Ok, while ago I set Watchguard external to static and now traffic to internet works. But BO VPN tunnel not come up, maybe I continue with Watchguard support. WG have ike keep-alive and dead peer notification, tested both but no success, WG logs "IKE SA is mature".