IPSec Problem with working Policy

hi all,

i have working ipsec policy secures communication web servers clients.

the web servers behind nlb (not ms).

the rules configured on servers :

rule name, protocol, src port, dst port

any <-> webserver1, tcp, any, 80

any <-> webserver1, tcp, any, 443

any <-> webserver2, tcp, any, 80

any <-> webserver2, tcp, any, 443

any <-> webnlb, tcp, any, 80

any <-> webnlb, tcp, any, 443

on client rules same.

both rules in request mode.

the policy works great people syn_sent when accessing servers.

we checked rules , oakley.log seems fine.

we check server's ipsec monitor , saw sa computers, same on clients.

when changed ip address of 1 of problematic clients worked !

when changed back, still working...

i have no clue...

can help?

Windows Server > Platform Networking

KCC