| Previous | Next |
| ERROR_IPSEC_CLEAR_TEXT_DROP | ERROR_IPSEC_THROTTLE_DROP |
ERROR_IPSEC_AUTH_FIREWALL_DROP
The authenticated firewall rejected ESP by design
The built-in text explicitly describes this drop as benign. Windows received an ESP packet while operating in authenticated-firewall mode and discarded it according to that mode's policy handling. The event should not automatically be escalated as an integrity failure or evidence that ESP parsing is broken.
Correlate the packet with the active connection-security policy and the expected authentication relationship. A benign policy drop can still explain why an application flow did not pass, but the remediation belongs in selector and authenticated-firewall policy analysis rather than certificate repair or packet-corruption investigation.
What to inspect
- Identify the rule and authenticated-firewall policy that applies to the packet.
- Compare the packet selectors with active Quick Mode SAs and permitted protected flows.
- Do not group this code with INTEGRITY_CHECK_FAILED; the status describes a policy-mode drop, not failed cryptographic validation.
Get-NetIPsecRule -PolicyStore ActiveStore
Get-NetIPsecQuickModeSAReferences
- Microsoft: Windows Filtering Platform API sets
- Microsoft: Get-NetIPsecQuickModeSA
- IETF RFC 4301: IPsec security architecture
Looking for a different code? Search another status or error code.