| Previous | Next |
| STATUS_FWP_KEY_DICTATOR_ALREADY_REGISTERED | STATUS_FWP_CONNECTIONS_DISABLED |
STATUS_FWP_KEY_DICTATION_INVALID_KEYING_MATERIAL
The dictated IPsec keying material is invalid
These status values come from the Windows Filtering Platform path. For STATUS_FWP_KEY_DICTATION_INVALID_KEYING_MATERIAL, wFP classifies traffic through layers, filters, provider contexts, sublayers, and callouts; IPsec policy is also configured through WFP at IKE/AuthIP-related layers.
This status is about externally supplied keying material, not peer negotiation. WFP rejected the keys dictated by the key manager because they do not satisfy the expected format or policy.
For STATUS_FWP_KEY_DICTATION_INVALID_KEYING_MATERIAL, when this appears during IPsec or AuthIP negotiation, compare the Main Mode, Quick Mode, Extended Mode, transform, tunnel endpoint, DNS name, and authentication-method policy actually installed in WFP.
What to inspect
- Validate key length, SPI, algorithm, and lifetime fields.
- Check that keying material matches the negotiated transform set.
- Do not continue using a security association created from rejected keys.
References for STATUS_FWP_KEY_DICTATION_INVALID_KEYING_MATERIAL
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: WFP error codes
- Microsoft: IPsec configuration through WFP
Looking for a different code? Search another status or error code.