<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Calibri" size="2"><span style="font-size:11pt;">
<div>Hi,</div>
<div> </div>
<div>RFC 5996 says this about INITIAL_CONTACT:</div>
<div> The INITIAL_CONTACT notification asserts that this IKE SA is the only</div>
<div> IKE SA currently active between the authenticated identities. It MAY</div>
<div> be sent when an IKE SA is established after a crash, and the</div>
<div> recipient MAY use this information to delete any other IKE SAs it has</div>
<div> to the same authenticated identity without waiting for a timeout.</div>
<div> This notification MUST NOT be sent by an entity that may be</div>
<div> replicated (e.g., a roaming user's credentials where the user is</div>
<div> allowed to connect to the corporate firewall from two remote systems</div>
<div> at the same time). The INITIAL_CONTACT notification, if sent, MUST</div>
<div> be in the first IKE_AUTH request or response, not as a separate</div>
<div> exchange afterwards; receiving parties MAY ignore it in other</div>
<div> messages.</div>
<div> </div>
<div>My question is whether INITIAL_CONTACT notification can be sent in IKE_AUTH response?</div>
<div>If yes, in which condition this notification will be sent by responder?</div>
<div> </div>
<div>Could you please clarify?</div>
<div> </div>
<div> </div>
<div><font size="3" color="#009900"><span style="font-size:12pt;"><i>Regards,</i></span></font></div>
<div><font size="3" color="#009900"><span style="font-size:12pt;"><i>Pavan</i></span></font></div>
<div> </div>
<div> </div>
<div> </div>
</span></font>
</body>
</html>