OK so far:
I have contacted support on the issue, and they asked to upgrade to V. 6.48.2 from 6.48.1, as some improvements took place regarding transport mode and IPsec. The problem persisted after the upgrade.
Then support suggested to include dst-nat rule to either machines (since both are behind NAT) and use passive mode on that machine. The problem with that is when using DDNS, MT will not allow a passive mode. In a further communication I mentioned that 2 clients could connect to the server, but one couldn’t (and none had port forwarding rules). They said that probably there were somewhere port forwarding rules. I can definitively confirm that in no modem nor any MT I have introduced port forwarding rules and yet the connection gets established (after some efforts but…gets established)
Here is what I discovered today and would like the community’s input and ideas so I can better phrase it to support:
One, out of the three clients to the server, got disconnected yesterday (I discovered due to an ISP public IP change). A couple of hours later a second client got disconnected and discovered that it was also due to a public IP change. In both cases the link did not return afterwards.
So, I went on and disabled and re-enabled all three links (as before). Did not make a difference.
Disabled completely on the server and the client MT (the first one that lost connection) all settings regarding the link (without re-enabling it), then on server disabled and re-enabled the other 2 peers and Voila the links got re-established!
I was completely baffled as you can imagine 
then I re-enabled the last remaining client with hopes…well, the link would not establish no matter what I tried! After about an hour or so research, I completely removed all settings regarding the link on that client, and on the server side I disabled the PPP/secret for that client. Entered from scratch all settings on client (L2TP client and IPsec), enabled the PPP secret on the server and then…
started noticing some packets coming in through the firewall ( chain=input action=accept protocol=udp dst-port=1701,500,4500 log=no log-prefix=" ) .
The link would still not establish, but when I disabled the peer and re-enabled it (I flushed esp and ah before), to my amazement the link established!!!
So, it seems that in transport mode because I use DDNS name if a public IP changes, when 5 minutes later (that’s my setting) that public IP address get’s renewed:
A) The link will not be re-established and disabling/enabling it will not “fix” it. As if it remembers the old IP and exchange?
B) Deleting the configuration and starting from scratch will bring me 90% close to a successful link and the final step will be flushing in IPsec and disabling/enabling the peer on the server side (didn’t try it on the client side, could be as well the case)
All three clients are currently connected to the server. Any thoughts on the above would be very much appreciated! Here are the firewall rules (if I should include something more, please let me know, I am not suggesting anywhere that I haven’t missed something).
Server
/ip firewall filter
add action=accept chain=input in-interface=ether1 protocol=ipsec-esp
add action=accept chain=input dst-port=500,1701,4500 in-interface=ether1 protocol=udp
add action=accept chain=input comment="accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="drop invalid" connection-state=invalid
add action=accept chain=input comment="accept ICMP" protocol=icmp
add action=accept chain=forward comment="accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="drop invalid" connection-state=invalid
add action=accept chain=forward comment="accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="accept out ipsec policy" ipsec-policy=out,ipsec
/ip firewall nat
add action=masquerade chain=srcnat
Client 1
/ip firewall filter
add action=accept chain=input dst-port=1701,500,4500 protocol=udp
add action=accept chain=input protocol=ipsec-esp
add action=accept chain=input comment="accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="drop invalid" connection-state=invalid
add action=accept chain=input comment="accept ICMP" protocol=icmp
add action=accept chain=forward comment="accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="drop invalid" connection-state=invalid
add action=accept chain=forward comment="accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="accept out ipsec policy" ipsec-policy=out,ipsec
add action=accept chain=output connection-state=established,related
add action=drop chain=output connection-state=invalid
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
Client 2:
/ip firewall filter
add action=accept chain=input dst-port=500,1701,4500 protocol=udp
add action=accept chain=input protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid log=yes
/ip firewall nat
add action=masquerade chain=srcnat out-interface=bridge1
Client 3:
/ip firewall filter
add action=accept chain=input dst-port=500,1701,4500 protocol=udp
add action=accept chain=input protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=\
established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=\
established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid log=yes
/ip firewall nat
add action=masquerade chain=srcnat out-interface=bridge1
! I have also emailed support regarding the so far discussed …