How do I send the responder identity correctly in an IKEv2 site-to-site PSK vpn setup with Strongswan?

Question

I'm trying to set up an IKEv2 site-to-site PSK vpn setup with legacy Strongswan

/etc/ipsec.conf

config setup
    charondebug="all"
    uniqueids=no
    strictcrlpolicy=no
conn ikev2-vpn
    auto=add
    dpdaction=restart
    compress=no
    type=tunnel
    keyexchange=ikev2
    rekey=no
    authby=secret
    leftauth=psk
    left=<PRIVATE_IP>
    leftid=<PUBLIC_IP>
    leftsubnet=<OUR_SUBNET>
    rightauth=psk
    right=<THEIR_PUBLIC_IP>
    rightid=<THEIR_PUBLIC_IP>
    rightsubnet=<THEIR_SUBNET>

I get as far as a responder identity failure which on the remote side is a Checkpoint server that gives an error "Auth exchange: Sending notification to peer: Traffic selectors unacceptable"

root@hostname:/home/sarajarjoura# ipsec up ikev2-vpn
initiating IKE_SA ikev2-vpn[1] to <THEIR_PUBLIC_IP>
generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(HASH_ALG) N(REDIR_SUP) ]
sending packet: from <PRIVATE_IP>[500] to <THEIR_PUBLIC_IP>[500] (464 bytes)
received packet: from <THEIR_PUBLIC_IP>[500] to <PRIVATE_IP>[500] (540 bytes)
parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_S_IP) N(NATD_S_IP) N(NATD_S_IP) N(NATD_S_IP) N(NATD_D_IP) N(CHDLESS_SUP) ]
local host is behind NAT, sending keep alives
authentication of '<PUBLIC_IP>' (myself) with pre-shared key
establishing CHILD_SA ikev2-vpn{1}
generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(EAP_ONLY) N(MSG_ID_SYN_SUP) ]
sending packet: from <PRIVATE_IP>[4500] to <THEIR_PUBLIC_IP>[4500] (272 bytes)
received packet: from <THEIR_PUBLIC_IP>[4500] to <PRIVATE_IP>[4500] (96 bytes)
parsed IKE_AUTH response 1 [ N(TS_UNACCEPT) N(TS_UNACCEPT) ]
IDr payload missing
generating INFORMATIONAL request 2 [ N(AUTH_FAILED) ]
sending packet: from <PRIVATE_IP>[4500] to <THEIR_PUBLIC_IP>[4500] (80 bytes)
establishing connection 'ikev2-vpn' failed

/etc/ipsec.secrets

<PUBLIC_IP> <THEIR_PUBLIC_IP> : PSK "<SUPER_STRONG_PSK>"

How do I change the conf file to send the responder identity? This is the first time I've had to configure a vpn client so my knowledge is based on googling and trying to comprehend excerpts on the topic of IKEv2.

Resources I've found and that might be helpful for others who are stuck on the same issue:

IKE v2 https://www.rfc-editor.org/rfc/rfc7296

VPN troubleshooting https://docs.netgate.com/pfsense/en/latest/vpn/ipsec/ipsec-troubleshooting.html

Site to Site configuration with StrongSwan https://www.strongswan.org/testing/testresults/ikev2/net2net-psk/

How to configure StrongSwan IKEv2 VPN with PSK (pre-shared key)?

Incidentally I've tried this with libreswan as well and I'm not opposed to switching around the client. At the same time I've tested this with a server under my control and I believe I'm not far off.