...
Ask your vendor. Let us know what works.
If you are behind a Palo Alto, you will need some kind of ZeroTier bastion. As far as we know, there’s no way to enable endpoint independent mapping. Contact us for help.
Here’s a table of the likeliness of a direct connection between two types of NAT:
...