! Cisco FP1010 in ASA mode: dirty-to-clean IKEv1 protocol break

hostname An_SYDNEY-FW
!
interface GigabitEthernet1/1
 description FROM-DIRTY-INTERNET-ISR1111
 nameif outside
 security-level 0
 no shutdown
interface GigabitEthernet1/2
 description TO-CLEAN-OVERLAY-ISR1111
 nameif inside
 security-level 100
 no shutdown
!
object network PARTNER-LAN
 subnet 10.42.1.0 255.255.255.240
object network COUNTRY-SUMMARY
 subnet 10.42.0.0 255.255.0.0
object-group network USA-CORES
 network-object 10.255.0.1 255.255.255.255
 network-object 10.255.0.2 255.255.255.255
!
access-list CLEAN-CRYPTO extended permit ip object PARTNER-LAN object-group USA-CORES
access-list CLEAN-CRYPTO extended permit ip object PARTNER-LAN host 10.250.2.1
access-list PARTNER-ISOLATION extended deny ip object PARTNER-LAN object COUNTRY-SUMMARY
access-list PARTNER-ISOLATION extended permit ip object PARTNER-LAN object-group USA-CORES
access-group PARTNER-ISOLATION in interface inside
nat (inside,outside) source static PARTNER-LAN PARTNER-LAN destination static USA-CORES USA-CORES no-proxy-arp route-lookup
!
crypto ikev1 enable outside
crypto ikev1 policy 10
 authentication pre-share
 encryption aes-256
 hash sha256
 group 14
 lifetime 86400
crypto ipsec ikev1 transform-set CLEAN-SET esp-aes-256 esp-sha256-hmac
tunnel-group An_SYDNEY_OVERLAY type ipsec-l2l
tunnel-group An_SYDNEY_OVERLAY ipsec-attributes
 ikev1 pre-shared-key wsRf#v^d%$N(Bii9jN4c(bsql7F$!w!KM(RmIeij
crypto map CLEAN-MAP 10 match address CLEAN-CRYPTO
crypto map CLEAN-MAP 10 set peer An_SYDNEY_OVERLAY
crypto map CLEAN-MAP 10 set ikev1 transform-set CLEAN-SET
crypto map CLEAN-MAP interface outside
!
! Relationship source: geJSIcE4999ncOD3xGD-W
! Resolved allocation: AU_SLOT_1 / 10.42.1.0/28
write memory