IOS - Anyconnect IPSec IKEv2 with Cert fails

[ALAN HAMMOND]

Trying to use 2921 running IOS 15.3(3)M for remote access - IPSec, IKEv2 with certs and Anyconnect 3.1.13015.

739876: Mar  4 19:29:54.037: IKEv2:(SA ID = 1):[PKI -> IKEv2] Validation of certificate chain PASSED
739877: Mar  4 19:29:54.037: IKEv2:(SESSION ID = 68,SA ID = 1):Save pubkey
739878: Mar  4 19:29:54.041: IKEv2:(SESSION ID = 68,SA ID = 1):: Failed to validate the certificate

Certificate was exported with private key and imported on client, attached screen capture shows correct EKU.

Attached are router debug, relevant config and anyconnect side debug.

Any help would be appreciated.

[Philip D'Ath]

This is a difficult task.  I wrote this guide about how to do it.

http://www.ifm.net.nz/cookbooks/Cisco-IOS-router-IKEv2-AnyConnect-Suite-B-Crypto.html

As a tip - don't even try getting this to work unless you are running 15.4(3)M4 or better.