%% You should probably cite rfc7791 instead of this I-D.
@techreport{mglt-ipsecme-clone-ike-sa-05,
    number =    {draft-mglt-ipsecme-clone-ike-sa-05},
    type =      {Internet-Draft},
    institution =   {Internet Engineering Task Force},
    publisher = {Internet Engineering Task Force},
    note =      {Work in Progress},
    url =       {https://datatracker.ietf.org/doc/draft-mglt-ipsecme-clone-ike-sa/05/},
    author =    {Daniel Migault and Valery Smyslov},
    title =     {{Cloning IKE SA in the Internet Key Exchange Protocol Version 2 (IKEv2)}},
    pagetotal = 14,
    year =      2015,
    month =     aug,
    day =       24,
    abstract =  {This document considers a VPN End User establishing an IPsec SA with a Security Gateway using the Internet Key Exchange Protocol Version 2 (IKEv2), where at least one of the peers has multiple interfaces or where Security Gateway is a cluster with each node having its own IP address. With the current IKEv2 protocol, the outer IP addresses of the IPsec SA are determined by those used by IKE SA. As a result using multiple interfaces requires to set up an IKE SA on each interface, or on each path if both the VPN Client and the Security Gateway have multiple interfaces. Setting each IKE SA involves authentications which might require multiple round trips as well as activity from the VPN End User and thus would delay the VPN establishment. In addition multiple authentications unnecessarily increase the load on the VPN client and the authentication infrastructure. This document presents the solution that allows to clone IKEv2 SA, where an additional SA is derived from an existing one. The newly created IKE SA is set without the IKEv2 authentication exchange. This IKE SA can later be assigned to another interface or moved to another cluster mode using MOBIKE protocol.},
}