STATUS_FWP_INCOMPATIBLE_SA_STATE (0XC022001B) Fix – Security Association State Error

You're setting up a VPN connection on Windows 10 or 11, or maybe you're tweaking firewall rules with PowerShell, and then you hit STATUS_FWP_INCOMPATIBLE_SA_STATE (0XC022001B). The exact message says: "The call is not allowed for the current security association state." This usually happens right after you try to modify an IPsec security association (SA) that's already active—like when you change a VPN policy while the connection is still up, or when a firewall rule tries to update an SA that's in the middle of negotiation.

A common trigger: You run Set-NetIPsecRule in PowerShell to change a rule, and then try to apply it with Update-NetIPsecRule. The WFP (Windows Filtering Platform) says "nope, this SA isn't in a state where I can change it." Another one: third-party VPN clients like Cisco AnyConnect or OpenVPN fail with this code when they try to tear down or modify an SA that's half-built.

What's actually happening here is...

Security associations in WFP have strict state machines. They go through phases: INITIAL, NEGOTIATING, ESTABLISHED, PENDING_DELETION, and DELETED. Each state allows only certain operations. For example, you can't modify a rule on an SA that's in PENDING_DELETION because it's already marked for removal. And you can't delete an SA that's still in NEGOTIATING because the kernel hasn't finished building it.

The error 0XC022001B means your call tried to do something the current state doesn't allow. Windows doesn't auto-correct this—it just returns the error. So you need to force the SA into a state where the operation works, or wipe the whole WFP state.

The fix: reset the WFP state

Skip trying to manually track each SA's state—that's a rabbit hole. The real fix is resetting the WFP state entirely. This clears all SAs and lets you start fresh.

1. Open an elevated Command Prompt. Press Win + X, choose "Windows Terminal (Admin)" or "Command Prompt (Admin)".
2. Reset the WFP state. Run:

   netsh wfp reset

   This resets the WFP state back to defaults, clearing all security associations, filters, and rules. It doesn't delete your firewall rules permanently—just the active state. After this, any VPN or firewall call should work because there's no existing SA to conflict with.
3. Restart the Windows Firewall service. Not strictly required, but I do it to be safe:

   net stop MpsSvc && net start MpsSvc

   This forces the firewall to reload all rules and rebuild SAs from scratch.
4. Try your VPN or firewall command again. The error should be gone. If you're using a VPN client, reconnect manually.

If it still fails

Sometimes the problem is a stuck SA that the reset didn't fully clear. In that case, you need to delete the specific SA manually. Find the SA index first:

netsh wfp show state

This dumps a ton of info. Look for the security association entries under IPsec or Security Associations. Each has an SA ID or Index. Note it down, then delete it:

netsh wfp delete state index=<number>

Replace <number> with the actual index. This removes only that SA, leaving others alone.

Another thing: check if your VPN client is conflicting with Windows Defender Firewall. Disable the firewall temporarily to test:

netsh advfirewall set allprofiles state off

Then try your operation. If it works, you've got a rule conflict. Re-enable the firewall with netsh advfirewall set allprofiles state on and then review your IPsec rules in wf.msc (Windows Defender Firewall with Advanced Security).

Last resort: reboot. I know, it's boring, but a reboot fully clears all WFP state and often fixes weird SA states that reset doesn't touch.