So, until now, I used L2TP/IPSec, with RADIUS authentication. It worked perfectly, except there was this tiny little problem with multiple clients behind the same NAT... :) With new ROS 6.38 I tried to set up IPSec with IKEv2 and also RADIUS authentication. Now I can't connect from my Android 6.0.1 ...