Hi,
I have successfully enabled VPN access to my MikroTik router by following IPsec manual, in particular section titled Road Warrior setup using IKEv2 with RSA authentication. I do have a question about peer identity verification. The manual states: “Identity menu allows to match specific remote peers and assign different configuration for each one of them. First, create a default identity, that will accept all peers, but will verify the peer’s identity with its certificate.” and the corresponding command is:
/ip ipsec identity
add auth-method=rsa-signature certificate=server1 generate-policy=port-strict mode-config=ike2-conf peer=ike2 policy-template-group=ike2-policies
Does the certificate have to exist in System / certificates for verification to succeed? Or does it check if the peer (client) certificate was signed with the same CA certificate as the server certificate?
Many thanks in advance.