All of your IPsec setup appears correct.
The key debug output appears top be "Unable to allocate IKE SA". I note a similar problem was encountered and documented in this thread. Perhaps you are dealing with a similar incompatibility between the crypto engines and MPLS (or another feature)?