Consider the following scenario. Two sides of the connection, WEST and EAST, initiate connection simultaneously. Their IKE_AUTH request cross over the network. Suppose WEST is processing IKE_AUTH request from EAST. AC1) If WEST-initiated IKE SA is not yet established and has higher SPI than EAST-initiated IKE SA then WEST replies AUTHENTICATION_FAILED to EAST and continues establishing its own IKE SA. AC2) If WEST-initiated IKE SA is not yet established and has lower  or equal SPI than EAST-initiated IKE SA then WEST deletes its own IKE SA and continue by replying to IKE AUTH request from the EAST. AC3) If WEST-initiated IKE SA got established in a short time window then  WEST replies AUTHENTICATION_FAILED to EAST and continues establishing its own IKE SA.