IKEv2 EAP radius and user manager

RouterOS The User Manager
1

Hello,
It would be great if you could elaborate on this.
Does anyone use IKEv2 EAP with the user manager?
Shared users/Max simultaneous sessions don’t work as they should when IKEv2 is used. The first connection gets disconnected when the next one is trying to connect.
It does work with PPP sessions. However, this is not the case with IKEv2. Is this related to MT doesn’t support VTI? or something else?
But when I tested this, whenever the first session was a Windows client and the second was an iOS one, there was no problem.
Both of the sessions stayed connected. When I reversed the clients, the first session (iOS) disconnected as the second one (Windows) established the connection. The same result emerged when both clients were cellphones (iOS, Android).

2

I spent some time investigating this, with the help of my AI, as I have almost exactly the same setup.

Environment

  • RouterOS 7.23.2
  • Native Apple IKEv2 clients (macOS and iOS)
  • EAP-MSCHAPv2
  • User Manager (RADIUS)
  • Let's Encrypt certificate
  • generate-policy=port-strict

Everything works well except one thing.

Problem

If two Apple devices connect simultaneously using the same User Manager username, the second device connects successfully, but the first one is immediately disconnected.

Initially I thought this was caused by User Manager, so I increased shared-users from 1 to 9. No change.

I also verified that:

  • the address pool has more than 90 available addresses
  • both devices can connect individually
  • changing the Apple Local ID does not change the behaviour

The RouterOS log consistently shows:

ipsec peer authorized
ipsec initial contact
ipsec killing IKE SA with same identity: VPN-user
ipsec releasing address 10.11.101.100
ipsec acquired 10.11.101.100 address for ..., VPN-user

My IPsec identity is configured as:

  • auth-method=eap-radius
  • certificate=<Let's Encrypt certificate>
  • generate-policy=port-strict
  • mode-config=ikev2-modecfg
  • peer=ikev2
  • policy-template-group=ikev2-group

Relevant VPN configuration:

  • IP pool: 10.11.101.10–10.11.101.100
  • Passive IKEv2 peer
  • Dynamic policy generation (generate-policy=port-strict)
  • EAP authentication through local User Manager via RADIUS
  • User Manager enabled
  • User Manager router pointing to 127.0.0.1

The User Manager account is configured with shared-users=9.

Authentication succeeds, but RouterOS immediately removes the existing IKE SA because it considers both sessions to have the same identity (VPN-user).

At this point it appears that shared-users only affects RADIUS authentication and does not allow multiple simultaneous IKE SAs using the same authenticated EAP identity.

I have opened a support case with MikroTik to clarify whether this is:

  • expected behaviour
  • configurable
  • or a RouterOS limitation

My current workaround is to create one User Manager account per device (for example vpn-iphone, vpn-mac, etc.). I don't yet know whether this is the intended RouterOS design or a limitation.

Has anyone managed to get multiple concurrent native Apple IKEv2 clients using the same EAP username against RouterOS/User Manager?

Happy to attach config if needed