An identity mismatch occurs when the local and remote identities configured on the IPsec peers do

not match. This can prevent the establishment of an IPsec tunnel or cause traffic to be dropped by

the IPsec policy. In this case, the network engineer should verify that the local and remote identities

configured on the Cisco WAN edge router and the AWS endpoint match the values expected by each

peer. The identities can be an IP address, a fully qualified domain name (FQDN), or a distinguished

name (DN). The identities are exchanged during the IKE phase 1 negotiation and are used to

authenticate the peers. If the identities do not match, the peers will reject the IKE proposal and the

IPsec tunnel will not be established or will be torn down. Reference :=

Configure IOS-XE Site-to-Site VPN Connection to Amazon Web Services, Topic: Troubleshooting

Designing and Implementing Cloud Connectivity (ENCC) v1.0, Module 3: Implementing Cloud

Connectivity, Lesson 2: Implementing Cisco SD-WAN Cloud OnRamp for IaaS, Topic: Troubleshooting

Cisco SD-WAN Cloud OnRamp for IaaS

Cisco IOS Security Configuration Guide, Release 15M&T, Chapter: Configuring IPsec Network

Security, Topic: Configuring IPsec Identity and Peer Addressing