@xperiments I don't know what type of internet do you have but in many case I completely remove ISP router and connect firewall directly to internet, maybe you can do the same, then your ER605...

@xperiments then I do not know, I think you need to consult with tp-link support about this, maybe they have a solution.

@xperiments you have to do it on your router with public wan ip. not on ER605 if it behind a nated router.

@xperiments Ok, but IKev1 work behind NAT? that strange. Ok then you have to nat ipsec port to your ER605 to get it to work. I think that is UDP port 500 and 4500

@xperiments Do you have som ACL roule on gateway, Switch or EAP that block? You can also enable alert on ipsec to get alert when connect or disconnect

@xperiments This is my config between two ER605, semilar config in both site. exept remote subnet and wan ip :-)