Using AH based authentication generates duplicate announces from master: IPSEC-AH : sequence number 34831 already processed. Packet dropped. Use insecure (unencrypted) authentication for announcement pakets until this is sorted out.