[strongSwan] Cisco ASA as a client

[abi]

Hello.

I have a small issue with Cisco ASA as the client with ikev1 key 
exchange. Certificates can be validates only with ignore-ipsec-keyusage 
usage, so looks like it lacks necessary ExtendedKeyUsage bits, but I 
can't find which one.
http://www.cisco.com/c/en/us/td/docs/security/asa/asa80/command/reference/cmd_ref/i1.html#wp1687992

The following PKI flags  was used for client cert --flag clientAuth 
--flag ikeIntermediate

What else can be added to please ASA ?