I've been tinkering with a vpn.
I can get a pptp connection from my Android (Running oreo) to my 2860 via its gsm connection.

I know pptp isn't the most secure, so I've moved up to l2tp.
However, I can't seem to get it to work, with syslog reporting authentication errors. I'm using psk mode, not certificates.

Any ideas?

The built-in L2TP client on my old Samsung S3 (Android 4) was very hit and miss - but it would eventually connect. By contrast, the client on my Huawei P9 (Android 7) has never successfully connected. The conventional wisdom seems to indicate that it is a straight-forward Android bug (but happy to be contradicted!)

I use SSL instead - via Draytek's Smart VPN app.

Yep SSL works wonderfully!