| Previous | Next |
| ERROR_IPSEC_INVALID_PACKET | ERROR_IPSEC_CLEAR_TEXT_DROP |
ERROR_IPSEC_INTEGRITY_CHECK_FAILED
Authenticated packet bytes do not validate under the SA
IPsec integrity protection detects modification of a protected datagram. ESP can provide data-origin authentication and connectionless integrity, and the receiver validates the packet using algorithms and keys from the selected SA. This status means that verification failed.
The cause can be packet modification or corruption, but a key or SA mismatch can produce the same observable result: the receiver applies integrity state that does not match the sender. Compare SPIs, negotiated algorithms, and rekey timing before assuming malicious tampering.
What to inspect
- Verify the packet maps to the expected inbound SA and SPI.
- Compare negotiated integrity algorithms and SA generation on both peers.
- Check whether failures begin exactly at rekey, peer restart, or policy replacement.
Get-NetIPsecQuickModeSAReferences
- IETF RFC 4303: Encapsulating Security Payload
- IETF RFC 4301: IPsec security architecture
- Microsoft: Get-NetIPsecQuickModeSA
Looking for a different code? Search another status or error code.