| Previous | Next |
| STATUS_FWP_INVALID_CIPHER_TRANSFORM | STATUS_FWP_INVALID_TRANSFORM_COMBINATION |
STATUS_FWP_INCOMPATIBLE_CIPHER_TRANSFORM
The cipher transform conflicts with the IPsec policy
These status values come from the Windows Filtering Platform path. For STATUS_FWP_INCOMPATIBLE_CIPHER_TRANSFORM, wFP classifies traffic through layers, filters, provider contexts, sublayers, and callouts; IPsec policy is also configured through WFP at IKE/AuthIP-related layers.
Unlike an invalid cipher transform, this status means the transform is recognizable but cannot be combined with the selected policy type or proposal.
For STATUS_FWP_INCOMPATIBLE_CIPHER_TRANSFORM, when this appears during IPsec or AuthIP negotiation, compare the Main Mode, Quick Mode, Extended Mode, transform, tunnel endpoint, DNS name, and authentication-method policy actually installed in WFP.
What to inspect
- Compare the cipher transform with authentication and mode settings.
- Check tunnel versus transport mode policy.
- Look for mixed legacy and modern crypto suites in one proposal.
References for STATUS_FWP_INCOMPATIBLE_CIPHER_TRANSFORM
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: WFP error codes
- Microsoft: IPsec configuration through WFP
Looking for a different code? Search another status or error code.