2
It can work.
You need to specify on both sides the local "authentication ID" and "authentication remote-id" (crossed of course).
The reason is that each device must be able to associate the incoming packets to a configuration, so it needs an ID. Since the IP addresses are modified by NAT, they cannot be used as ID and you need to provide ...
Only top voted, non community-wiki answers of a minimum length are eligible
