| Previous | Next |
| STATUS_IPSEC_REPLAY_CHECK_FAILED | STATUS_IPSEC_INTEGRITY_CHECK_FAILED |
STATUS_IPSEC_INVALID_PACKET
The ESP/IPsec structure itself is not usable
STATUS_IPSEC_INVALID_PACKET indicates a structural problem in the received IPsec packet: the relevant header, trailer, padding, or field layout is not valid for the processing path. It is a format-level result and should not be reduced to “the tunnel is down.”
The useful distinction is that STATUS_IPSEC_INTEGRITY_CHECK_FAILED concerns authenticity/integrity verification, whereas this status concerns packet structure before or during parsing. Investigate capture truncation, encapsulation mismatch, an unexpected ESP/AH layout, a broken intermediary, or peers that disagree about the negotiated transform and mode.
What to verify
- Preserve a packet capture with enough outer and encapsulation context for analysis.
- Compare ESP/AH mode, NAT traversal use, and transform negotiation on both peers.
- Check MTU and fragmentation behavior before assuming application payload is at fault.
- Treat repeated malformed packets as a protocol or security event, not as a retryable application error.
References
- Microsoft Open Specifications: NTSTATUS values
- RFC 4303: Encapsulating Security Payload (ESP)
- RFC 4301: Security Architecture for IP
- Microsoft: configuring IPsec with WFP
Looking for a different code? Search another status or error code.