From log: NESMIKEv2VPNSession... I am creating NEVPNProtocolIKEv2 profile (Native IKEv2 Personal VPN). I also have no other vpn profile connected at the same time. I've tried clearing all previous profiles with no success.

Matt, you mean even if none of the profiles are active (connected)?

Ok, there's definitely a strange behaviour. If I delete all of the vpn profiles in Network preferences, only then I can connect NEVPNProtocolIKEv2 profile with IncludeAllNetworks flag. As soon as I add any other vpn profile I am no longer able to connect my IKEv2 profile. Even if I manually add some IPSec profile via Network prefeneces 🤯. This makes IncludeAllNetworks flag impossible to use in my vpn app.

No, I don't think this is the case. The conflicting VPN profile is NESMLegacySession (IPSec) added manually to the Network preferences panel by the user and NOT the app. I don't think this profile has includeAllNetworks flag set or if it even can have one.

Struggling with the same problem. So what is the non-'out of the box' file-based keychain solution? In my case the app would be deployed using Developer ID signing.