I am trying to connect an iPhone (iOS 16/17) to a MikroTik RouterOS 7.8 using IKEv2 + IPsec and it consistently fails.

The same configuration does work with a Debian 13 client using strongSwan.

The error message in RouterOS log is always identity not found for server:valid.fqdn peer: (here it changes depending on the config: RFC822 or FQDN or ADDR4 depending on the content of local ID config in iOS VPN)

Environment:

• MikroTik RouterOS: 7.8 with RB3011UiAS
• iOS 18.6.2 with iPhone 14
• VPN type: IKEv2 (IPsec)
• Client: iOS built-in VPN (IKEv2)
• Authentication: Certificates

Here parts of the RouterOS config:

/ip ipsec mode-config add address-pool=pool-vlan35-private name=ikev2-pool
/ip ipsec profile add dh-group=ecp256,modp2048 enc-algorithm=aes-256 hash-algorithm=sha256 name=ikev2-profile
/ip ipsec peer add exchange-mode=ike2 name=ikev2-peer passive=yes profile=ikev2-profile
add auth-algorithms=sha256 enc-algorithms=aes-256-cbc,aes-256-gcm name=ikev2-proposal pfs-group=ecp256
/ip ipsec identity
add auth-method=digital-signature certificate=SRV-IKEV2 generate-policy=port-strict match-by=certificate mode-config=ikev2-pool peer=ikev2-peer remote-certificate=CLI-IPHONE

I have tried all possible combinations with IPsec identity in the Mikrotik side and also with different types of client certificates including:

• Include common-name in the client certificate
• Include subject-alt-name in the client certificate
• days-valid=700, key-usage=tls-client
• Exported to iOS both Client and CA (also made trusted CA)

I have tried all possible combinations that I can think of (match by remote id, certificate, remote id type auto, none, etc.) nothing seems to work.

I sure I am missing something, but cannot find the cause.

Some questions:

• Does the field Local ID in the VPN config in iOS has to be:

1. empty (iOS in this case tries to use the local IP ADDR4 and connection is rejected)
2. include the FQDN (Shall I add a DNS instead of an Email in the SAN?)
3. The Subject Alt. Name of the client certificate
4. The Subject Alt. Name of the server certificate (This should be the Remote ID field not local but I have also tried)

• Why does MikroTik reject the RFC822 identity even when it matches the client certificate's Subject Alt. Name (Email type)?.