| Previous | Next |
| ERROR_IPSEC_DOSP_MAX_ENTRIES | ERROR_IPSEC_DOSP_NOT_INSTALLED |
ERROR_IPSEC_DOSP_KEYMOD_NOT_ALLOWED
The peer selected a negotiation protocol outside policy
ERROR_IPSEC_DOSP_KEYMOD_NOT_ALLOWED is produced when negotiation traffic identifies a keying module that the DoSP configuration does not permit. Windows can distinguish IKEv1, IKEv2, and AuthIP for this purpose. The defaults are intentionally restrictive: AuthIP is allowed by default, while IKEv1 and IKEv2 require enabling flags in the low-level options or equivalent NetSecurity configuration.
Confirm the protocol actually used by the peer rather than assuming every UDP 500 exchange is IKEv2. Then compare it with the DoSP setting for the targeted private IPv6 range. Enabling another keying module expands the accepted attack surface, so make the change only for addresses that require it and verify the downstream IPsec policy can complete that protocol’s authentication and proposal negotiation.
Protocol-policy comparison
- Identify IKEv1, IKEv2, or AuthIP from packet capture and event data.
- Inspect DoSP flags and any private-address-specific keying-module rule.
- Keep allowed modules scoped to the internal destinations that need them.
- Verify the downstream host supports the newly allowed negotiation method.
References
- Microsoft: DoSP keying-module flags
- Microsoft: KeyModules parameter and defaults
- RFC 7296: IKEv2 protocol role
Looking for a different code? Search another status or error code.