IETF Logo Mail Archive

[IPsec] IKEv2 peculiarity

Turritopsis Dohrnii Teo En Ming <ceo.teo.en.ming@gmail.com> Thu, 19 February 2026 17:30 UTC

Return-Path: <ceo.teo.en.ming@gmail.com>
X-Original-To: ipsec@mail2.ietf.org
Delivered-To: ipsec@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id C7591B9F2FC5 for <ipsec@mail2.ietf.org>; Thu, 19 Feb 2026 09:30:45 -0800 (PST)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BuTJAVQ08dEr for <ipsec@mail2.ietf.org>; Thu, 19 Feb 2026 09:30:45 -0800 (PST)
Received: from mail-pf1-x435.google.com (mail-pf1-x435.google.com [IPv6:2607:f8b0:4864:20::435]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 81C06B9F2FC0 for <ipsec@ietf.org>; Thu, 19 Feb 2026 09:30:45 -0800 (PST)
Received: by mail-pf1-x435.google.com with SMTP id d2e1a72fcca58-824ba8f0acaso817450b3a.1 for <ipsec@ietf.org>; Thu, 19 Feb 2026 09:30:45 -0800 (PST)
ARC-Seal: i=1; a=rsa-sha256; t=1771522244; cv=none; d=google.com; s=arc-20240605; b=N0cdofQhqwyhT9l6QV1SaRMI8WvaMznnTfexYGXzPV19wwRed+wkWIgeuTPJ2IBZkl ShNw0hQRvXRMRrkOI54Ukt3L5oqTlvPZW/M4kL5tA/GWKX8fevT0SC6nVZ8a7D8tsXhi eqxt4jIRSVcuOLfvcC0zHn3usr3IOYdJbFRvwMTDSfKQHoCbpE8Eiy8pGN4EoXRmzURc 7MMghEy38cSWF+vXrMHBIGWwDOPJvLZLZIZTDUv+3xPenVyvai5VFu77+LMX7JX6ku0Y JNoJDgjsk2mFihRsgqkss5cIc5JEJ/RiT5GC9aXTerQJ2dqcn1o+CuNEmyAgoxIrJVgn rt1g==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20240605; h=cc:to:subject:message-id:date:from:mime-version:dkim-signature; bh=VdN7GoEUw5IpBXwZM0fpPeYdrsYSljXD/X9iGIeomKo=; fh=Mdh33LDpDZtrGRTmRZKbpLm5CDQfiug44xtjdjEAvCQ=; b=UwHiadmVWguZMO1U54Iqp+rS0B/j58f16T9kn3Pqehr5qNVRnqBOVcjYqOwdNba5tg 6QzmBoZ8JY9BjZn1GNvWmVtIgwwOAuFPwZF+3ZRIZaZ/SNZOdLfUk+b0tyoBJ2W5tpp7 VDa4109FoXp6WiwdL3OvzZ5hV6eNrQgrNgxrEoeTKZLqbmM7VZD2TFAYsvBbi2/ebOOE 9SpX02qBm+/HPDOMJ9mUirCqZblIeHvhKLisfR1yUDuLOpsrldJkmjfkoGZpKTx395+x dWu6+pMhFqcus5Y7mQoTGj4bRnnuLpbiLtUamd8cD4ks2u7FBjrOz4nJ7edJCbDLgc3W YWaQ==; darn=ietf.org
ARC-Authentication-Results: i=1; mx.google.com; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1771522244; x=1772127044; darn=ietf.org; h=cc:to:subject:message-id:date:from:mime-version:from:to:cc:subject :date:message-id:reply-to; bh=VdN7GoEUw5IpBXwZM0fpPeYdrsYSljXD/X9iGIeomKo=; b=Vy8EPFU6lQGMzFsu71tXHt5t2gOS665A5/dY1b/w++K4wwDXQvgZm5FIM/Hk4eEWnb jpTjmn+dN1rSCPRqHIpqPguk4hW/aVaXkKysJNIPvDNQW9lZtD91At8I+ej+uuPgb+ju IgYhMDkfAjfSz3q9EUp9lKeb1Mz+QjZR+gcaYr4orHW7gJio2P2ixl7HnaFhh9/zVsdN ICCzOj7jNan7VsI46IrnDcgcSoavutVnGTh9dRS+MllCumdvI//IcdZv4wYHs+JuFhY3 eVR+0m4mnVKB7DfqFoa8HdeEP3hTqWbB3/RLMVZuNrrtrhR7dkYeO5AnPQ/l0pSAwSIV fQ0w==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1771522244; x=1772127044; h=cc:to:subject:message-id:date:from:mime-version:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=VdN7GoEUw5IpBXwZM0fpPeYdrsYSljXD/X9iGIeomKo=; b=kRmHBrIwygOfyJusPy0VW9ae6PUWmHG2+PPayCEDj0XgR7geL851JS2c/sXLDCoon+ zJU6FOPWSktp/VQgKBmeYZHhPNZUXFl2SGRRQRG4+NTIdVcKK9OiOr+dfx+wBZpa4Sya 1PpGp6AQQqfRpGGkzkcnzDhzAHNrhAB/Vg0M0Ns5ZmoWVPbp+ILURvJ+bIUXVAB0EN4G 8Qqjeer7LvXUWjK6x+aurvKkmITjwUawYCM/MWgxrL7QAIT6HJj3gD1FpsD3ojrmoae9 DR7pDuHDWKNzLuE02P1CT5j97oWIOvFAQGLGo21FQOvjN9ylWITKMg2BHWmmC1ffTxYW 7q9A==
