IPSEC Draytek Vigor 3900 behind NAT from service provider to Azure

Trying to setup an IPSEC tunnel between a Draytek Vigor 3900 to Azure.

First time working with Draytek and not impressed with the lack of info/ease of use.

My issue is that the company has an ISP provided router that NATs all traffic to 192.168.1.x network. ISP router gives DHCP IP to Draytek WAN1 interface.

I'm pretty sure I need to configure the VPN tunnel with source being the public IP, which is invisible to the Draytek.

Any idea how to do this? I tried setting up an alias to the WAN1 with the public IP and lost connectivity, so I guess that's not it.