If the IKE traffic is terminated on a Cisco device, it can contain a Cisco vendor ID field. If the Cisco vendor ID field is seen in IKE packets by the App-ID it will be identified as 'ciscovpn' application.
owner: nmiletic
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm0iCAC&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail