This issue is due to the presence of Cisco bug ID CSCsd50841.
When 800 series routers run with CPU over 50 percent, traffic can stop after one or more IPsec rekeys. When this happens, Packets Dropped and Invalid Flow Error counters increment in the crypto accelerator statistics. Use the show crypto engine accelerator statistic command in order to view these counters.
This issue occurs on 870 routers when the IPsec flow ID value reaches 40 and on 1800 routers when the flow ID reaches 300. Most often, the main outbound Security Association (SA) does not pass traffic.
Note: This issue is first found in Cisco IOS Software Release 12.4(6)T.
For temporary workaround:
Clear the IPsec SAs. Use the clear crypto sacommand in order to restart traffic orset a longer IPsec rekey interval.
For permanent workaround:
In order to completely resolve this issue, download the latest code. With Cisco, the number of images and releases is reduced, which makes it easier to choose the right release.