Cisco IPsec Tunnel – NAT to AWS Customer Gateway

I'm trying to configure an IPSec tunnel between a Cisco router (ISR) and AWS (Customer Gateway). The connection to the ISP here is a PPPoE connection with a static private IP (e.g. 10.100.1.1) which is mapped to from a public IP, (e.g. 160.1.1.1 ). There is no filtering on the public IP, all traffic is translated to the private.

I am now trying to configure the IPSec tunnel, but am not able to get it up. The recommended configuration provided to configure a tunnel if I had a public IP is as follows:

crypto keyring preshared-key-public
  local-address 160.1.1.1
  pre-shared-key address 54.1.1.1 key XXX ! AWS IP

crypto isakmp profile isakmp-vpn-public
  keyring preshared-key-public
  match identity address 54.1.1.1 255.255.255.255
  local-address 160.1.1.1

interface Tunnel1
  ip address 169.1.1.1 255.255.255.252
  tunnel source 160.1.1.1
  tunnel destination 54.1.1.1
  tunnel mode ipsec ipv4
  tunnel protection ipsec profile pfs-group2-sometransform

This is the config I am using:

crypto keyring preshared-key-private
  local-address 10.100.1.1
  pre-shared-key address 54.1.1.1 key XXX

crypto isakmp profile isakmp-vpn-private
  keyring preshared-key-private
  match identity address 54.1.1.1 255.255.255.255
  local-address 10.100.1.1

interface Tunnel1
  tunnel source 10.100.1.1
  ! everything else is the same

So I have modified the 3 occurrences of public IPs with the private IP (based on http://blog.brianbeach.com/2015/05/configuring-aws-customer-gateway-behind.html), but the tunnel does not come up:

*Dec  8 : ISAKMP: Error: payload length of VENDOR 0 < 4
*Dec  8 : %CRYPTO-4-IKMP_BAD_MESSAGE: IKE message from 54.1.1.1    failed its sanity check or is malformed
*Dec  8 : ISAKMP (0:0): incrementing error counter on sa, attempt 1 of 5: PAYLOAD_MALFORMED
*Dec  8 : ISAKMP:(0:0:N/A:0): sending packet to 54.1.1.1 my_port 500 peer_port 500 (I) MM_NO_STATE

I initially thought that the 0 < 4 error might be related to this bug: https://tools.cisco.com/quickview/bug/CSCee74283 but firmware is a fixed version:

Cisco IOS Software, 2801 Software, Version 12.4(25c), RELEASE SOFTWARE (fc2)
ROM: System Bootstrap, Version 12.4(13r)T, RELEASE SOFTWARE (fc1)

I can confirm that the preshared secret is configured correctly, I downloaded the configuration from AWS and copied it into the Cisco config. Is the setup correct? Any ideas as to what might be wrong? I am not sure if I am meant to be using the private IP in all 3 locations (keyring, isakmp profile and interface), or should 1 of them reference the public IP (I've tried using it in keyring and isakmp profile but it didn't work either.

Before providing a public / NAT / private setup, the ISP used to provide an L2TP tunnel where the public static IP was on the router, and that worked fine. However the L2TP tunnel is no longer available (but this router / software worked with AWS in that environment)