dokas@cs.umn.edu said:
> I see this kind of situation almost every time that I reboot one of my
> tunnel endpoints.  Usually I see no ill effects.

After trying a couple of times - yes, this happens for me too.
If there are two pairs of SAs on both sides, and they are
consistent, everything works.
But in the case I described there was one pair on one side
(the laptop), and two pairs on the other (the gateway), and
the gateway tried to use the one unknown to the other
(or, to be exact, considered expired, as shown in my other
mail).

I can easily reproduce the problem by setting the time
on the laptop into the future before booting multiuser.
It seems that even minimal time corrections backward
trigger it (two seconds in my first report).

best regards
Matthias