ikev2 with cisco Router using certificate problem

[Luping]

after I finished the ikev2 configuration(using Distinguished Name (Subject) from PAN and Cisco Router using identity local dn ), I got this isse:

received ID_I (type dn [CN=externalrouter.robinlab.org,unstructuredName=externalrouter.robinlab.org]) does not match peers id

after this:

IKEv2 IKE SA negotiation is failed as responder

any ideas?

regards

Luping

[SutareMayur]

@LupingThere seems to be mismatch in the DN name you have configured under IKE gateway and the certificate present under certificate profile. Also verify IKE version configuration at both ends.

[Luping]

I changed the configuration using preshare for Ikev2, it works. Just if I change to certificate, it show me this error message. it should no IKE missconfigure...

and DN, I just use the subject-name CN, you can see both find the same DN "externalrouter.robinlab.org".

"CN=externalrouter.robinlab.org,unstructuredName=externalrouter.robinlab.org" --- what is "unstructuredName"?

PKI Configuration from Router:

crypto pki trustpoint CA
enrollment terminal
serial-number none
fqdn externalrouter.robinlab.org
ip-address none
subject-name CN=externalrouter.robinlab.org
revocation-check none
rsakeypair sslkey