optimized half-open IKE_SA lookup (no checkout)