Azure VPN Gateway: IKEv2 Phase 1 rekey fails with 0x363A — Max number of established MM SAs to peer exceeded

We are experiencing recurring IKEv2 Phase 1 rekey failures between an on-premises OPNsense HA firewall pair (strongSwan) and Azure VPN Gateway.

The tunnel establishes successfully, and Phase 2 CHILD_SAs generally rekey without issues. However, during periodic Phase 1 IKE SA rekeys, the negotiation fails, after which the VPN reconnects.

Environment:

• OPNsense Business 25.10_2 / strongSwan 6.0.1
• Two OPNsense firewalls configured in HA using CARP
• IKEv2 with PSK authentication
• IKE encryption AES256, integrity SHA256, DH Group 14
• IPsec encryption AES256, integrity SHA256, PFS2048
• Azure VPN connection mode: ResponderOnly
• OPNsense Phase 1 rekey interval: 21,600 seconds (previously 27,000 seconds)
• Multiple CHILD_SAs with a 3,600-second local rekey interval

OPNsense error:

rekeying IKE_SA failed, peer not responding
During the failed rekey exchange, strongSwan also reports unexpected IKE message IDs:
received message ID 755, expected 756, ignored
The request is retransmitted several times before the rekey fails.

Azure IKEDiagnosticLog error:
ErrorCode: 0x363A
Max number of established MM SAs to peer exceeded
SA_type: MM_SA
SAEstablished: false
SA_CREATION_DIRECTION: Inbound

We would appreciate guidance on the possible root cause and recommended troubleshooting steps or configuration adjustments.

Thank you.