1. A computerized system comprising: an offload target comprising a processor to process datagrams with a first offloaded security association (SA); and a host having a secure internet protocol (IPSec) layer that, in response to expiration of an SA lifetime timer, re-keys the first offloaded SA by providing a second offloaded SA to the offload target and initializes and maintains a keepalive timer, wherein the IPSec layer deletes the first offloaded SA when the keepalive timer has expired.