IPSec from OSX isn't working

RouterOS General
1

I was running v6.42.10, where both OSX and Linux worked fine, but not Windows (certificate chaining from what I could tell). So I upgraded to v6.44beta39, where I can now chain the certificates.

It is now working fine on both Linux and Windows, but NOT OSX any more.

My config:

/ip ipsec mode-config
add address-pool=ipsec address-prefix-length=32 name=IKEv2 split-include=10.64.0.0/10
/ip ipsec peer profile
add enc-algorithm=aes-256,3des name=profile_1
/ip ipsec peer
add exchange-mode=ike2 name=peer_1 passive=yes profile=profile_1 send-initial-contact=no
/ip ipsec policy group
add name=IKEv2
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc,3des lifetime=8h pfs-group=none
add auth-algorithms=sha512,sha256,sha1 enc-algorithms=aes-256-cbc,aes-192-cbc,aes-128-cbc,3des lifetime=8h name=IPSec pfs-group=none
add auth-algorithms=sha256 enc-algorithms="" lifetime=8h name=IKEv2 pfs-group=none
/ip ipsec identity
add auth-method=eap-radius certificate=<VPN_SERVER_CERT>,<VPN_SERVER_CERT_CA> generate-policy=port-override mode-config=IKEv2 my-id=fqdn:<VPN_SERVER_ID> peer=peer_1 policy-template-group=IKEv2
/ip ipsec policy
add dst-address=0.0.0.0/0 group=IKEv2 proposal=IPSec src-address=0.0.0.0/0 template=yes

When I try to connect the OSX client, I get:

16:15:04 ipsec -> ike2 request, exchange: SA_INIT:0 <CLIENT_EXTERNAL_IP>[1011]
16:15:04 ipsec ike2 respond
16:15:04 ipsec payload seen: SA
16:15:04 ipsec payload seen: KE
16:15:04 ipsec payload seen: NONCE
16:15:04 ipsec payload seen: NOTIFY
16:15:04 ipsec payload seen: NOTIFY
16:15:04 ipsec payload seen: NOTIFY
16:15:04 ipsec payload seen: NOTIFY
16:15:04 ipsec processing payload: NONCE
16:15:04 ipsec processing payload: SA
16:15:04 ipsec IKE Protocol: IKE
16:15:04 ipsec  proposal #1
16:15:04 ipsec   enc: 3des-cbc
16:15:04 ipsec   prf: hmac-sha1
16:15:04 ipsec   auth: sha1
16:15:04 ipsec   dh: modp2048
16:15:04 ipsec matched proposal:
16:15:04 ipsec  proposal #1
16:15:04 ipsec   enc: 3des-cbc
16:15:04 ipsec   prf: hmac-sha1
16:15:04 ipsec   auth: sha1
16:15:04 ipsec   dh: modp2048
16:15:04 ipsec processing payload: KE
16:15:04 ipsec adding payload: SA
16:15:04 ipsec adding payload: KE
16:15:04 ipsec adding payload: NONCE
16:15:04 ipsec adding notify: NAT_DETECTION_SOURCE_IP
16:15:04 ipsec adding notify: NAT_DETECTION_DESTINATION_IP
16:15:04 ipsec adding payload: CERTREQ
16:15:04 ipsec <- ike2 reply, exchange: SA_INIT:0 <CLIENT_EXTERNAL_IP>[1011]
16:15:04 ipsec,info new ike2 SA (R): <VPN_SERVER_INTERNAL_IP>[500]-<CLIENT_EXTERNAL_IP>[1011] spi:62508099bdd5ce70:4a6e54179920f977
16:15:04 ipsec processing payloads: VID (none found)
16:15:04 ipsec processing payloads: NOTIFY
16:15:04 ipsec   notify: REDIRECT_SUPPORTED
16:15:04 ipsec   notify: NAT_DETECTION_SOURCE_IP
16:15:04 ipsec   notify: NAT_DETECTION_DESTINATION_IP
16:15:04 ipsec   notify: IKEV2_FRAGMENTATION_SUPPORTED
16:15:04 ipsec (NAT-T) REMOTE LOCAL
16:15:04 ipsec KA list add: <VPN_SERVER_INTERNAL_IP>[4500]-><CLIENT_EXTERNAL_IP>[1011]
16:15:04 ipsec -> ike2 request, exchange: AUTH:1 <CLIENT_EXTERNAL_IP>[64916]
16:15:04 ipsec peer ports changed: 1011 -> 64916
16:15:04 ipsec KA remove: <VPN_SERVER_INTERNAL_IP>[4500]-><CLIENT_EXTERNAL_IP>[1011]
16:15:04 ipsec KA list add: <VPN_SERVER_INTERNAL_IP>[4500]-><CLIENT_EXTERNAL_IP>[64916]
16:15:04 ipsec payload seen: ENC
16:15:04 ipsec processing payload: ENC
16:15:04 ipsec payload seen: ID_I
16:15:04 ipsec payload seen: NOTIFY
16:15:04 ipsec payload seen: NOTIFY
16:15:04 ipsec payload seen: ID_R
16:15:04 ipsec payload seen: CONFIG
16:15:04 ipsec payload seen: NOTIFY
16:15:04 ipsec payload seen: NOTIFY
16:15:04 ipsec payload seen: SA
16:15:04 ipsec payload seen: TS_I
16:15:04 ipsec payload seen: TS_R
16:15:04 ipsec ike auth: respond
16:15:04 ipsec processing payload: ID_I
16:15:04 ipsec ID_I (ADDR4): <CLIENT_INTERNAL_IP>
16:15:04 ipsec processing payload: ID_R
16:15:04 ipsec ID_R (FQDN): <VPN_SERVER_ID>
16:15:04 ipsec processing payload: AUTH (not found)
16:15:04 ipsec also using server fqdn: <VPN_SERVER_ID>
16:15:04 ipsec identity not found for: <VPN_SERVER_ID>
16:15:04 ipsec reply notify: AUTHENTICATION_FAILED
16:15:04 ipsec adding notify: AUTHENTICATION_FAILED
16:15:04 ipsec <- ike2 reply, exchange: AUTH:1 <CLIENT_EXTERNAL_IP>[64916]
16:15:04 ipsec,info killing ike2 SA: <VPN_SERVER_INTERNAL_IP>[4500]-<CLIENT_EXTERNAL_IP>[64916] spi:62508099bdd5ce70:4a6e54179920f977
16:15:04 ipsec KA remove: <VPN_SERVER_INTERNAL_IP>[4500]-><CLIENT_EXTERNAL_IP>[64916]
2

