Common for carriers to block IPSEC traffic?

I am currently trying of a POC for VIptela SD-WAN. I wanted to include LTE backup on the branch routers.

I have a working SIM card, the router gets a valid IP, etc... Everything seems to be working, but Viptela reports that BFD is getting no traffic. When I look at the IPSEC tunnels, the tx counters are going up, the rx counters are at 0.

I am in Canada, trying this with a "vanilla" Telus SIM card. Is it pretty common for carriers to hinder/block IPSEC connections like this? Do I need to request a static/public IP/APN from the carrier for this to work?