VPN IPSEC with a nat-enabled router

Hi. I've a litte question about a VPN problem.

The situation is this:

Internet =70.4.... (with 1 public static IP)  => Fiber routrer  == 192.168.1.x ==> USG110 ==192.168.10.x= => LAN

The customer has another person that needs to connect to the lan. I tried with SSL VPN and it worked fine (I natted all ports from router to firewall), but my boss sold them the IPSEC license. I tried the autoconfiguration but, when I download the cofiguration from the client, it sets the destination IP the wan IP of the firewall (192.168.1.2) and not the external one. So the client won't work. If I manually the remote gateway on the client with the public IP, everything stops after "sending phase 1 ID".

Unfortunatly I cannot put the pubblic IP on firewall's wan

I read some docs, but I cannot find my actual situation to search any hint for the config