Tried my first VPN to GCP and didn’t have much luck with IKEv1. While it did detect the remote router being behind NAT, Phase1 wouldn’t come up due to an ID mismatch:
received NAT-T (RFC 3947) vendor ID remote host is behind NAT IDir '192.168.1.123' does not match to '203.0.113.222'
Where 192.168.1.123 is the Real private IP of the router and 203.0.113.222 is the public NAT IP.
When using one-to-one NAT, your on-premises VPN gateway must identify itself using the same external IP address of the NAT device
See also the same configuration with IKEv2.