What does Windows error code 13913 (ERROR_IPSEC_REPLAY_CHECK_FAILED) mean?

ERROR_IPSEC_REPLAY_CHECK_FAILED

The sequence number falls outside acceptable anti-replay state

IPsec anti-replay protection detects duplicate packets within a constrained sequence-number window. ESP includes a sequence number, and the receiver tracks accepted values for each SA. This status means the packet failed that replay check; it does not necessarily mean an attacker intentionally replayed traffic.

Network duplication, heavy reordering beyond the window, packets from stale SA state, and sender or middlebox defects can produce the same result. Diagnose per SPI because anti-replay state is maintained for the security association, not globally for the peer.

What to inspect

• Capture SPI and sequence numbers for accepted and rejected packets.
• Check whether failures cluster around rekey or a path change that reorders traffic.
• Avoid disabling anti-replay as a first response; first prove whether duplicate or excessively reordered packets are present.

Get-NetIPsecQuickModeSA

References

• IETF RFC 4301: IPsec security architecture
• IETF RFC 4303: Encapsulating Security Payload
• Microsoft: Get-NetIPsecQuickModeSA

Looking for a different code? Search another status or error code.