| Previous | Next |
| STATUS_IPSEC_DOSP_MAX_ENTRIES | STATUS_IPSEC_DOSP_MAX_PER_IP_RATELIMIT_QUEUES |
STATUS_IPSEC_DOSP_KEYMOD_NOT_ALLOWED
The key-management method is not permitted at this point
STATUS_IPSEC_DOSP_KEYMOD_NOT_ALLOWED means the DoS-protection path received an IPsec negotiation packet for a keying module that the effective policy does not permit. It is a policy compatibility result, not a statement that the packet’s encryption algorithm is weak or that the packet is structurally invalid.
Windows IPsec policy is configured through WFP layers, where negotiation policies and authentication methods are associated with keying modules. Compare the actual policy deployed on both ends and the expected keying mechanism before changing a broad allow list. This status can occur when a peer tries an allowed protocol in a context where the local policy allows a different keying path.
What to verify
- Identify the keying module and IPsec policy that were active for the packet.
- Compare IKE/AuthIP or manual-SA choices across all affected peers.
- Check deployment drift and policy precedence before assuming a peer bug.
- Do not weaken the DoS-protection rule until the intended negotiation design is confirmed.
References
- Microsoft Open Specifications: NTSTATUS values
- Microsoft: configuring IPsec with WFP
- RFC 7296: IKEv2 and Security Association lifetimes
- Microsoft: WFP sublayer identifiers
Looking for a different code? Search another status or error code.