Both sides set require-id-on-certificate=no, so it should succeed despite that
west/east do not have a SAN matching their IKE ID
