I know this error is infuriating — one minute your VPN is fine, the next you're staring at FWP_E_INCOMPATIBLE_SA_STATE and every connection attempt fails. I've seen this on Windows 10 and 11, usually after a firewall policy push or a VPN client update. The good news? The fix is usually a single command.
The Quick Fix: Reset IPsec and Windows Filtering Platform
Open an elevated Command Prompt (right-click Command Prompt, choose Run as administrator) and run:
netsh advfirewall resetThen restart the IPsec services:
net stop ipsecsvc
net start ipsecsvcThat's it. Try your VPN or the application that threw the error. In most cases, it connects immediately after this.
Why does this work? The error means the Windows Filtering Platform (WFP) has a security association (SA) in a state that doesn't match what the calling application expects. Think of it like a phone line that's still open on the other end after the call ended. The netsh advfirewall reset command clears all firewall and IPsec policies, forcing WFP to drop every existing SA and start fresh. The service restart makes sure the state is fully flushed.
One warning: This resets your Windows Firewall rules to default. If you've customized rules (like allowing a specific port for a game or app), you'll need to re-add them. But for most people, this is a clean slate that solves the problem.
When the Reset Doesn't Work
If the error persists, the problem might be a specific policy that's reapplying itself. Here's the next step:
- Run
gpupdate /forcein the same elevated command prompt. This forces a refresh of Group Policy, which often carries the IPsec rules. - If you're on a corporate network, check with your IT team — they might have pushed a faulty policy. I've seen this happen when an admin updates IPsec rules but forgets to refresh the connection security rules on clients.
- Disable any third-party firewall or VPN client temporarily. Some clients (looking at you, certain Cisco AnyConnect versions) install their own WFP filters that conflict with Windows' native IPsec.
If none of that works, you might have a corrupted WFP store. Rebuild it with:
netsh wfp set options netevents = disabled
netsh wfp set options netevents = enabledThat toggles the WFP event collection, which forces the subsystem to reinitialize its state. It's a long shot, but I've seen it fix stubborn cases.
Less Common Variations
This error doesn't just show up during VPN connections. I've seen it in these scenarios:
Windows Sandbox or WSL
If you're using Windows Sandbox or WSL (Windows Subsystem for Linux), the isolated network stack can trigger this error when the host's IPsec policies change. The fix is to restart the sandbox or WSL instance. For WSL, run wsl --shutdown in PowerShell, then start your distro again.
Docker Desktop with Windows Containers
Docker's Windows containers use WFP heavily. After a Windows update, I've seen Docker fail with FWP_E_INCOMPATIBLE_SA_STATE when trying to create a network. Restarting the Docker service (or just rebooting) usually clears it. But if you're in a hurry, run netsh advfirewall reset from an elevated prompt, then restart Docker.
After a Windows Feature Update
Big updates like 22H2 or 23H2 sometimes leave stale SAs behind. If you see this error within a week of a feature update, skip the manual reset and just reboot — Windows will rebuild its firewall state during boot. If that doesn't help, then do the netsh reset.
Prevention: Stop It From Coming Back
Two things cause this error most often: stale policies and third-party software that doesn't clean up after itself.
Update your VPN client regularly. Old clients often have bugs that leave orphaned SAs. I've seen specific versions of Cisco AnyConnect and Pulse Secure cause this repeatedly until updated.
If you're an admin managing IPsec rules, test policy changes on a small group first. A bad rule can hit every machine and generate a flood of these errors. And always use Update-HostIPsecPolicy or the Windows Firewall with Advanced Security console to modify rules — don't edit the registry directly.
For home users, the simplest prevention is to reboot after a Windows update. It forces a clean WFP state, and you avoid the ten minutes of troubleshooting this error causes.
One last thing: if you're using a third-party firewall like Comodo or GlassWire, check their logs when this error appears. They often block IPsec traffic without telling you, and the real fix is whitelisting your VPN's executable, not resetting Windows Firewall.
That's it. Run the netsh reset, restart the service, and you should be back online within a minute. If you're still stuck, check if your VPN client has a known issue with your specific Windows build — sometimes the error is a symptom of a broader compatibility problem that only a client update can solve.