Previous post's config is probably what you're really after.. but to explain my earlier comment, in case you are using 1:1 nat, it works, at least on version 11.1, to use main mode and specify the public IP's as the ike gateways on each side. You would have actually disable NAT-T on both ike gateways to get it working however.
Probably the only practical reason to try it this way would be if there is some specific requirement to make the device behind nat as responder... this doesn't seem to be one of the documented supported scenarios so would be better to use aggressive mode if at all possible as previous post mentioned.
In any case, for reference below is the config I was talking about:
---------------------------
initiator
---------------------------
root@Network_A> show security ipsec security-associations
Total active tunnels: 1
ID Algorithm SPI Life:sec/kb Mon vsys Port Gateway
<131077 ESP:3des/sha1 1f526aa8 3465/ unlim - root 500 192.0.12.102
>131077 ESP:3des/sha1 77292946 3465/ unlim - root 500 192.0.12.102
root@Network_A> show configuration security | display set | match nat
set security ike policy vpn-natt-static-ikepol mode main
set security ike policy vpn-natt-static-ikepol proposal-set standard
set security ike policy vpn-natt-static-ikepol pre-shared-key ascii-text "$9$dVw2ajHmFnCZUnCtuEhVwY"
set security ike gateway vpn-natt-static-B ike-policy vpn-natt-static-ikepol
set security ike gateway vpn-natt-static-B address 192.0.12.102
set security ike gateway vpn-natt-static-B no-nat-traversal
set security ike gateway vpn-natt-static-B external-interface ge-0/0/0.12
set security ipsec policy vpn-natt-static-ipsecpol proposal-set standard
set security ipsec vpn vpn-natt-static-B bind-interface st0.12
set security ipsec vpn vpn-natt-static-B ike gateway vpn-natt-static-B
set security ipsec vpn vpn-natt-static-B ike ipsec-policy vpn-natt-static-ipsecpol
set security ipsec vpn vpn-natt-static-B establish-tunnels immediately
---------------------------
intermediate static 1:1 nat device
---------------------------
root@Network_B> show security flow session protocol esp | no-more
Session ID: 6196, Policy name: default-policy/2, Timeout: 1800, Valid
In: 192.0.12.1/0 --> 192.0.12.102/0;esp, If: ge-0/0/0.12, Pkts: 12, Bytes: 1632
Out: 192.2.12.254/0 --> 192.0.12.1/0;esp, If: ge-0/0/7.12, Pkts: 12, Bytes: 1632
root@Network_B> show configuration security nat | display set
set security nat static rule-set nat_static from zone static_nat_untrust
set security nat static rule-set nat_static rule nat_static_rule match destination-address 192.0.12.102/32
set security nat static rule-set nat_static rule nat_static_rule then static-nat prefix 192.2.12.254/32
set security nat proxy-arp interface ge-0/0/0.12 address 192.0.12.102/32
---------------------------
responder behind static nat:
---------------------------
root@endpoints> show log vpn.tr | match "role is"
Aug 10 10:09:09 Role is responder. Using responder spi 0x77292946 for payload of vpn-natt-static-B-to-A
root@endpoints> show security ipsec security-associations
Total active tunnels: 1
ID Algorithm SPI Life:sec/kb Mon vsys Port Gateway
<131073 ESP:3des/sha1 77292946 3521/ unlim - root 500 192.0.12.1
>131073 ESP:3des/sha1 1f526aa8 3521/ unlim - root 500 192.0.12.1
root@endpoints> show configuration security | display set | match "ike|ipsec" | no-more
set security ike traceoptions file vpn.tr
set security ike traceoptions file size 5m
set security ike traceoptions file files 2
set security ike traceoptions flag all
set security ike policy vpn-natt-static-ikepol mode main
set security ike policy vpn-natt-static-ikepol proposal-set standard
set security ike policy vpn-natt-static-ikepol pre-shared-key ascii-text "$9$GGjkPFnCBIc5QIcylLXUjH"
set security ike gateway vpn-natt-static-B-to-A ike-policy vpn-natt-static-ikepol
set security ike gateway vpn-natt-static-B-to-A address 192.0.12.1
set security ike gateway vpn-natt-static-B-to-A no-nat-traversal
set security ike gateway vpn-natt-static-B-to-A external-interface fe-0/0/2.12
set security ipsec traceoptions flag all
set security ipsec policy vpn-natt-static-ipsecpol proposal-set standard
set security ipsec vpn vpn-natt-static-B-to-A bind-interface st0.12
set security ipsec vpn vpn-natt-static-B-to-A ike gateway vpn-natt-static-B-to-A
set security ipsec vpn vpn-natt-static-B-to-A ike ipsec-policy vpn-natt-static-ipsecpol
set security ipsec vpn vpn-natt-static-B-to-A establish-tunnels on-traffic