You can get IPSec to work behind a NAT router if you change the userid from the IP address, which gets translated by NAT, to the Fully Qualified Domain Name (FQDN). This essentially thwarts the IP based authentication, however, and makes you rely solely on the RSA key security.