site to site VPN between two different wr11 through cellular ppp not working

I am trying to create an ipsec VPN between two WR11 XT Modems using the AN10 application note. The only difference is in the initiator when I set the ipsec rule I use a hostname that is resolving through dydns in my event log I see that it resolves to the remote ip address but the responder refuses to negotiate in aggressive mode. This is across two different cellular networks. It seems to time out even though the correct ip address resolves? Any Ideas

Hi and welcome to Digi Forums.

AN10 would be the right Application Note to follow for such setup.
Have you ensured that the responder is accessible from the initiator (respond to pings)?
Also ensure you are running the latest firmware version found on our website:

You can find some troubleshooting steps for ipsec here:

and here:

For any further help on this issue, please contact our Technical Support team at . Make sure to provide an IMEI of the devices for warranty and Base support registration as well as the debug.txt from the device:

Thank you


Digi Technical Support Engineer

Adding to Alex’s notes…
The VPN responder MUST have a public IP address on its WAN interface.
Just because DynDNS registers the address in use does not mean it is public and routable.
If the address assigned is in a private range, then this will not work, even with DynDNS.
Common private ranges are: - - - -

Even if the WR11 SIM provides a public IP address, you need to ensure that IPsec services are allowed. Some mobile network operators will block certain ports and protocols. Check this with the network operator.

If either of these are the cause, there is nothing Digi Support can do to help.

Ben - Digi Support