Site to Site VPN, Pepwave Max BR1 5G

Need some direction on creating a site to site VPN with bidirectional routing between two Pepwave MAX BR1 Pro 5G, firmware 8.4.1. The catch is that one is behind NAT some of the time. The other is not; it’s WAN IP changes depending on how it’s connected, but it has a fully routable IPv4 address and a dynamic DNS host name.

We have a functioning client to site OpenVPN connection between them, but the host side can’t access devices on the client side; we need bidirectional access.

I setup an IPSec VPN connection on each device, but it doesn’t connect, and the logging is basic (at best). I can’t see where the issue is, but I have tinkered with IKE1/2, aggressive mode in IKE1, with and without local and remote IDs.

I do not want to use Speedfusion.