| Previous | Next |
| STATUS_IPSEC_BAD_SPI | STATUS_IPSEC_WRONG_SA |
STATUS_IPSEC_SA_LIFETIME_EXPIRED
The SA has reached its cryptographic lifetime
STATUS_IPSEC_SA_LIFETIME_EXPIRED says that the receiving side selected an IPsec security association, but that association is no longer permitted to carry traffic because its lifetime has ended. IPsec lifetimes can be limited by time, amount of protected traffic, or both; they are part of key-management hygiene rather than an application timeout.
An expired SA should be replaced through the configured keying path. In IKEv2 terminology, a replacement SA is established by rekeying; traffic must move to the new SA rather than continue on the old one. Therefore this result is more specific than a generic tunnel outage and should be investigated together with negotiation, peer reachability, and clock or policy changes.
What to verify
- Compare the negotiated SA lifetime and rekey timing on both peers.
- Check whether a new SA was installed while packets still used the old SPI.
- Look for stalled IKE/AuthIP negotiation or a peer that did not accept the replacement parameters.
- Avoid extending or disabling lifetimes merely to mask a broken rekey path.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: configuring IPsec with WFP
- RFC 4301: Security Architecture for IP
- RFC 7296: IKEv2 and Security Association lifetimes
Looking for a different code? Search another status or error code.