| Previous | Next |
| STATUS_IPSEC_SA_LIFETIME_EXPIRED | STATUS_IPSEC_REPLAY_CHECK_FAILED |
STATUS_IPSEC_WRONG_SA
An SA was found, but it does not authorize this packet
STATUS_IPSEC_WRONG_SA is more specific than an unknown SPI. Windows found an IPsec security association, but the packet characteristics did not match that association. In IPsec, an SA is associated with policy selectors and protection parameters; possession of a matching SPI alone does not make every packet acceptable under that SA.
This result often points to a disagreement about traffic selectors, tunnel versus transport mode, address family, protocol, or direction. It can also follow a policy update in which one peer has installed different selector bounds than the other. The right comparison is the active SA and policy on both ends, not only the static configuration that was intended to be deployed.
What to verify
- Record the selected SPI and the packet’s outer and inner addresses, protocol, and ports.
- Compare active traffic selectors, not just the proposal names shown in a management UI.
- Check whether a route or NAT changed the packet identity after policy was designed.
- Keep this separate from bad-SPI and integrity failures in incident reports.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: configuring IPsec with WFP
- RFC 4301: Security Architecture for IP
- RFC 4303: Encapsulating Security Payload (ESP)
Looking for a different code? Search another status or error code.