OK gotta add this to my toolkit. Its a tool that thru IKE queries to a VPN server, it can ID that server. I haven’t tried it out myself yet, but its on the list.
http://www.darknet.org.uk/2013/11/ike-scan-discover-fingerprint-ike-hosts-ipsec-vpn-servers/