Hi @pedjoeangdigital , it should be a good idea to use key-exchange ikev2 instead of ikev1 if some of the hosts are behind a NAT. I’m not very familiar with Mikrotik, but I think you can use authentication id and authentication remote id to satisfy negotiation