I have set up an ipsec connection according to https://wiki.mikrotik.com/wiki/IKEv2_EAP_between_NordVPN_and_RouterOS Option 1
The connection fails with quite non-informative error: ipsec,error EAP failed:
I have the latest RouterOS v6.46
Here the logs in debug mode:
21:30:42 ipsec ike2 starting for: 23.226.132.237
21:30:43 ipsec adding notify: NAT_DETECTION_DESTINATION_IP
21:30:43 ipsec adding notify: NAT_DETECTION_SOURCE_IP
21:30:43 ipsec adding payload: NONCE
21:30:43 ipsec adding payload: KE
21:30:43 ipsec adding payload: SA
21:30:43 ipsec <- ike2 request, exchange: SA_INIT:0 23.226.132.237[4500] 6d7e507d7e8ae0b2:0000000000000000
21:30:43 ipsec -> ike2 reply, exchange: SA_INIT:0 23.226.132.237[4500] 6d7e507d7e8ae0b2:0000000000000000
21:30:43 ipsec payload seen: NOTIFY
21:30:43 ipsec first payload is NOTIFY
21:30:43 ipsec processing payloads: NOTIFY
21:30:43 ipsec notify: COOKIE
21:30:43 ipsec adding notify: COOKIE
21:30:43 ipsec adding notify: NAT_DETECTION_DESTINATION_IP
21:30:43 ipsec adding notify: NAT_DETECTION_SOURCE_IP
21:30:43 ipsec adding payload: NONCE
21:30:43 ipsec adding payload: KE
21:30:43 ipsec adding payload: SA
21:30:43 ipsec -> ike2 reply, exchange: SA_INIT:0 23.226.132.237[4500] 6d7e507d7e8ae0b2:8c639a553a050e77
21:30:43 ipsec ike2 initialize recv
21:30:43 ipsec payload seen: SA
21:30:43 ipsec payload seen: KE
21:30:43 ipsec payload seen: NONCE
21:30:43 ipsec payload seen: NOTIFY
21:30:43 ipsec payload seen: NOTIFY
21:30:43 ipsec payload seen: NOTIFY
21:30:43 ipsec processing payload: NONCE
21:30:43 ipsec processing payload: SA
21:30:43 ipsec IKE Protocol: IKE
21:30:43 ipsec proposal #1
21:30:43 ipsec enc: aes128-cbc
21:30:43 ipsec prf: hmac-sha1
21:30:43 ipsec auth: sha1
21:30:43 ipsec dh: modp2048
21:30:43 ipsec matched proposal:
21:30:43 ipsec proposal #1
21:30:43 ipsec enc: aes128-cbc
21:30:43 ipsec prf: hmac-sha1
21:30:43 ipsec auth: sha1
21:30:43 ipsec dh: modp2048
21:30:43 ipsec processing payload: KE
21:30:43 ipsec,info new ike2 SA (I): 192.168.178.24[4500]-23.226.132.237[4500] spi:6d7e507d7e8ae0b2:8c639a553a050e77
21:30:43 ipsec processing payloads: NOTIFY
21:30:43 ipsec notify: NAT_DETECTION_SOURCE_IP
21:30:43 ipsec notify: NAT_DETECTION_DESTINATION_IP
21:30:43 ipsec notify: MULTIPLE_AUTH_SUPPORTED
21:30:43 ipsec (NAT-T) LOCAL
21:30:43 ipsec KA list add: 192.168.178.24[4500]->23.226.132.237[4500]
21:30:43 ipsec init child
21:30:43 ipsec init child continue
21:30:43 ipsec offering proto: 3
21:30:43 ipsec proposal #1
21:30:43 ipsec enc: aes256-cbc
21:30:43 ipsec enc: aes192-cbc
21:30:43 ipsec enc: aes128-cbc
21:30:43 ipsec auth: sha1
21:30:43 ipsec can't get local certificate from configuration
21:30:43 ipsec ID_I (ADDR4): 192.168.178.24
21:30:43 ipsec adding payload: ID_I
21:30:43 ipsec adding notify: INITIAL_CONTACT
21:30:43 ipsec adding payload: SA
21:30:43 ipsec initiator selector: 0.0.0.0/0
21:30:43 ipsec adding payload: TS_I