With the help of support, I was asked to change the my-id to address::: and then back again.

That didn’t work, but removing it and then adding it back worked:

[admin@mikrotik.pharmpress.net] > /ip ipsec identity print
Flags: D - dynamic
 0   peer=peer_1 auth-method=eap-radius mode-config=IKEv2 my-id=fqdn:<VPN_SERVER_ID>
     certificate=<VPN_SERVER_CERT>,<VPN_SERVER_CERT_CA> generate-policy=port-override
     policy-template-group=IKEv2
[admin@mikrotik.pharmpress.net] > /ip ipsec identity set 0 my-id=address:::
failure: FQDN ID must be used for EAP or use my-id=auto!
[admin@mikrotik.pharmpress.net] > /ip ipsec identity print
Flags: D - dynamic
 0   peer=peer_1 auth-method=eap-radius mode-config=IKEv2 my-id=fqdn:<VPN_SERVER_ID>
     certificate=<VPN_SERVER_CERT>,<VPN_SERVER_CERT_CA> generate-policy=port-override
     policy-template-group=IKEv2
[admin@mikrotik.pharmpress.net] /ip ipsec identity> remove 0
[admin@mikrotik.pharmpress.net] /ip ipsec identity> add peer=peer_1 auth-method=eap-radius mode-config=IKEv2 my-id=fqdn:<VPN_SERVER_ID> certificate=<VPN_SERVER_CERT>,<VPN_SERVER_CERT_CA> generate-policy=port-override policy-template-group=IKEv2
[admin@mikrotik.pharmpress.net] /ip ipsec identity> print
Flags: D - dynamic
 0   peer=peer_1 auth-method=eap-radius mode-config=IKEv2 my-id=fqdn:<VPN_SERVER_ID> certificate=<VPN_SERVER_CERT>,<VPN_SERVER_CERT_CA> generate-policy=port-override policy-template-group=IKEv2
3

thanks FransUrbo!
This also fixed the problem with iOS devices.