| Previous | Next |
| STATUS_IPSEC_WRONG_SA | STATUS_IPSEC_INVALID_PACKET |
STATUS_IPSEC_REPLAY_CHECK_FAILED
The sequence number was not acceptable for the anti-replay window
STATUS_IPSEC_REPLAY_CHECK_FAILED means the receiver rejected the packet’s ESP sequence number under the anti-replay state for the selected security association. Anti-replay is intentionally stateful: a duplicate packet, a packet too far behind the receive window, or a number that cannot be reconciled with the current state may be discarded even when the peer is otherwise valid.
Do not equate this status with a corrupted packet. Integrity verification protects the sequence number when the anti-replay service is enabled, but replay processing answers a different question: whether this sequence number is still acceptable for this SA. Persistent failures can reveal duplicated traffic, reordering beyond the configured window, an SA reset on one peer, or stale packets after rekeying.
What to verify
- Capture the SPI, sequence number, direction, and whether the packet was a duplicate or merely old.
- Check for asymmetric SA resets, failover, packet mirroring, or excessive reordering.
- Correlate with rekey events before enlarging any replay window.
- Do not disable anti-replay as a first response; it is a security control, not a congestion knob.
References
- Microsoft Open Specifications: NTSTATUS values
- RFC 4303: Encapsulating Security Payload (ESP)
- RFC 4301: Security Architecture for IP
- Microsoft: configuring IPsec with WFP
Looking for a different code? Search another status or error code.