FW: Stale IKE SA on FW-1

Hi List,

has anyone ever had an IKE SA that just wouldn't die on a Checkpoint?

The Firewall in question is a (fairly new) R61 clustered on Nokia hardware.

Normally the #vpn tu command should allow SA's to be deleted either singly or 
collectively.

I have a stale IKE SA between this gateway and another (externally managed) 
gateway that refuses to die. The SA is more than twice as old as the reneg 
time, and is just sitting there blocking negotiation of a new one. If I delete 
it with #vpn tu absolutely nothing changes and the SA is still showing in the 
list.

Have any of you ever seen this before? Does anyone have an idea what I can do?

I have already tried:

- making changes in encryption in the community settings and publishing the 
policy
- deleting the object for the remote gateway and the related rules, publishing 
and then recreating them
- every possible #vpn tu command, including deleting ALL IKE+IPSec SA's
- banging my head on the wall

I was even considering booting the firewall, but the SA should be synched on 
both so I assume that will be pretty useless as the other node will have the SA 
as well.

Thanks in advance for any suggestions, I wasn't able to find *anything* on 
google about this type of problem.

Chris Meidinger