| Previous | Next |
| ERROR_IPSEC_INTEGRITY_CHECK_FAILED | ERROR_IPSEC_AUTH_FIREWALL_DROP |
ERROR_IPSEC_CLEAR_TEXT_DROP
Policy requires IPsec but the packet is clear text
IPsec policy can require protected inbound traffic for matching selectors. This status means the data path received a clear-text packet where the effective security policy expected IPsec protection, so the packet was dropped before being accepted as ordinary traffic.
The correct question is why the sender transmitted without an applicable SA. The sender may have no matching rule, negotiation may have failed, selectors may differ, or the packet may have taken a path that bypasses the expected IPsec endpoint. Opening the application port does not satisfy an IPsec require rule.
What to inspect
- Compare effective IPsec rules and traffic selectors on both peers.
- Verify a Quick Mode SA exists for the exact packet direction and addresses.
- Trace the preceding IKE negotiation if the sender was expected to establish protection before transmitting.
Get-NetIPsecRule -PolicyStore ActiveStore
Get-NetIPsecQuickModeSAReferences
- IETF RFC 4301: IPsec security architecture
- Microsoft: Get-NetIPsecQuickModeSA
- Microsoft: Windows Filtering Platform API sets
Looking for a different code? Search another status or error code.