| Previous | Next |
| STATUS_FWP_CALLOUT_NOTIFICATION_FAILED | STATUS_FWP_INVALID_CIPHER_TRANSFORM |
STATUS_FWP_INVALID_AUTH_TRANSFORM
The IPsec authentication transform is not valid
These status values come from the Windows Filtering Platform path. For STATUS_FWP_INVALID_AUTH_TRANSFORM, wFP classifies traffic through layers, filters, provider contexts, sublayers, and callouts; IPsec policy is also configured through WFP at IKE/AuthIP-related layers.
Authentication transforms define integrity and authentication algorithms for IPsec negotiation. This status means the transform description is malformed or not accepted before compatibility with the peer is even considered.
For STATUS_FWP_INVALID_AUTH_TRANSFORM, when this appears during IPsec or AuthIP negotiation, compare the Main Mode, Quick Mode, Extended Mode, transform, tunnel endpoint, DNS name, and authentication-method policy actually installed in WFP.
What to inspect
- Validate algorithm identifiers and transform structure fields.
- Compare policy against supported Windows IPsec suites.
- Separate invalid transform syntax from peer negotiation failure.
References for STATUS_FWP_INVALID_AUTH_TRANSFORM
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: WFP error codes
- Microsoft: IPsec configuration through WFP
Looking for a different code? Search another status or error code.