:> How do I have it do this itself in the event of a link loss.
:To be more specific both PIX's have a connection established but traffic :will not pass either way. A rest of the sa's sorts it out.
*Eventually* the two ends sort each other out, but it can be a long wait.
In my experience, the problem happens only when one of the ends changes IP address. In theory, setting the "identification" to hostname on both ends should eliminate the problem, but sometimes it happens anyhow.
When one end attempts to re-establish communications after a link loss, it is supposed to send a token that means "clear all SA's with this identification". If the identification is based upon IP address and the IP address changed, then there are no SA's for the new address registered at the other machine so no SA's get cleared. That's why using hostname as the ID should work [or so I've reasoned.]