An update to the earlier working config examples to setup wifi VLANs with cAP AC, cAP AX and CAPsMAN, this time including a management VLAN.
- RB960PGS running CAPsMAN
- RBcAPGi-5acD2nD cAP AC connected to eth4
- cAPGi-5HaxD2HaxD cAP AX connected to eth5
- cAP AC wifi configured via cAP VLAN interfaces
- cAP AX wifi configured via CAPsMAN datapath VLAN
- All devices running v7.16.2
- VLAN 10 - management VLAN + CAPsMAN
- VLAN 20 - cAP AC client wifi with SSID = Access McAccessPoint
- VLAN 30 - cAP AC guest wifi with SSID = Access McAccessPoint-Guest
- VLAN 40 - cAP AX client wifi with SSID = Testy McTesticle
- VLAN 50 - cAP AX guest wifi with SSID = Testy McTesticle-Guest
- Router <> cAP VLAN interfaces configured as trunks
- Separate DHCP configured for each VLAN
- CAPsMAN configured for VLAN 10 (management)
WARNING: The config below aligns with the ordering when exporting config.
Running commands to admit-only-vlan-tagged packets on interfaces may lock you out of the device if you are connected via that interface.
e.g. on a cAP AC or cAP AX if you are connected via ether 1 run these commands as the end/as the very last step.
/interface bridge port
add bridge=bridgeLocal frame-types=admit-only-vlan-tagged interface=ether1
And don’t forget to secure your network with firewall rules kids!
RB960PGS running CAPsMAN
/interface bridge
set [ find comment=defconf ] vlan-filtering=yes
/interface vlan
add interface=bridge name=vlan10-mgmt vlan-id=10
add interface=bridge name=vlan20-client-capac vlan-id=20
add interface=bridge name=vlan30-guest-capac vlan-id=30
add interface=bridge name=vlan40-client-capax vlan-id=40
add interface=bridge name=vlan50-guest-capax vlan-id=50
# NOTE: This could be simplified if frequencies weren't specified for 2Ghz AX, 2Ghz N, 5Ghz AC, 5Ghz AX
/interface wifi channel
add band=2ghz-ax disabled=no frequency=2412-2462 name=cap-ch2ax skip-dfs-channels=10min-cac
add band=2ghz-n disabled=no frequency=2412-2462 name=cap-ch2n skip-dfs-channels=10min-cac
add band=5ghz-ac disabled=no name=cap-ch5ac skip-dfs-channels=10min-cac
add band=5ghz-ax disabled=no name=cap-ch5ax skip-dfs-channels=10min-cac
/interface wifi datapath
add bridge=bridge disabled=no name=cap-dp-ac
add bridge=bridge disabled=no name=cap-dp-ax40-client vlan-id=40
add bridge=bridge disabled=no name=cap-dp-ax50-guest vlan-id=50
# NOTE: This could be simplified if unique passwords weren't required for each VLAN
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disabled=no ft=yes ft-over-ds=yes name=cap-secwpa3-vlan20-client
add authentication-types=wpa2-psk,wpa3-psk disabled=no ft=yes ft-over-ds=yes name=cap-secwpa3-vlan30-guest
add authentication-types=wpa2-psk,wpa3-psk disabled=no ft=yes ft-over-ds=yes name=cap-secwpa3-vlan40-client
add authentication-types=wpa2-psk,wpa3-psk disabled=no ft=yes ft-over-ds=yes name=cap-secwpa3-vlan50-guest
# NOTE: The steering/neighbor groups are only created after an initial CAPsMAN provisioning i.e. must be added after
/interface wifi steering
add disabled=no name=cap-steering-capac-vlan20-client neighbor-group="dynamic-Access McAccessPoint-f3ea40ae"
add disabled=no name=cap-steering-capac-vlan30-guest neighbor-group="dynamic-Access McAccessPoint-Guest-f3ea40ae"
add disabled=no name=cap-steering-capax-vlan40-client neighbor-group="dynamic-Testy McTesticle-f3ea40ae"
add disabled=no name=cap-steering-capax-vlan50-guest neighbor-group="dynamic-Testy McTesticle-f3ea40ae"
# NOTE: The steering/neighbor groups are only created after an initial CAPsMAN provisioning i.e. must be added after
/interface wifi configuration
add channel=cap-ch2n country="New Zealand" datapath=cap-dp-ac disabled=no name=cap-cfg2n-vlan20-client security=cap-secwpa3-vlan20-client ssid="Access McAccessPoint" steering=cap-steering-capac-vlan20-client
