fix spurious error setting SA on ipsec intf