We don't really know nor care what the partner netowrk setup internally looks like in detail. We just know their vpn-endpoint public ip (184.108.40.206), their internal network (10.10.10.0/24) and the ip adress of their server(s) (for example 10.10.10.1)
Our vpn-router-server is a IAAS server hosted by a public cloud provider. It has a directly reachable ...
For IKEv2, there is an extension defined in RFC 7619 that allows establishing IKE SAs in which only one side (similar to TLS) or neither side is authenticated. strongSwan currently does not support this. But you could try Libreswan, where the null authentication method enables it.