diff --git a/src/libipsec/ipsec_sa_mgr.c b/src/libipsec/ipsec_sa_mgr.c
index 314785f67e..a1fa23e287 100644
--- a/src/libipsec/ipsec_sa_mgr.c
+++ b/src/libipsec/ipsec_sa_mgr.c
@@ -401,7 +401,7 @@ METHOD(ipsec_sa_mgr_t, get_spi, status_t,
 	uint32_t spi_min, spi_max, spi_new;
 
 	spi_min = lib->settings->get_int(lib->settings, "%s.spi_min",
-									 0x00000000, lib->ns);
+									 0x00000100, lib->ns);
 	spi_max = lib->settings->get_int(lib->settings, "%s.spi_max",
 									 0xffffffff, lib->ns);
 	if (spi_min > spi_max)
@@ -410,6 +410,9 @@ METHOD(ipsec_sa_mgr_t, get_spi, status_t,
 		spi_min = spi_max;
 		spi_max = spi_new;
 	}
+	/* make sure the SPI is valid (not in range 0-255) */
+	spi_min = max(spi_min, 0x00000100);
+	spi_max = max(spi_max, 0x00000100);
 
 	this->mutex->lock(this->mutex);
 	if (!this->rng)
@@ -433,8 +436,6 @@ METHOD(ipsec_sa_mgr_t, get_spi, status_t,
 			return FAILED;
 		}
 		spi_new = spi_min + spi_new % (spi_max - spi_min + 1);
-		/* make sure the SPI is valid (not in range 0-255) */
-		spi_new |= 0x00000100;
 		spi_new = htonl(spi_new);
 	}
 	while (!allocate_spi(this, spi_new));