SAMJUN

Comments

I'll have another chance at testing in the next few days. I will then post some logs. Thanks thus far!

in USG 500 FLEX: IPSec Site-to-Site behind Double NAT only possible in Aggressive Mode? Comment by SAMJUN September 2022
Yes, the PFS settings are hidden behind the 'Advanced' button. But that's only affecting dial-out connections. For incoming connections the Draytek seems to accept any combination of these parameters which are listed under 'IPSec General Setup': 'Nailed up' and NAT Traversal are enabled.

in USG 500 FLEX: IPSec Site-to-Site behind Double NAT only possible in Aggressive Mode? Comment by SAMJUN September 2022
@Zyxel_Cooldia Thanks for the warm welcome! :) The USG 500 is a DMZ host of the first NAT router so it is passing everything right through to the USG 500. @mMontana That's correct, yes. This is the working LAN to LAN profile in the Vigor: I will extract some IKE logs as soon as possible and post it here, too.

in USG 500 FLEX: IPSec Site-to-Site behind Double NAT only possible in Aggressive Mode? Comment by SAMJUN August 2022