I am puzzled about two paragraphs regarding a notification payload in section 3.10 of RFC7296. There you can find the following:
o Protocol ID (1 octet) - If this notification concerns an existing SA whose SPI is given in the SPI field, this field indicates the type of that SA. For notifications concerning Child SAs, this field MUST contain either (2) to indicate AH or (3) to indicate ESP. Of the notifications defined in this document, the SPI is included only with INVALID_SELECTORS, REKEY_SA, and CHILD_SA_NOT_FOUND. If the SPI field is empty, this field MUST be sent as zero and MUST be ignored on receipt. o SPI Size (1 octet) - Length in octets of the SPI as defined by the IPsec protocol ID or zero if no SPI is applicable. For a notification concerning the IKE SA, the SPI Size MUST be zero and the field must be empty.
My question is: what is the proper form for a notification payload regarding an IKE SA?
The second paragraph says for an IKE SA the SPI size must be zero and the SPI field empty while the first paragraph says the protocol ID must be zero when the SPI field is empty.
In an SA payload the protocol ID for IKE is 1 but as I understand the above paragraphs, in an Notification payload I would have to set it to 0.