This read-write switch turns on invalid-SPI recovery, which makes the device open an IKE security association (if none exists) so it can send a DELETE message to a remote peer that sent an invalid SPI or cookie. Enabling it speeds up recovery from SA-database inconsistencies, but the tradeoff is that it can expose the device to a denial-of-service attack from a spoofed remote peer, so it's a security-vs-resilience tradeoff an admin should weigh deliberately.