Choosing IKE mode auto on the mobile IPSec config can result in an invalid config.
It's possible to end up in situation where neither the IKE mode or Negotiation mode are defined in the config file or shown in IPSec status.
More odd is that the customer that hit this was unable to select Aggressive mode from the drop down. The gui switched back to Main mode automatically every time.
I was unable to replicate this on my local test box but it should not be possible to get into this situation.