Stale IKE SA on FW-1

Hi List,

has anyone ever had an IKE SA that just wouldn't die on a Checkpoint?

The Firewall in question is a (fairly new) R61 clustered on Nokia
hardware.

Normally the #vpn tu command should allow SA's to be deleted either
singly or collectively.

I have a stale IKE SA between this gateway and another (externally
managed) gateway that refuses to die. The SA is more than twice as old
as the reneg time, and is just sitting there blocking negotiation of a
new one. If I delete it with #vpn tu absolutely nothing changes and the
SA is still showing in the list.

Have any of you ever seen this before? Does anyone have an idea what I
can do?

I have already tried:

- making changes in encryption in the community settings and publishing
the policy
- deleting the object for the remote gateway and the related rules,
publishing and then recreating them
- every possible #vpn tu command, including deleting ALL IKE+IPSec SA's
- banging my head on the wall

I was even considering booting the firewall, but the SA should be
synched on both so I assume that will be pretty useless as the other
node will have the SA as well.

Thanks in advance for any suggestions, I wasn't able to find *anything*
on google about this type of problem.

Chris Meidinger

PS: sorry for the cross post, the topic seems to be right in the middle
between firewalls and vpns...