Fix ERROR_IPSEC_TUNNEL_FILTER_EXISTS 0X000032D8

Cause 1: You're trying to add a filter that already exists

The most common reason you see ERROR_IPSEC_TUNNEL_FILTER_EXISTS is that the exact tunnel filter you're trying to create is already on the system. This usually happens when you run a script or policy twice, or when a previous configuration didn't clean up properly. The system won't let you create a second identical filter — it just errors out.

Here's how to check and fix it.

Step 1: List current IPsec filters

Open Command Prompt as Administrator. Right-click Start, choose "Command Prompt (Admin)" or "Windows PowerShell (Admin)".

Run this to see all active IPsec filters:

netsh ipsec static show filterlist

You'll see a list of filter lists and their associated filters. Look for the one that matches what you're trying to add — same source, destination, protocol, and port.

Step 2: Find the duplicate filter

If the filter list name looks familiar, run this to see the details:

netsh ipsec static show filterlist name="YourFilterListName"

Replace YourFilterListName with the actual name. You'll see a table with filter numbers, source, destination, and protocol.

Step 3: Delete the existing filter

Once you've confirmed the filter already exists, you have two choices:

• Use it as-is — if it matches what you need, just reference the existing filter list in your policy.
• Delete it and recreate it if the settings are wrong.

To delete a specific filter:

netsh ipsec static delete filterlist name="YourFilterListName"

This removes the whole filter list. If you only want to remove one filter from a list, you'll need to recreate the list without that filter — there's no direct "remove filter" command in the static mode. That's annoying, but it's how the tool works.

Expected outcome: After deleting, you can add your new filter without the error. You'll see a confirmation message like "Deleting Filter List... OK" when you run the delete command.

Cause 2: Two policies reference the same filter list

Another common trigger is when you have two IPsec policies that both reference the same tunnel filter list. Windows treats the filter list as a shared resource, so if it's already assigned to one policy, adding it to another causes the conflict.

Step 1: Check policy assignments

Run:

netsh ipsec static show policy all

This lists every policy and which filter lists and actions it uses. Look for duplicate references.

Step 2: Reassign or remove the duplicate

If you find the same filter list under two policies, you need to decide which policy should keep it. Then either:

• Remove the filter list assignment from one policy using netsh ipsec static delete policy name="PolicyName" (if that policy isn't needed), or
• Create a separate filter list for the second policy with the same rules but a different name.

To create a new filter list and add it to the second policy:

netsh ipsec static add filterlist name="NewFilterList"
netsh ipsec static add filter filterlist="NewFilterList" srcaddr=... dstaddr=... protocol=... 

Fill in the actual addresses and protocol. Then assign it to the policy with:

netsh ipsec static set policy name="PolicyName" assign

Expected outcome: After reassigning, the error won't appear when you apply the policy. You'll see "Policy assigned successfully" if all goes well.

Cause 3: Stale filters from a previous VPN or DirectAccess setup

Sometimes the filter exists but isn't visible in the normal listing because it was left behind by a removed VPN client or a failed DirectAccess deployment. This is trickier because netsh might not show it.

Step 1: Use PowerShell to see hidden filters

Open PowerShell as Administrator and run:

Get-NetIPsecRule | Where-Object { $_.Name -like "*tunnel*" } | Format-List DisplayName, Name, Filter

This shows all IPsec rules with "tunnel" in the name. If you see one that shouldn't be there, note its DisplayName.

Step 2: Remove the stale rule

Delete it with:

Remove-NetIPsecRule -DisplayName "YourStaleRuleName"

Confirm when prompted.

Step 3: Check for orphaned filters in the registry

If the error persists, there might be a leftover registry entry. Open Registry Editor (regedit) and go to:

HKLM:\SYSTEM\CurrentControlSet\Services\PolicyAgent\Policy\IPSec

Look for subkeys that reference your tunnel. Export the key first (right-click → Export) so you have a backup, then delete the subkey that matches the problem filter. Restart the Policy Agent service or reboot.

Expected outcome: After removing the stale rule and cleaning the registry, the error disappears. You'll be able to add your filter without any complaint.

Quick-reference summary table

That's it. Run through those in order, and you'll kill this error. If you're still stuck after all three, check if you have any third-party firewall that might be interfering — but honestly, in 90% of cases, it's just a duplicate filter you didn't know about.