Associations in mixed security network

[captador]

Hello,

I got battery operated HeatIt z-temp2 thermostat to play with and want to check with community how associations work.

My network is in hybrid state security wise. Some nodes are unsecure, some S2 and some first generation security.

Now I want to set associations from my thermostat to binary switches. How does it suppose to work in following cases? I expect that higher security of thermostat covers all lower security levels at switches.

1.a. Thermostat unsecure + Switch unsecure -> should work
1.b. T unsecure + Switch S0 (also mean one shield S1 security) or S2 -> not work

2.a. T S0 + Switch unsecured or S0 -> work
2.b. T S0 + Switch S2 -> doesn't

3. T S2 + Switch of any security -> works


To my surprise I got only 'T Unsecure + Switch S0' case working. All devices in direct visibility with green health of linkage. I have fibaro single switch 2 in both S0 and unsecure, so it doesn't look as device model issue.

Firmware 5.37, Z-way 3.1.1

UPD: unsecure aeotec dimmer responded as well. So now issue is about fibaro single+double switch 2 with 3.2 firmware. 3.3 responds normally.

UPD2: S0 flag on switches seems to be a false one due to issue in separate thread when corrupted crc8 is accepted. So what I have is actually unsecure-unsecure association.

[captador]

Similar question is at old thread https://forum.z-wave.me/viewtopic.php?t=33259&p=85963

Basically there is a rule of fallback from S2 to S0 and to insecure mode by specs. However actual implementation is vendor specific.

Right now I am testing Thermostat at S2 Auth and it does not talk with S0 or insecure actuators.

[captador]

S0 thermostat associates with S1 (not sure it is a term, but one shield security from z-wave.me UI), but unsecure switch does not.

So far seems association is only working among equals on same level of security