ikev2 fails on iPad, user authentication failed

RouterOS Beginner Basics
1

I’m currently trying to set up IKEv2 vpn between Mikrotik RB4011 and iPad (IOS 13.3), using this guide:
https://mum.mikrotik.com/presentations/MY19/presentation_7008_1560543676.pdf
Everything kind of works, connection is established, but I do get immediately disconencted with message “User authentication failed”.
In router logs, it looks like connection was established, and simply killed afterwards:

17:22:40 ipsec,info new ike2 SA (R): xxx.xxx.xxx.xxx[500]-xxx.xxx.xxx.xxx[11252] spi:4e0a...769b 
17:22:40 ipsec,info,account peer authorized: xxx.xxx.xxx.xxx[4500]-xxx.xxx.xxx.xxx[11156] spi:4e0a...769b
17:22:40 ipsec,info killing ike2 SA: xxx.xxx.xxx.xxx[4500]-xxx.xxx.xxx.xxx[11156] spi:3070...ebef 
17:22:40 ipsec,info releasing address yyy.yyy.yyy.yyy
17:22:40 ipsec,info acquired yyy.yyy.yyy.yyy address for xxx.xxx.xxx.xxx, iPljad
2

As an sidenote, I do have SAN fields on my certificates, matching server FQDN for server and iPad’s hostname for client.

3

After setting PFS=none, log shows everything okey:

18:50:56 ipsec,info new ike2 SA (R): xxx.xxx.xxx.xxx[500]-xxx.xxx.xxx.xxx[11252] spi:8d62...8dbc 
18:50:56 ipsec,info,account peer authorized: xxx.xxx.xxx.xxx[4500]-xxx.xxx.xxx.xxx[11156] spi:8d62...8dbc 
18:50:56 ipsec,info acquired yyy.yyy.yyy.yyy address for xxx.xxx.xxx.xxx, iPljad

But still, connection is immediately dropped and iPad displays error: “User authentication failed”

4

OK, found the issue…I managed to do typo in server SAN somehow… :open_mouth: