| Previous | Next |
| ERROR_IPSEC_DOSP_BLOCK | ERROR_IPSEC_DOSP_INVALID_PACKET |
ERROR_IPSEC_DOSP_RECEIVED_MULTICAST
The protected edge path expects unicast flow state
ERROR_IPSEC_DOSP_RECEIVED_MULTICAST indicates that the DoSP component received an IPsec-specific multicast packet in a path where multicast is not accepted. The feature tracks public-to-internal IPv6 flows and authenticated state using concrete public and internal host addresses; multicast does not map to the same per-peer state model.
Identify whether the packet was genuinely required by the application or was misrouted negotiation or encapsulated traffic. Do not solve the event by broadly exempting all IPv6 traffic, because that bypasses the edge protection objective. Validate interface roles, multicast routing, tunnel decapsulation placement, and whether the workload should use a separate multicast-capable path outside the DoSP-protected forwarding boundary.
Network checks
- Capture the destination IPv6 multicast address and the receiving interface.
- Determine whether tunneling or forwarding placed the packet on the wrong side of the edge host.
- Verify that the application actually requires multicast with IPsec.
- Keep exemptions narrow if architecture requires a separate multicast path.
References
- Microsoft: traffic scope and deployment position for DoSP
- Microsoft: per-host DoSP state model
- RFC 4301: IPsec security policy selectors
Looking for a different code? Search another status or error code.