After adding the src ip options for VPN clients could finally establish two simultaneous connections to a VPN concentrator.
It gave balance to the links
On FortiGate you can specify “local-gw” and “remote-gw” for the IPSEC phase1, this gives you quite a bit of flexibility on devices with multiple IP addresses allowing you to terminate/originate a tunnel to a specific IP but not others.
Example config from Fortigate:
config vpn ipsec phase1
edit "P1-SupplierVPN"
set interface "port1"
set local-gw 10.98.50.1
set dhgrp 2
set keylife 86400
set proposal 3des-sha1
set remote-gw 26.43.2.70
set psksecret ENC #######
next
Also, I know the Mikrotik guys laugh about how many times I have requested this, but PLEASE add Virtual Tunnel Interfaces to IPSEC, and finish off xauth-RADIUS support so its actually useful
I implement IPsec tunnel interface in SonicWall SRA solutions and those tunnels work superb with a load of (OSPF) routing options.
It would be perfect if RouterOS would support a kind of ipsec virtual interface just like IPIP and GRE tunnels but then standard with ipsec security. With the performance of IPIP+ipsec and the nice MTU independent usage of GRE+ipsec.
Also source IP for any kind of tunnel is very important especially if you have multiple WAN and per WAN a load of usable IP addresses.
I think a big part of the problem with IPSEC on RouterOS is that Mikrotik are still using Racoon for IPSEC, to support most of the requested features they will need to move to StrongSwan.
Not a huge undertaking, but not a small one either.