In our environment we are noticing packet drops (with reason "No SA Found") during the SA re-keying. The traffic rate is about 1.2Gbps (pkt size: 800 bytes) and the packet drops are about 200-300 packets in one hour happening during re-keying. Is this normal? The RFC seems to acknowledge that this drop CAN happen and implementations MAY provide a solution for this. (https://wiki.strongswan.org/issues/1291) Strongswan seems to have decided not to fix this. Our IP stack is proprietary, however I would like to know if these drops are seen on other implementations like cisco or juniper and so on. Also, what is normally the lifetime configured for an SA? We are using 1 hour, but what is normally used in real production networks?
1.2 Gigabits per second / 8 bytes per bit = .15 Gigabytes = 150 Megabytes = 157,286,400 bytes = 196,608 * 800 byte packets per second.
Losing 200-300 packets is about a 1.2 millisecond interruption (assuming constant rate). If this is the hit you take for an hourly re-key I think you're doing pretty well! To put it in context it shouldn't be enough to even cause a noticeable pop - much less a disconnect - on a VOIP call.
I haven't run any IPSec tunnels at that kind of rate but can say that I didn't generally experience anything regularly noticeable connectivity issues with router-to-router IOS-based VPN's with tens of megabits flowing. That said, though, a millisecond or so of traffic loss would have been within the range of line noise on most Internet connections.