diff --git a/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c b/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
index d951aa073..b06c836d1 100644
--- a/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
+++ b/src/libcharon/plugins/kernel_netlink/kernel_netlink_ipsec.c
@@ -470,7 +470,7 @@ static u_int ipsec_sa_hash(ipsec_sa_t *sa)
 						  chunk_hash_inc(chunk_from_thing(sa->mark),
 						  chunk_hash_inc(chunk_from_thing(sa->if_id),
 						  chunk_hash_inc(chunk_from_thing(sa->hw_offload),
-						  chunk_hash(chunk_from_thing(sa->cfg)))))));
+						  ipsec_sa_cfg_hash(&sa->cfg))))));
 }
 
 /**
diff --git a/src/libcharon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c b/src/libcharon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
index 469b4b9cc..abf85fdbd 100644
--- a/src/libcharon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
+++ b/src/libcharon/plugins/kernel_pfkey/kernel_pfkey_ipsec.c
@@ -348,7 +348,7 @@ static u_int ipsec_sa_hash(ipsec_sa_t *sa)
 {
 	return chunk_hash_inc(sa->src->get_address(sa->src),
 						  chunk_hash_inc(sa->dst->get_address(sa->dst),
-						  chunk_hash(chunk_from_thing(sa->cfg))));
+						  ipsec_sa_cfg_hash(&sa->cfg)));
 }
 
 /**
diff --git a/src/libstrongswan/ipsec/ipsec_types.c b/src/libstrongswan/ipsec/ipsec_types.c
index d84c97b39..82b5c9ee7 100644
--- a/src/libstrongswan/ipsec/ipsec_types.c
+++ b/src/libstrongswan/ipsec/ipsec_types.c
@@ -53,6 +53,22 @@ ENUM(dscp_copy_names, DSCP_COPY_OUT_ONLY, DSCP_COPY_NO,
 	"no",
 );
 
+/*
+ * See header
+ */
+u_int ipsec_sa_cfg_hash(ipsec_sa_cfg_t *this)
+{
+	return chunk_hash_inc(chunk_from_thing(this->mode),
+			chunk_hash_inc(chunk_from_thing(this->reqid),
+			chunk_hash_inc(chunk_from_thing(this->policy_count),
+			chunk_hash_inc(chunk_from_thing(this->esp.use),
+			chunk_hash_inc(chunk_from_thing(this->esp.spi),
+			chunk_hash_inc(chunk_from_thing(this->ah.use),
+			chunk_hash_inc(chunk_from_thing(this->ah.spi),
+			chunk_hash_inc(chunk_from_thing(this->ipcomp.transform),
+				chunk_hash(chunk_from_thing(this->ipcomp.cpi))))))))));
+}
+
 /*
  * See header
  */
diff --git a/src/libstrongswan/ipsec/ipsec_types.h b/src/libstrongswan/ipsec/ipsec_types.h
index 936e4f86e..22f54819e 100644
--- a/src/libstrongswan/ipsec/ipsec_types.h
+++ b/src/libstrongswan/ipsec/ipsec_types.h
@@ -179,6 +179,14 @@ struct ipsec_sa_cfg_t {
 	} ipcomp;
 };
 
+/**
+ * Hash an ipsec_sa_cfg_t object.
+ *
+ * @param this		object to hash
+ * @return			hash value
+ */
+u_int ipsec_sa_cfg_hash(ipsec_sa_cfg_t *this);
+
 /**
  * Compare two ipsec_sa_cfg_t objects for equality.
  *