this is a security check by the iphone. Following things are needed to get it to work.
the certificate choosen under site-to-site > ipsec > advanced have to include as identifier the same dns name your asg is reachable from external. If not, the iphone will not verify the certificate.
for example. If you connect with your iphone to iphone.myhomeasg.org the certificate have to include this name as identifier