21:30:43 ipsec responder selector: 0.0.0.0/0
21:30:43 ipsec adding payload: TS_R
21:30:43 ipsec prepearing internal IPv4 address
21:30:43 ipsec prepearing internal IPv4 netmask
21:30:43 ipsec prepearing internal IPv6 subnet
21:30:43 ipsec prepearing internal IPv4 DNS
21:30:43 ipsec adding payload: CONFIG
21:30:43 ipsec <- ike2 request, exchange: AUTH:1 23.226.132.237[4500] 6d7e507d7e8ae0b2:8c639a553a050e77
21:30:43 ipsec -> ike2 reply, exchange: AUTH:1 23.226.132.237[4500] 6d7e507d7e8ae0b2:8c639a553a050e77
21:30:43 ipsec payload seen: ENC
21:30:43 ipsec processing payload: ENC
21:30:43 ipsec payload seen: ID_R
21:30:43 ipsec payload seen: CERT
21:30:43 ipsec payload seen: CERT
21:30:43 ipsec payload seen: AUTH
21:30:43 ipsec payload seen: EAP
21:30:43 ipsec processing payloads: NOTIFY (none found)
21:30:43 ipsec ike auth: initiator finish
21:30:43 ipsec processing payload: ID_R
21:30:43 ipsec ID_R (FQDN): us3398.nordvpn.com
21:30:43 ipsec processing payload: AUTH
21:30:43 ipsec processing payloads: CERT
21:30:43 ipsec got CERT: us3398.nordvpn.com
21:30:43 ipsec got CERT: CN=NordVPN CA4,C=PA,ST=,L=,O=NordVPN,OU=,SN=
21:30:43 ipsec requested auth method: RSA
21:30:44 ipsec,info,account peer authorized: 192.168.178.24[4500]-23.226.132.237[4500] spi:6d7e507d7e8ae0b2:8c639a553a050e77
21:30:44 ipsec processing payload: EAP
21:30:44 ipsec adding payload: EAP
21:30:44 ipsec <- ike2 request, exchange: AUTH:2 23.226.132.237[4500] 6d7e507d7e8ae0b2:8c639a553a050e77
21:30:44 ipsec -> ike2 reply, exchange: AUTH:2 23.226.132.237[4500] 6d7e507d7e8ae0b2:8c639a553a050e77
21:30:44 ipsec payload seen: ENC
21:30:44 ipsec processing payload: ENC
21:30:44 ipsec payload seen: EAP
21:30:44 ipsec processing payloads: NOTIFY (none found)
21:30:44 ipsec processing payload: EAP
21:30:44 ipsec adding payload: EAP
21:30:44 ipsec <- ike2 request, exchange: AUTH:3 23.226.132.237[4500] 6d7e507d7e8ae0b2:8c639a553a050e77
21:30:44 ipsec -> ike2 reply, exchange: AUTH:3 23.226.132.237[4500] 6d7e507d7e8ae0b2:8c639a553a050e77
21:30:44 ipsec payload seen: ENC
21:30:44 ipsec processing payload: ENC
21:30:44 ipsec payload seen: EAP
21:30:44 ipsec processing payloads: NOTIFY (none found)
21:30:44 ipsec processing payload: EAP
21:30:44 ipsec adding payload: EAP
21:30:44 ipsec <- ike2 request, exchange: AUTH:4 23.226.132.237[4500] 6d7e507d7e8ae0b2:8c639a553a050e77
21:30:46 ipsec -> ike2 reply, exchange: AUTH:4 23.226.132.237[4500] 6d7e507d7e8ae0b2:8c639a553a050e77
21:30:46 ipsec payload seen: ENC
21:30:46 ipsec processing payload: ENC
21:30:46 ipsec payload seen: EAP
21:30:46 ipsec processing payloads: NOTIFY (none found)
21:30:46 ipsec processing payload: EAP
21:30:46 ipsec,error EAP failed:
21:30:46 ipsec,info killing ike2 SA: 192.168.178.24[4500]-23.226.132.237[4500] spi:6d7e507d7e8ae0b2:8c639a553a050e77
21:30:46 ipsec KA remove: 192.168.178.24[4500]->23.226.132.237[4500]
Any idea what it means?