If the on-prem CloudEOS instance is behind a NAT device, configure the public IP address in local-ID under the IKE policy configuration as shown in the example below.

CloudEOS#ip security
 ike policy ikeAzure
encryption aes256
dh-group 2
local-id 3.212.212.81