diff --git a/programs/pluto/ikev2_eap.c b/programs/pluto/ikev2_eap.c
index 07f6380363..97b0bf17b7 100644
--- a/programs/pluto/ikev2_eap.c
+++ b/programs/pluto/ikev2_eap.c
@@ -880,23 +880,11 @@ void llog_success_process_v2_IKE_AUTH_EAP_request(struct ike_sa *ike,
  * EAP responder transitions, there is no initiator code.
  */
 
-static const struct v2_transition v2_IKE_AUTH_EAP_responder_transition[] = {
-
-	{ .story      = "process initial IKE_AUTH(EAP) request",
-	  .to = &state_v2_IKE_AUTH_EAP_R,
-	  .exchange = &v2_IKE_AUTH_EAP_exchange,
-	  .recv_role  = MESSAGE_REQUEST,
-	  .message_payloads.required = v2P(SK),
-	  .encrypted_payloads.required = v2P(IDi),
-	  .encrypted_payloads.optional = v2P(CERTREQ) | v2P(IDr) | v2P(CP) | v2P(SA) | v2P(TSi) | v2P(TSr),
-	  .processor  = process_v2_IKE_AUTH_request_EAP_start,
-	  .log_transition_start = true,
-	  .llog_success = llog_success_process_v2_IKE_AUTH_EAP_request,
-	  .timeout_event = EVENT_v2_DISCARD, },
+static const struct v2_transition v2_IKE_AUTH_EAP_continue_responder_transition[] = {
 
 	{ .story      = "process continuing IKE_AUTH(EAP) request",
 	  .to = &state_v2_IKE_AUTH_EAP_R,
-	  .exchange = &v2_IKE_AUTH_EAP_exchange,
+	  .exchange = &v2_IKE_AUTH_EAP_continue_exchange,
 	  .recv_role  = MESSAGE_REQUEST,
 	  .message_payloads.required = v2P(SK),
 	  .encrypted_payloads.required = v2P(EAP),
@@ -907,7 +895,7 @@ static const struct v2_transition v2_IKE_AUTH_EAP_responder_transition[] = {
 	{ .story      = "process final IKE_AUTH(EAP) request",
 	  .to = &state_v2_ESTABLISHED_IKE_SA,
 	  .flags = { .release_whack = true, },
-	  .exchange = &v2_IKE_AUTH_EAP_exchange,
+	  .exchange = &v2_IKE_AUTH_EAP_continue_exchange,
 	  .recv_role  = MESSAGE_REQUEST,
 	  .message_payloads.required = v2P(SK),
 	  .encrypted_payloads.required = v2P(AUTH),
@@ -917,15 +905,40 @@ static const struct v2_transition v2_IKE_AUTH_EAP_responder_transition[] = {
 
 };
 
+const struct v2_exchange v2_IKE_AUTH_EAP_continue_exchange = {
+	.type = ISAKMP_v2_IKE_AUTH,
+	.name = "IKE_AUTH (EAP)",
+	.secured = true,
+	.transitions.responder = {
+		ARRAY_PTR(v2_IKE_AUTH_EAP_continue_responder_transition),
+	},
+};
+
 V2_STATE(IKE_AUTH_EAP_R, "sent IKE_AUTH(EAP) response",
 	 CAT_OPEN_IKE_SA, /*secured*/true,
-	 &v2_IKE_AUTH_EAP_exchange);
+	 &v2_IKE_AUTH_EAP_continue_exchange);
+
+static const struct v2_transition v2_IKE_AUTH_EAP_start_responder_transition[] = {
+
+	{ .story      = "process initial IKE_AUTH(EAP) request",
+	  .to = &state_v2_IKE_AUTH_EAP_R,
+	  .exchange = &v2_IKE_AUTH_EAP_start_exchange,
+	  .recv_role  = MESSAGE_REQUEST,
+	  .message_payloads.required = v2P(SK),
+	  .encrypted_payloads.required = v2P(IDi),
+	  .encrypted_payloads.optional = v2P(CERTREQ) | v2P(IDr) | v2P(CP) | v2P(SA) | v2P(TSi) | v2P(TSr),
+	  .processor  = process_v2_IKE_AUTH_request_EAP_start,
+	  .log_transition_start = true,
+	  .llog_success = llog_success_process_v2_IKE_AUTH_EAP_request,
+	  .timeout_event = EVENT_v2_DISCARD, },
+
+};
 
-const struct v2_exchange v2_IKE_AUTH_EAP_exchange = {
+const struct v2_exchange v2_IKE_AUTH_EAP_start_exchange = {
 	.type = ISAKMP_v2_IKE_AUTH,
 	.name = "IKE_AUTH (EAP)",
 	.secured = true,
 	.transitions.responder = {
-		ARRAY_PTR(v2_IKE_AUTH_EAP_responder_transition),
+		ARRAY_PTR(v2_IKE_AUTH_EAP_start_responder_transition),
 	},
 };
diff --git a/programs/pluto/ikev2_eap.h b/programs/pluto/ikev2_eap.h
index 522f4b14d3..c775a8e162 100644
--- a/programs/pluto/ikev2_eap.h
+++ b/programs/pluto/ikev2_eap.h
@@ -20,6 +20,7 @@ struct eap_state;
 
 extern void free_eap_state(struct eap_state **eap);
 
-extern const struct v2_exchange v2_IKE_AUTH_EAP_exchange;
+extern const struct v2_exchange v2_IKE_AUTH_EAP_start_exchange;
+extern const struct v2_exchange v2_IKE_AUTH_EAP_continue_exchange;
 
 #endif
diff --git a/programs/pluto/ikev2_ike_intermediate.c b/programs/pluto/ikev2_ike_intermediate.c
index 58dbf65e57..4ab42cea0c 100644
--- a/programs/pluto/ikev2_ike_intermediate.c
+++ b/programs/pluto/ikev2_ike_intermediate.c
@@ -1190,7 +1190,7 @@ V2_STATE(IKE_INTERMEDIATE_R, "sent IKE_INTERMEDIATE response",
 	 CAT_OPEN_IKE_SA, /*secured*/true,
 	 &v2_IKE_INTERMEDIATE_exchange,
 	 &v2_IKE_AUTH_exchange,
-	 &v2_IKE_AUTH_EAP_exchange);
+	 &v2_IKE_AUTH_EAP_start_exchange);
 
 V2_EXCHANGE(IKE_INTERMEDIATE, "",
 	    CAT_OPEN_IKE_SA, CAT_OPEN_IKE_SA,
diff --git a/programs/pluto/ikev2_ike_sa_init.c b/programs/pluto/ikev2_ike_sa_init.c
index 485e49c516..f719c717b6 100644
--- a/programs/pluto/ikev2_ike_sa_init.c
+++ b/programs/pluto/ikev2_ike_sa_init.c
@@ -1429,7 +1429,7 @@ V2_STATE(IKE_SA_INIT_R, "sent IKE_SA_INIT response",
 	 CAT_HALF_OPEN_IKE_SA, /*secured*/true,
 	 &v2_IKE_AUTH_exchange,
 	 &v2_IKE_INTERMEDIATE_exchange,
-	 &v2_IKE_AUTH_EAP_exchange);
+	 &v2_IKE_AUTH_EAP_start_exchange);
 
 V2_EXCHANGE(IKE_SA_INIT, "",
 	    CAT_HALF_OPEN_IKE_SA, CAT_OPEN_IKE_SA,