What does Windows error code 13928 (ERROR_IPSEC_DOSP_STATE_LOOKUP_FAILED) mean?

 
Previous Next
ERROR_IPSEC_DOSP_INVALID_PACKET ERROR_IPSEC_DOSP_MAX_ENTRIES

ERROR_IPSEC_DOSP_STATE_LOOKUP_FAILED

The packet and the DoSP state table no longer agree

ERROR_IPSEC_DOSP_STATE_LOOKUP_FAILED indicates that DoSP processing expected a state entry for the public/internal host flow but could not resolve one. State entries record the paired IPv6 addresses, packet counts, and age of authenticated flows. A lookup can fail after idle expiration, policy replacement, interface-address change, table cleanup, or when asymmetric routing sends later packets through a different edge node.

Enumerate current DoSP state and compare it with the packet’s endpoints. Check StateIdleTimeoutSeconds and whether load balancing preserves flow affinity. Raising the state-table maximum is relevant only when capacity errors are also present; it does not fix asymmetric forwarding or a timeout that is shorter than the application’s idle periods.

Correlate state with routing

  • Enumerate state entries and record their duration and packet counters.
  • Compare the public and internal IPv6 pair with the failing packet.
  • Check idle timeout and recent policy or interface changes.
  • Verify that both directions of a flow traverse the same DoSP instance.

References


Looking for a different code? Search another status or error code.