add channel=cap-ch2n country="New Zealand" datapath=cap-dp-ac disabled=no name=cap-cfg2n-vlan30-guest security=cap-secwpa3-vlan30-guest ssid="Access McAccessPoint-Guest" steering=cap-steering-capac-vlan30-guest
add channel=cap-ch5ac country="New Zealand" datapath=cap-dp-ac disabled=no name=cap-cfg5ac-vlan20-client security=cap-secwpa3-vlan20-client ssid="Access McAccessPoint" steering=cap-steering-capac-vlan20-client
add channel=cap-ch5ac country="New Zealand" datapath=cap-dp-ac disabled=no name=cap-cfg5ac-vlan30-guest security=cap-secwpa3-vlan30-guest ssid="Access McAccessPoint-Guest" steering=cap-steering-capac-vlan30-guest
add channel=cap-ch2ax country="New Zealand" datapath=cap-dp-ax40-client disabled=no name=cap-cfg2ax-vlan40-client security=cap-secwpa3-vlan40-client ssid="Testy McTesticle" steering=cap-steering-capax-vlan40-client
add channel=cap-ch2ax country="New Zealand" datapath=cap-dp-ax50-guest disabled=no name=cap-cfg2ax-vlan50-guest security=cap-secwpa3-vlan50-guest ssid="Testy McTesticle-Guest" steering=cap-steering-capax-vlan50-guest
add channel=cap-ch5ax country="New Zealand" datapath=cap-dp-ax40-client disabled=no name=cap-cfg5ax-vlan40-client security=cap-secwpa3-vlan40-client ssid="Testy McTesticle" steering=cap-steering-capax-vlan40-client
add channel=cap-ch5ax country="New Zealand" datapath=cap-dp-ax50-guest disabled=no name=cap-cfg5ax-vlan50-guest security=cap-secwpa3-vlan50-guest ssid="Testy McTesticle-Guest" steering=cap-steering-capax-vlan50-guest
/ip pool
add name=ipv4-pool-dhcp-vlan10 ranges=10.10.10.200-10.10.10.254
add name=ipv4-pool-dhcp-vlan20 ranges=10.10.20.200-10.10.20.254
add name=ipv4-pool-dhcp-vlan30 ranges=10.10.30.200-10.10.30.254
add name=ipv4-pool-dhcp-vlan40 ranges=10.10.40.200-10.10.40.254
add name=ipv4-pool-dhcp-vlan50 ranges=10.10.50.200-10.10.50.254
/ip dhcp-server
add address-pool=ipv4-pool-dhcp-vlan10 interface=vlan10-mgmt name=dhcpv4-server-vlan10
add address-pool=ipv4-pool-dhcp-vlan20 interface=vlan20-client-capac name=dhcpv4-server-vlan20
add address-pool=ipv4-pool-dhcp-vlan30 interface=vlan30-guest-capac name=dhcpv4-server-vlan30
add address-pool=ipv4-pool-dhcp-vlan40 interface=vlan40-client-capax name=dhcpv4-server-vlan40
add address-pool=ipv4-pool-dhcp-vlan50 interface=vlan50-guest-capax name=dhcpv4-server-vlan50
# WARNING: If you are connected via ether4 or ether5 this config may lock you out WARNING
# WARNING: If you are connected via ether4 or ether5 run these commands at end WARNING
/interface bridge port
add bridge=bridge frame-types=admit-only-vlan-tagged interface=ether4
add bridge=bridge frame-types=admit-only-vlan-tagged interface=ether5
/interface bridge vlan
add bridge=bridge tagged=bridge,ether4,ether5 vlan-ids=10
add bridge=bridge tagged=bridge,ether4 vlan-ids=20
add bridge=bridge tagged=bridge,ether4 vlan-ids=30
add bridge=bridge tagged=bridge,ether5 vlan-ids=40
add bridge=bridge tagged=bridge,ether5 vlan-ids=50
/interface wifi capsman
set ca-certificate=auto certificate=auto enabled=yes interfaces=vlan10-mgmt package-path="" require-peer-certificate=no upgrade-policy=none
/interface wifi provisioning
add action=create-dynamic-enabled disabled=no master-configuration=cap-cfg2ax-vlan40-client slave-configurations=cap-cfg2ax-vlan50-guest supported-bands=2ghz-ax
add action=create-dynamic-enabled disabled=no master-configuration=cap-cfg2n-vlan20-client slave-configurations=cap-cfg2n-vlan30-guest supported-bands=2ghz-n
add action=create-dynamic-enabled disabled=no master-configuration=cap-cfg5ax-vlan40-client slave-configurations=cap-cfg5ax-vlan50-guest supported-bands=5ghz-ax
