Allowing IPsec NAT traversal

Testing a config with an ER-X on the inside of an ER-L, creating an IPsec VPN to another (remote) ER-L.

If I try to set this up using Port Forwarding (with auto firewall) I get only TCP and UDP options in the 1.8.5 GUI and no luck in the CLI either:

[edit port-forward]
admin@gateway# set rule 3 forward-to address 192.168.22.101
[edit port-forward]
admin@gateway# set rule 3 protocol 50
Protocol must be "tcp", "udp", or "tcp_udp"

How do I allow ESP to pass through to that internal IP?