| Previous | Next |
| STATUS_IPSEC_AUTH_FIREWALL_DROP | STATUS_IPSEC_DOSP_BLOCK |
STATUS_IPSEC_THROTTLE_DROP
Rate protection intentionally discarded the packet
STATUS_IPSEC_THROTTLE_DROP says that IPsec dropped a packet because a denial-of-service throttle was active. This is a defensive capacity decision, not proof that the packet was malformed, unauthenticated, or matched a forbidden IPsec policy.
The right investigation treats the event as a rate-control signal. Measure the burst shape, source distribution, protocol and direction, and correlate them with negotiation activity and WFP/IPsec policy changes. If legitimate traffic is consistently throttled, the remedy is to understand the policy limit and traffic pattern; merely retrying dropped packets can amplify the overload.
What to verify
- Collect packet-rate and source-distribution evidence around the throttle window.
- Separate IKE/AuthIP negotiation bursts from protected data traffic.
- Review policy thresholds and upstream traffic controls with the security owner.
- Avoid disabling throttling globally as a quick connectivity workaround.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: configuring IPsec with WFP
- Microsoft: WFP sublayer identifiers
- RFC 4301: Security Architecture for IP
Looking for a different code? Search another status or error code.