This seems to an Expected behavior as explained in https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuu2591   Installing the CA Certificate of the Peer's ID-Cert Issuer locally, but not referencing it in the isakmp profile [or IKEv2 profile] would be ...