FW that handles IPsec subnet overlap withOUT 1:1 NAT?

Hello,

Just curious if anyone knows of a firewall vendor/model for an Azure VA that can handle subnet overlap across multiple IPsec tunnels without doing 1:1 NAT? ADC's seem to do this pretty easily via overload or pools, I was surprised that Palo Alto and CheckPoint can't do it. I'm averse to Cisco (paying for the name in this use case) and Fortigate (worst support of my career) but if they're the only game in town, so be it.

hoping some UTM/NGFW (or whatever the cool term is this week) out there can handle this.