strongSwan

We have two servers running a VPN session with strongSwan version: U5.1.3/K2.6.32-431.20.5.el6.x86_64 on Centos 6.5. The session between the two stations runs for a number of days before it stops forwarding. What we discovered was that the ip tables forwarding rules were removed after a successful rekey function. It turns out that this rekey function went through a rekey collision handling, which seems to have all worked, except that it also called the IPsec _updown function with a command of "down-client", which removed the forwarding rules. I have attached IPsec.conf file and syslog which shows the call to _updown function. (We are using the standard _updown script, with a handler to capture and log calls in syslog).