | ERROR_IPSEC_REPLAY_CHECK_FAILED |
ERROR_IPSEC_WRONG_SA
The packet characteristics disagree with the security association
IPsec policy binds protected traffic to selectors and security associations. A packet can reference existing SA state yet still fail when its addresses, protocol, ports, or other characteristics do not match the traffic that the SA was negotiated to protect. This is different from BAD_SPI, where no valid SA is found for the index.
Look for selector asymmetry between peers, policy changes after SA creation, or traffic rewritten by NAT or another packet-processing component. The active Quick Mode SA should be compared directly with the packet that failed rather than with a broadly similar firewall rule.
What to inspect
- Record the packet five-tuple and direction at the point where IPsec validates it.
- Compare those selectors with the active Quick Mode SA on the receiving host.
- Check for address or port translation between policy matching and IPsec processing.
Get-NetIPsecQuickModeSA
Get-NetIPsecRule -PolicyStore ActiveStoreReferences
- IETF RFC 4301: IPsec security architecture
- Microsoft: Get-NetIPsecQuickModeSA
- Microsoft: Windows Filtering Platform API sets
Looking for a different code? Search another status or error code.