Hi
if you are doing port forwarding you are going to have to use the firewall as you dont just need port 500 you also will need protocol 50 for the esp packets
yjr fire wall rule for port forwarding would be like this
pass in break end on ppp 1 proto udp from a.a.a.a to any port=ike -> to z.z.z.z
pass in break end on ppp 1 proto udp from a.a.a.a to any port=ikefloat -> to z.z.z.z
pass in break end on ppp 1 proto 50 from a.a.a.a to any -> to z.z.z.z
pass out break end on ppp 1
information on the firewall can be found here
https://www.digi.com/resources/documentation/digidocs/PDFs/90001019.pdf page 759
the other way to use the wr21 in ip passthrough mode as drscribed in this document
http://ftp1.digi.com/support/documentation/AN_38_IP_Passthrough_On_TransPort_Routers.pdf