A remote site's IPsec site-to-site VPN to headquarters fails to establish the IPsec SAs even though IKE phase 1 completes successfully. The remote router sits behind an ISP device that performs PAT (Port Address Translation) for all outbound traffic. Traffic is being dropped as it traverses the PAT device. Which mechanism must be enabled so the encrypted ESP traffic can successfully traverse the NAT device?