Filtering Sublayer Identifiers

The Windows Filtering Platform (WFP) sublayer identifiers are each represented by a GUID.

These identifiers are defined as follows.

FWPM_SUBLAYER_EDGE_TRAVERSAL / FWPM_SUBLAYER_TEREDO

Edge traversal filters are added to this sublayer.

Note

For Windows 7 and later, use FWPM_SUBLAYER_EDGE_TRAVERSAL.

FWPM_SUBLAYER_INSPECTION

This is the lowest weighted sublayer. It is used only for inspection filters.

FWPM_SUBLAYER_IPSEC_DOSP

IPsec DoS Protection filters are added to this sublayer. Note Available only on Windows Vista with SP1, Windows Server 2008, and later.

FWPM_SUBLAYER_IPSEC_FORWARD_OUTBOUND_TUNNEL

IPsec forward outbound tunnel filters are added to this sublayer. Note Available only on Windows 7, Windows Server 2008 R2, and later.

FWPM_SUBLAYER_IPSEC_TUNNEL

FWPM_SUBLAYER_LIPS

FWPM_SUBLAYER_RPC_AUDIT

RPC audit filters are added to this sublayer. These filters audit RPC incoming calls as part of C2 and common criteria compliance.

FWPM_SUBLAYER_SECURE_SOCKET

FWPM_SUBLAYER_TCP_CHIMNEY_OFFLOAD

FWPM_SUBLAYER_TCP_TEMPLATES

TCP template filters are added to this sublayer. Note Available only on Windows 8, Windows Server 2012, and later.

FWPM_SUBLAYER_UNIVERSAL

This sublayer hosts all filters that are not assigned to any of the other sublayers.

Requirements

Requirement	Value
Minimum supported client	Windows Vista [desktop apps only]
Minimum supported server	Windows Server 2008 [desktop apps only]
Header	Fwpmu.h