I was able to get the IPsec VPN between Cisco <=> Mikrotik and pfSense <=> Mikrotik, but not Nethserver <=> Mikrotik.
I have now set SHA256 / AES256 and DH 2048 bits with IKE2 on all platforms.
This is the message I receive:
initial parent SA message received on 1.1.1.1:4500 but no suitable connection found with IKEv2 policy
Jul 18 13:52:08 neth pluto[9755]: packet from 2.2.2.2:4500: responding to SA_INIT message (ID 0) from 1.1.1.1:4500 with unencrypted notification NO_PROPOSAL_CHOSEN
This is a great resource: