VPN reply attack from trusted sources

[Ilovecheckpoint]

Hello,

I have more gateways on MDS, all managed by us.

They have a vpn site to site with the main gateway, with permanent tunnels.

From time to time I notices messages like this:

encryption_failure: Warning: possible replay attack. Sequence Number xxx (Expected yyyy)

Which could be the most reasonable explaination and how to prevent it?

Another question: what about a real attack from untrusted source, is there any hardening or the normal secury sequence check is enough?

[G_W_Albrecht]

sk94984: VPN traffic is dropped with "Encryption failure: Warning: possible replay attack" log

sk111156: VPN traffic dropped with "Encryption failure: Warning: possible replay attack" log

could someone advice me how to determine the value for "ipsec.replay_counter_window_size"