keepalive is used for detection; while invalid spi recovery is one of the ways to fix up a vpn black hole.
with keepalive enabled, the router/pix will be able to determine whether the vpn peer is still alive or not. in case the peer doesn't respond for a certain period of time, then the router/pix will decide to remove the vpn being created.
in case there was some sort of interruption of the internet link, the vpn peer will still consider that the "old" vpn is up; whereas the local device would have no vpn as keepalive suggested. what would happen next is that the peer will keep sending traffic via the "old" vpn; while the local device will try to initiate a "new" vpn. this is when the feature invalid spi recovery get involved.
with invalid spi recovery, the router/pix will be able to notify the peer in order to trash the old vpn , and create a new vpn at the same time.
i guess they work together, not overlapping each other.