X-Gm-Message-State: AOJu0YzhOcUnzomzdU9G7TrHoT64d4YZRm4ux1A5EKuTbSpiV+wJ/tH9 wdlbGulzYfTLs18QMLBgTQZdvl4luXRCJa5WSIlyfgVoTqYEybcPkPuiSfh0wM4ODwkcBqKlXgp tUKJhPrDDVETTIF9BD6SaYAe0Oy4jPvmIf8z4MZmS4w==
X-Gm-Gg: AZuq6aLjD0+POc0CO8/N+xCasBUzs99cKMquagDqpwMLAgXu3l/3F6o+86UJx8HrhoU 9lLcH9ip5qQ7DA5vaSzpDNTpIycmd8U44psVPKvcuxDUt/U41WvlwNO8raajVv28csS+tYkiPFZ QCX8I8gbysZpQxB8Ve20cOLi46yZEdjuAkgmd1ZrNaMDvt8FzHs57oKCAFFX8fhd3CH43v6+Bpa 381aNeGYncQ9qHIczItIgfclfjLM+9/FeuzAgqdbcNV69d8RYPOFiz0C9MAOOYQgjDVl+JK+80l 082hAbtLSw==
X-Received: by 2002:a17:90b:1a86:b0:353:38c8:b612 with SMTP id 98e67ed59e1d1-356aabe68cbmr18888523a91.12.1771522244157; Thu, 19 Feb 2026 09:30:44 -0800 (PST)
MIME-Version: 1.0
From: Turritopsis Dohrnii Teo En Ming <ceo.teo.en.ming@gmail.com>
Date: Fri, 20 Feb 2026 01:30:30 +0800
X-Gm-Features: AaiRm50cpUDz2lYAyBm7CgUFmxKFiPQMeTX_7QywVHSTgQJMb3Jw2V_6NRcLALw
Message-ID: <CAMEJMGGkbOa8+Cg2+vvODhndpFkvF51-d5Ghrz_VY7BhTRjt_g@mail.gmail.com>
To: ipsec@ietf.org
Content-Type: text/plain; charset="UTF-8"
Message-ID-Hash: Z4W273TNP2QOYHCNYGPE5GIMAJSGBNIE
X-Message-ID-Hash: Z4W273TNP2QOYHCNYGPE5GIMAJSGBNIE
X-MailFrom: ceo.teo.en.ming@gmail.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-ipsec.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: ceo@teo-en-ming-corp.com
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [IPsec] IKEv2 peculiarity
List-Id: Discussion of IPsec protocols <ipsec.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/ipsec/Un7wbxv9C0Xf3vXqnc4lTyTybnY>
List-Archive: <https://mailarchive.ietf.org/arch/browse/ipsec>
List-Help: <mailto:ipsec-request@ietf.org?subject=help>
List-Owner: <mailto:ipsec-owner@ietf.org>
List-Post: <mailto:ipsec@ietf.org>
List-Subscribe: <mailto:ipsec-join@ietf.org>
List-Unsubscribe: <mailto:ipsec-leave@ietf.org>

Subject: IKEv2 peculiarity

Good day from Singapore,

When I wanted to use Email OTP 2FA MFA, IKEv2 doesn't allow it.

When I changed from IKEv2 to IKEv1 (main mode, not aggressive), Email
OTP is allowed.

I don't understand it.

IKEv2 is a newer protocol than IKEv1. Why isn't Email OTP allowed in IKEv2?

I am currently configuring IPsec road warrior VPN tunnels in Fortigate
firewalls.

Regards,

Mr. Turritopsis Dohrnii Teo En Ming
Extremely Democratic People's Republic of Singapore
20 Feb 2026 Friday 1.30 am Singapore Time

v2.46.0 | Report a Bug | By Email | System Status