Windows 2008 R2 IPSEC fails if NAT involved

Question

I'm deploying a project that includes an IPSEC Tunnel between Windows servers, through a NAT Firewall. When both servers were windows 2003, this worked fine. We have had to migrate to Win2k8R2, and now the tunnel is established, but no traffic flows through
the tunnel.
The tunnel has been tested in both Windows Firewall with Advanced Security, and Legacy "Policy Agent" configuration with the same result.
Originally we were Win2k3 to Win2k3 and it worked:
|Win2k3 PRIVATEIP|-------|NATFW|-----------|Win2K3 PUBLICIP|
Then we had to switch one server to Win2k8R2:
|Win2k3 PRIVATEIP|-------|NATFW|-----------|Win2K8R2 PUBLICIP|
NATFW is mapping the yellow server to a blue IP address.  It is a 1:1 mapping, NAT not PAT! Our tunnel establishes, but no traffic will flow. In our testing, we have the following results:
Yellow......Blue........Subnets...........Outcome
=================================================
2k8R2.......2k8R2.......same..............OK
2k3..........2k8R2.......same..............OK
2k3..........2k3..........same..............OK
2k8R2.......2k8R2.......routed,no.NAT....OK
2k3..........2k8R2.......routed,no.NAT.....OK
2k3..........2k3..........routed,no.NAT.....OK
2k8R2.......2k8R2.......routed,NAT........Fail.(quick/main.mode.established,.no.traffic)
2k3..........2k8R2.......routed,NAT........Fail.(quick/main.mode.established,.no.traffic)
2k3..........2k3..........routed,NAT........OK
any thoughts.

Answer 1

Hi I have exactly the same issue.
2k8R2.......2k8R2.......routed,no.NAT....OK
2k8R2.......2k8R2.......routed,NAT........Fail.(quick/main.mode.established,.no.traffic)
Did you find any solution for this? 
It is recommended to install ISA server to manage NAT and IPSEC. But I don't want to do this for some reasons.