Подключение mikrotik к strongswan.

  config setup
       uniqueids = no
   #   charondebug="cfg 2, dmn 2, ike 2, net 2"
  
  conn %default
     ike=aes128-sha256-modp2048!
     esp=aes128-sha256-modp2048!
     ikelifetime= 24h
     lifetime = 1h
     dpdaction=restart
     dpddelay=120s
     fragmentation=yes
     forceencaps=yes
     type=tunnel
     rekey=no
     keyingtries=1
     #SERVER SIDE
     left=%any
     leftauth=pubkey    
     leftid=@vpn.example.ru
     leftcert=vpnHostCert.pem
     leftsendcert=always
     leftsubnet=0.0.0.0/0
     #CLIENT SIDE
     right=%any
     rightauth=pubkey
     rightdns=8.8.8.8,8.8.4.4
     rightsubnet=192.168.88.1/24, 192.168.8.1/24
 # IKEv2: Newer version of the IKE protocol
 conn IPSec-IKEv2
     keyexchange=ikev2
     auto=add

[admin@MikroTik] > /ip ipsec peer print
Flags: X - disabled, D - dynamic, R - responder
 0     address=ip_server_strongswan/32 auth-method=rsa-signature
       certificate=BrightCert.pem_0 remote-certificate=BrightCert.pem_0
       generate-policy=port-strict policy-template-group=default
       exchange-mode=ike2 send-initial-contact=yes hash-algorithm=sha256
       enc-algorithm=aes-128 dh-group=modp2048 lifetime=1d dpd-interval=2m

[admin@MikroTik] > /certificate print
Flags: K - private-key, D - dsa, L - crl, C - smart-card-key, A - authority, I - issued, R - revoked, E - expired, T - trusted
 #          NAME      COMMON-NAME    SUBJECT-ALT-NAME FINGERPRINT
 0        T vpn.example.ruCert.pem_0 vpn.example.ru *****... # CA cert
 1 K      T BrightCert.pem_0   bright@example.ru  email:bright@.example.ru *****...  # cert with private key                                                        

май 21 22:05:53 ipsec[16853]: 08[NET] sending packet: from ip_server_strongswan[4500] to ip_mikrotik_client[2282] (80 bytes)
май 21 22:05:53 vpn.example.ru ipsec[16853]: 09[NET] received packet: from ip_mikrotik_client[2282] to ip_server_strongswan[4500] (424 bytes)
май 21 22:05:53 vpn.example.ru ipsec[16853]: 09[ENC] parsed IKE_SA_INIT request 0 [ N(NATD_D_IP) N(NATD_S_IP) No KE SA ]
май 21 22:05:53 vpn.example.ru charon[16862]: 12[ENC] parsed IKE_AUTH request 1 [ IDi AUTH CERT N(INIT_CONTACT) SA TSi TSr N(USE_TRANSP) ]
май 21 22:05:53 vpn.example.ru ipsec[16853]: 09[IKE] ip_mikrotik_client is initiating an IKE_SA
май 21 22:05:53 vpn.example.ru ipsec[16853]: 09[IKE] remote host is behind NAT
май 21 22:05:53 vpn.example.ru ipsec[16853]: 09[IKE] sending cert request for "C=Russia, O=ORG, CN=vpn.example.ru"
май 21 22:05:53 vpn.example.ru ipsec[16853]: 09[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ]
май 21 22:05:53 vpn.example.ru ipsec[16853]: 09[NET] sending packet: from ip_server_strongswan[4500] to ip_mikrotik_client[2282] (465 bytes)
май 21 22:05:53 vpn.example.ru ipsec[16853]: 06[NET] received packet: from ip_mikrotik_client[2282] to ip_server_strongswan[4500] (1792 bytes)
май 21 22:05:53 vpn.example.ru ipsec[16853]: 06[ENC] parsed IKE_AUTH request 1 [ IDi AUTH CERT N(INIT_CONTACT) SA TSi TSr N(USE_TRANSP) ]
май 21 22:05:53 vpn.example.ru ipsec[16853]: 06[IKE] received end entity cert "C=Russia, O=ORG, CN=bright@example.ru"
май 21 22:05:53 vpn.example.ru ipsec[16853]: 06[CFG] looking for peer configs matching ip_server_strongswan[%any]...ip_mikrotik_client[C=Russia, O=ORG, CN=bright@example.ru]
май 21 22:05:53 vpn.example.ru ipsec[16853]: 06[CFG] selected peer config 'IPSec-IKEv2'
май 21 22:05:53 vpn.example.ru ipsec[16853]: 06[CFG]   using certificate "C=Russia, O=ORG, CN=bright@example.ru"
май 21 22:05:53 vpn.example.ru ipsec[16853]: 06[CFG]   using trusted ca certificate "C=Russia, O=ORG, CN=vpn.example.ru"
май 21 22:05:53 vpn.example.ru ipsec[16853]: 06[CFG] checking certificate status of "C=Russia, O=ORG, CN=bright@example.ru"
май 21 22:05:53 vpn.example.ru ipsec[16853]: 06[CFG] certificate status is not available
май 21 22:05:53 vpn.example.ru ipsec[16853]: 06[CFG]   reached self-signed root ca with a path length of 0
май 21 22:05:53 vpn.example.ru ipsec[16853]: 06[IKE] authentication of 'C=Russia, O=ORG, CN=bright@example.ru' with RSA signature successful
май 21 22:05:53 vpn.example.ru ipsec[16853]: 06[IKE] no private key found for 'vpn.example.ru'
май 21 22:05:53 vpn.example.ru ipsec[16853]: 06[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]