| Previous | Next |
| ERROR_IPSEC_DOSP_INVALID_PACKET | ERROR_IPSEC_DOSP_MAX_ENTRIES |
ERROR_IPSEC_DOSP_STATE_LOOKUP_FAILED
The packet and the DoSP state table no longer agree
ERROR_IPSEC_DOSP_STATE_LOOKUP_FAILED indicates that DoSP processing expected a state entry for the public/internal host flow but could not resolve one. State entries record the paired IPv6 addresses, packet counts, and age of authenticated flows. A lookup can fail after idle expiration, policy replacement, interface-address change, table cleanup, or when asymmetric routing sends later packets through a different edge node.
Enumerate current DoSP state and compare it with the packet’s endpoints. Check StateIdleTimeoutSeconds and whether load balancing preserves flow affinity. Raising the state-table maximum is relevant only when capacity errors are also present; it does not fix asymmetric forwarding or a timeout that is shorter than the application’s idle periods.
Correlate state with routing
- Enumerate state entries and record their duration and packet counters.
- Compare the public and internal IPv6 pair with the failing packet.
- Check idle timeout and recent policy or interface changes.
- Verify that both directions of a flow traverse the same DoSP instance.
References
- Microsoft: enumerate IPsec DoS Protection state
- Microsoft: fields in a DoSP state entry
- Microsoft: state idle timeout configuration
Looking for a different code? Search another status or error code.