A managed to setup IPsec/IKev2 eap radius.
But it happens that split-include not working for windows 7.
Its working fine for win10 or mac clients.
mikrotik logs are fine - i see how he sends subnets from split-include. windows logs have no errors for Rasclient.
So maybe someone knows what is the reason?