Hi!
Now that's a challenging task, isn't it? At least for me it was - alone the idea of this double-nat to separate the policies!
I had to look in the solution-guide for that.
I found that NAT-T is not needed there, though. I thought (and my tests support this) that NAT-T is only needed if there is PAT used. This is valid if you use any ESP-variant (like in this task). Only if you use AH, you need NAT-T with normal static NAT, too. Can anyone confirm that?
Thanks,
airflow