How to allow server to use IPsec side-by-side with NAT?

Question

Network administration

So, there is a server with one physical and two virtual adapters (Hyper-V). From the physical to one of the virtual, the Internet is thrown using NAT. Through another virtual adapter, the server must hold an IPsec tunnel (IKEv2) with a virtual domain controller. Naturally, RRAS cuts IPsec through some kind of policy (NPS, as I understand it): “An IPsec main mode negotiation failed. Failure Point: Local computer Failure Reason: Invalid policy”. How to chop off this NPS to hell (why is it RRAS without VPN at all ?!) or at least allow the establishment of an IPsec tunnel?

Answer 1

Do IPSec policies match on both ends of the tunnel? According to the logs, no...