I recently upgraded a Netgear WNDR4300 which was running "fine" (aside from slow).

Install of the AX3000 went smoothly and seems very fast, however I am unable to connet to my work IPSec VPN, which is a dealbreaker.

I have verified that IPSEC passthrough is enabled under : NAT Forwarding -> ALG

I am able to successfully pass Phase 1 and XAUTH.  

Phase 2 never completes.

The remote firewall does not need to be reconfigured.

I am using VPN Tracker 365 software on my mac.

 When I swap back to my WNDR4300 or plug my mac directly into my cable modem, I am able to successfully pass through all phases and connet the VPN without issue.

Only when the AC3000 is in the mix that Phase 2 never completes.

The PHASE 1 and XAUTH logs are very similar.  The beginning of PHASE 2 is also similar.  Below are the differences:

    Working Connection : 
            PHASE 2
            15:29:02    === Phase 2 exchange / initiator / receive 1 (321)
            15:29:02    Rewriting status 0006000F for SCP status 2
            15:29:02    Status rewritten to 0006000F for SCP connection

            15:29:02    Phase 2 in Progress

            (Status Messages and Tunnel is created)

    TP-Link : 
            PHASE 2
            15:23:05    === Phase 2 exchange / initiator / send 1 (153)

            15:23:05    NAT autodetect: 1 (273)
            15:23:05    Internal connection state is now: Connecting
            15:23:05    local ID: 0.0.0.0 (IPv4_subnet) (4078)
            15:23:05    remote ID: 192.168.1.0 (IPv4_subnet) (4132)
            15:23:05    add payload of len 48, next type: nonce (2138)
            15:23:05    add payload of len 16, next type: id (2138)
            15:23:05    add payload of len 12, next type: id (2138)
            15:23:05    add payload of len 12, next type: none (2138)
            15:23:05    phase 2, next type: hash (2059)
            15:23:05    add payload of len 32, next type: sa (2138)
            15:23:05    IKEResender: Added packet 13 (-> 8 [R]) to backlog.
            15:23:05    IKEResender: Will resend packet 13 (-> 8) in 1.000 seconds.
            15:23:05    Internal connection state is now: Connecting
            15:23:06    IKEResender: Resending packet 13 (-> 8)
            15:23:06    IKEResender: Will resend packet 13 (-> 8) in 2.000 seconds.
            (LOOPING until failure)
 

I'm not sure if it's the local id or the NAT that is the issue.