add action=create-dynamic-enabled disabled=no master-configuration=cap-cfg5ac-vlan20-client slave-configurations=cap-cfg5ac-vlan30-guest supported-bands=5ghz-ac
/ip address
add address=10.10.10.1/24 interface=vlan10-mgmt network=10.10.10.0
add address=10.10.20.1/24 interface=vlan20-client-capac network=10.10.20.0
add address=10.10.30.1/24 interface=vlan30-guest-capac network=10.10.30.0
add address=10.10.40.1/24 interface=vlan40-client-capax network=10.10.40.0
add address=10.10.50.1/24 interface=vlan50-guest-capax network=10.10.50.0
/ip dhcp-server network
add address=10.10.10.0/24 dns-server=10.10.10.1 domain=vlan10.local gateway=10.10.10.1
add address=10.10.20.0/24 dns-server=10.10.20.1 domain=vlan20.local gateway=10.10.20.1
add address=10.10.30.0/24 dns-server=10.10.30.1 domain=vlan30.local gateway=10.10.30.1
add address=10.10.40.0/24 dns-server=10.10.40.1 domain=vlan40.local gateway=10.10.40.1
add address=10.10.50.0/24 dns-server=10.10.50.1 domain=vlan50.local gateway=10.10.50.1
cAP AC wifi configured via cAP VLAN interfaces
/interface bridge
set [ find comment=defconf ] vlan-filtering=yes
/interface vlan
add interface=ether1 name=vlan10-mgmt vlan-id=10
/interface wifi datapath
add bridge=bridgeLocal comment=defconf disabled=no name=capdp
/interface wifi
set [ find default-name=wifi1 ] name=wifi1-capac-vlan20-client
set [ find default-name=wifi2 ] name=wifi2-capac-vlan20-client
add disabled=no master-interface=wifi1-capac-vlan20-client name=wifi1-capac-vlan30-guest
add disabled=no master-interface=wifi2-capac-vlan20-client name=wifi2-capac-vlan30-guest
# WARNING: If you are connected via ether1 this config may lock you out WARNING
# WARNING: If you are connected via ether1 run these commands at end WARNING
/interface bridge port
add bridge=bridgeLocal comment=defconf frame-types=admit-only-vlan-tagged interface=ether1
add bridge=bridgeLocal frame-types=admit-only-untagged-and-priority-tagged interface=wifi1-capac-vlan20-client pvid=20
add bridge=bridgeLocal frame-types=admit-only-untagged-and-priority-tagged interface=wifi2-capac-vlan20-client pvid=20
add bridge=bridgeLocal frame-types=admit-only-untagged-and-priority-tagged interface=wifi1-capac-vlan30-guest pvid=30
add bridge=bridgeLocal frame-types=admit-only-untagged-and-priority-tagged interface=wifi2-capac-vlan30-guest pvid=30
/interface bridge vlan
add bridge=bridgeLocal tagged=bridgeLocal,ether1 vlan-ids=10
add bridge=bridgeLocal tagged=bridgeLocal,ether1 untagged=wifi1-capac-vlan20-client,wifi2-capac-vlan20-client vlan-ids=20
add bridge=bridgeLocal tagged=bridgeLocal,ether1 untagged=wifi1-capac-vlan30-guest,wifi2-capac-vlan30-guest vlan-ids=30
/interface wifi cap
set certificate=request discovery-interfaces=vlan10-mgmt enabled=yes slaves-datapath=capdp slaves-static=yes
/ip dhcp-client
add interface=vlan10-mgmt
cAP AX wifi configured via CAPsMAN datapath VLAN
/interface bridge
set [ find comment=defconf ] vlan-filtering=yes
/interface vlan
add interface=ether1 name=vlan10-mgmt vlan-id=10
/interface wifi datapath
add bridge=bridgeLocal comment=defconf disabled=no name=capdp
#/interface wifi
# No configuration as managed by CAPsMAN
# WARNING: If you are connected via ether1 this config may lock you out WARNING
# WARNING: If you are connected via ether1 run these commands at end WARNING
/interface bridge port
add bridge=bridgeLocal frame-types=admit-only-vlan-tagged interface=ether1
/interface bridge vlan
add bridge=bridgeLocal tagged=bridgeLocal,ether1 vlan-ids=10
add bridge=bridgeLocal tagged=bridgeLocal,ether1 vlan-ids=40
add bridge=bridgeLocal tagged=bridgeLocal,ether1 vlan-ids=50
/interface wifi cap
set certificate=request discovery-interfaces=vlan10-mgmt enabled=yes slaves-datapath=capdp
/ip dhcp-client
add interface=vlan10-mgmt