Скачать или смотреть How to setup IPsec Mobile VPN using IKEv2 with EAP-MSCHAPv2 on PFsense for Remote Access

IKEv2 is supported in current pfSense versions, and one way to make it work is by using EAP-MSCHAPv2 on Azure Cloud with Pfsense firewall

Create a Certificate Authority
Create a Server Certificate
Set up Mobile IPsec for IKEv2+EAP-MSCHAPv2
Mobile Clients
Phase 1
• If there is an existing Mobile IPsec P1 entry, click the Tunnels Tab and edit it there
• Set Key Exchange version to v2
• Set Authentication method to EAP-MSChapv2
• Set My Identifier to Distinguished name and enter in the hostname of the firewall
• Set Peer Identifier to any
• Select the server certificate created previously for My Certificate
• Select the appropriate CA for My Certificate Authority
• Set Encryption algorithm to 3DES or, if there are no iOS/OS X devices, AES 256
• Set Hash algorithm to SHA1, or, if there are no iOS/OS X devices, SHA256
• Set DH key group to 2 (1024 bit)
o Multiple combinations of encryption, hashing, and DH options may be created to accommodate various clients with different requirements. Click Add Algorithm to add more entries.
• Set Lifetime to 28800
• Uncheck Disable Rekey
• Uncheck Disable Reauth
• Check Enable DPD, set for 10 seconds and 5 retries
• Click Save

Phase 2
• Click Show Phase 2 Entries to show the Mobile IPsec Phase 2 list
• Click Add P2 to add a new Phase 2 entry if one does not exist, or click to edit an existing entry
• Set Mode to Tunnel IPv4
• Set Local Network as desired, e.g. LAN subnet
o To pass all traffic, including Internet traffic, across the VPN, set the Local Network to 0.0.0.0/0
• Enter an appropriate Description
• Set Protocol to ESP
• Set Encryption algorithms to AES Auto and if there are iOS/OS X devices, also select 3DES.
• Set Hash algorithms to SHA1 and SHA256
• Set PFS Key Group to off
• Set Lifetime to 3600
• Click Save
Create Client Pre-Shared Keys
Add Firewall Rules for IPsec