Have you tried the device tunnel over the Internet? I have a fully functional AlwaysOn VPN in lab. The User Tunnel dials in perfectly over the Internet, but the Device Tunnel keeps on failing. Error 809, indicating connectivity problems, but since the User Tunnel works over the same IKEv2 we can rule that out. Device Tunnel does connect on premise.