Although I've been using pfSense now for some time and like it very much, I haven't been able to shake duplicate SA's. I've checked all the obvious stuff - making sure configurations match on both ends - and yet they persist. I've tried preferring older SA's, not preferring older SA's, turning on debug mode, etc - all in vain. Instead of toying around with the settings further, I would rather like to know what causes duplicate SA's so that I might have better insight into have to fix them.
Also, I would like to know if anyone has a fool-proof way to reset a particular IPSec SA (and corresponding SPD's) in pfSense. Just disabling/enabling the tunnel doesn't always work for me. I am using the latest version of pfSense on both ends (2.0.3)
Edit: Even though I'm asking this in the context of pfSense, I've observed this issue with Cisco ASA as well - even when one of the endpoints is a dynamic responder.