IKEv2 MOBIKE not working on RB5009 RouterOS v7, but works fine with strongSwan on a side router

RouterOS
1

Dear All,

I'm experiencing a peculiar issue with IKEv2 VPN and MOBIKE on my RouterOS device (RB5009) and would appreciate any insights.

Problem Description:
MOBIKE does not work when the VPN server is the RB5009 itself. When my iPhone client (iOS 18) switches networks (e.g., from Wi-Fi to Cellular), the VPN connection drops and re-establishes, rather than smoothly migrating as MOBIKE should enable.

Critical Context / What I Have Already Verified:

  1. The network environment is not the issue. I set up an IKEv2 VPN server using strongSwan on a side router behind the same main RB5009. In this exact same network topology, MOBIKE works flawlessly. The iPhone connects and seamlessly migrates between Wi-Fi and Cellular without disconnection.
  2. MOBIKE is correctly implemented on the client. This confirms the problem is not with the client (iPhone) or the underlying NAT/routing of the network.
2

Hi, welcome on the forum.

I feel myself a little puzzled. If you state that network environment is not an issue then why you blame 5009?

  1. If strongSWAN on a side router behind 5009 works, how the 5009 is involved then?
  2. What device is the MOBIKE client?
  3. What device serves WiFi?
  4. What device is the MOBIKE server?

Could you please draw the configuration. One picture is worth more than a lot of words.
You can also follow this guide: Forum rules

3

Internet
│
▼
ONT (Optical Network Terminal)
│
▼
RB5009 (Main Router)
├─ PPPoE dial-up
├─ DHCP server (serving 192.168.1.0/24)
├─ IPsec IKEv2 server (the one that fails MOBIKE) ← Scenario B
├─ OpenWrt side router (running strongSwan IKEv2 server) ─ MOBIKE works correctly here ← Scenario A
├─ Linksys MX4200 x 3 (WiFi APs, mesh mode, serving SSID)
│
▼
iPhone (MOBIKE client, connecting via WiFi)

Scenario A (Working):
iPhone → MX4200 WiFi AP → RB5009 (routing/NAT) → OpenWrt/strongSwan (192.168.1.100)
→ MOBIKE works. WiFi ↔ Cellular handoff is smooth, VPN stays connected.

Scenario B (Not working):
iPhone → MX4200 WiFi AP → RB5009 (routing/NAT) → RB5009's own IPsec service
→ MOBIKE fails. WiFi ↔ Cellular handoff causes VPN to disconnect and reconnect.

The only variable between these two scenarios is the VPN server location:

  • strongSwan on OpenWrt (working)

  • RouterOS built-in IPsec on RB5009 (failing)

All other factors remain identical:

  • Same iPhone client

  • Same WiFi APs (MX4200)

  • Same DHCP server (RB5009)

  • Same NAT/routing path (RB5009 is the gateway in both cases)

I would like to clarify the proper way to configure IKEv2 on RouterOS (v7) and confirm whether MOBIKE is fully supported. Specifically, I want to understand:

  1. Are there any additional configuration parameters (beyond setting mobike=yes in /ip ipsec profile) required for MOBIKE to function correctly on RouterOS itself?

  2. Does RouterOS have any known limitations regarding MOBIKE support for locally terminated IPsec tunnels (as opposed to forwarding traffic to an internal server)?

  3. Could there be any interference from FastTrack, firewall rules, or internal routing that specifically affect MOBIKE signaling (UDP 4500) for the router's own IPsec service?

Thanks for your time.

4

This schema does explain nothing. Is OpenWRT on LAN side or WAN side? Scenario A says that on WAN side of a 5009, drawing says that on LAN side.

Suggest following that: Forum rules - #5 by gigabyte091

But I'm just thinking:

If VPN server is on 5009 then if iPhone jumps back&forth between WiFi and LTE then VPN connection switches fron LAN -> WAN -> LAN -> WAN ... interface of 5009. I'm not suprised that it couldn't match these two input directions as a part of the same connection.
Do you have harp-in NAT configured?

5

I'm not at all sure that Mikrotik supports MOBIKE at all.

Do you happen to have any reference that it's supposed to?

EDIT: If given the choice, I would rather stick with strongswan.

6

Whole post looks as prepared with an AI "support" so there could be some hallucinations in it but let us assume that the problem was really checked by the OP.

7

It's been a while, but last time I checked RouterOS's IKEv2 is not properly RFC compliant. IIRC MOBIKE is not event advertised in handshake by RouterOS.

To troubleshoot you need to sniff (and decrypt) to see what's actually being exchanged.

8

Mobile Internet Key Exchange (MOBIKE)

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-77r1.pdf

See page 90 ( IKEv2 MOBIKE )

There are many similarities with IPsec and IKE. WireGuard uses IKEv2-style DDoS COOKIES
and DPD/Keepalives. The data packet looks very similar to ESP in tunnel mode. Transport mode
is not supported. Its replay attack protection is the same as IPsec, using a replay window of 2000
(continuous packet sequence numbers). It supports PPK and has the same seamless reconnection
properties as IKEv2 MOBIKE, where a device can switch network interfaces without losing the
VPN connection. WireGuard takes advantage of multiple CPUs when present, unlike typical SSL
VPNs that are bound to one CPU.

I would try wireguard. Hopefully it's not striped out of MT's version.

Use your strongSwan config as a guide.