With MC-IPsec, it is required that MC-IPsec pair could only act as IKEv2 responder (except for the automatic CHILD_SA rekey upon switchover). To enable this behavior, configure the following command.
config>isa>tunnel-grp>
ipsec-responder-only
See IPsec deployment requirements section for details.