| Previous | Next |
| STATUS_IPSEC_DOSP_BLOCK | STATUS_IPSEC_DOSP_INVALID_PACKET |
STATUS_IPSEC_DOSP_RECEIVED_MULTICAST
The protected IPsec control path does not admit this multicast packet
STATUS_IPSEC_DOSP_RECEIVED_MULTICAST means the IPsec denial-of-service protection path received an IPsec-specific multicast packet that it does not allow. It identifies a traffic-class restriction, not merely a generic multicast routing failure.
Multicast has different replication and group-membership properties from ordinary unicast peer traffic. Diagnose the sender, group address, encapsulation and policy path before changing a rule. A configuration that intentionally secures unicast traffic does not automatically imply that the same IPsec negotiation or protection policy applies to multicast control traffic.
What to verify
- Capture the group address, outer and inner destination, and packet type.
- Check whether the deployment is intended to use multicast at this stage of IPsec processing.
- Compare IPv4/IPv6 and tunnel/transport-mode policy assumptions.
- Avoid enabling broad multicast exceptions without validating the security design.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: configuring IPsec with WFP
- RFC 4301: Security Architecture for IP
- Microsoft: WFP sublayer identifiers
Looking for a different code? Search another status or error code.