Hello, Is there a way not to negotiate the first CHILD SA during the IKE_AUTH message (i.e. force the CREATE_CHILD_SA message?) I think it would require to implement the RFC6023? Would that be a hard work to do? Regards, Emeric