> >Synopsis:       racoon leaves old SA's in kernel

	IPsec/IKE specification does not define how to re-negotiate keys
	nor how to use old/new key, and behavior is totally implementation-
	dependent.  racoon and netbsd are following guidances in
	draft-jenkins-ipsec-rekeying-xx (keep old key and use old key until
	old key really expires).

itojun