MikroTik

For versatility I would also go for AX2 but ... it has no usb port.

Just netinstalled 5 cap ac ( ros and wifi-qcom-ac) using container on AX3.
First time right on each occurrence.

Sure. Each slave radio needs to be attached to a master and will take over the physical properties but can have separate SSID and security. Each of those slave radios will be an interface on its own and then the VLAN game can be applied again. Just don't overdo it because each virtual SSID will ulti...

Good job !

From those 3, wap AX since it allows for 160MHz channels (if you can use it within your environment. I can

).

It does seem odd wireless package is loaded yet not being used ?

You could try to simply MANUALLY add the wifi interface (in case that interface really needs a long time before it becomes operational after startup). What happens then ?

I think I have seen a similar question recently and if I'm not mistaking, you need to use some sort of address remapping based on port.

Edit: I knew I saw it already before not too long ago

viewtopic.php?p=1108865#p1108865

What model of mikrotik routers do you have in Venezuela and Espana?

It's hidden in the wall of text

AC3 in Venezuela, already present.
Planned to buy AC2 for Spain.

100Mbps over 2.4GHz legacy wireless ? Yeah, one can dream. Make no mistake about my sentiments, however. That mAP is still a fabulous device for its price and flexibility ! I even prefer it over mAP Lite (I do keep that one in my backpack wherever I go). But I get what you mean. Everyone always refe...

For wireguard you only need one public IP, as long as that is present, there is no problem to setup a VPN tunnel which you then can cross from the other side, there are plenty of examples how this should be done, do you have by now also the idea that use of proper interpunction and line breaks is a ...

It is more an issue with its routing speed, that may be too slow for your requirements, it should be in the 150-200 Mbit range.

And how are you going to do that with only 100Mb ports ???

Yes, works just fine !

(IPSEC to Azure, Wireguard, EOIP, , DHCP for about 15 devices, routing, ISP connection of 50/20Mb...)
"only" 19d uptime because I did upgrade of that version, before it was 139d.

2024-12-04_10-22-02.jpg

Can go up to 15 minutes...

Manually is the safest way. Also observe defaults which may be present on the ac2 which may have been different on the older one. Go for the newer settings then. Don't copy MAC addresses for bridge or interfaces. They will be filled in by default. On itself it is not really a big deal, done it plent...

My experience so far is that wifi-qcom-ac is just not worth the trouble, it is way more unstable and there is no significant performance gain so if you don't absolutely need new CAPsMAN just stay with the older wireless package... I disagree. +1 on disagreeing. MAJOR difference in performance betwe...

Super, no issue there then !

As long as the second device gets sufficient power and it can " see" capsman controller network-wise, no problem. What i want to do is: capsman<----wired--->cap1<---wired--->cap2 Or it is daisy-chained (controller wired to cap wired to 2nd cap) in which case there should not be a problem ...

You got a point.
You can check for src_address!=192.168.88.0/27, dst_address=192.168.88.0/27

I doubt that USB-C connector can be used for anything else then powering the device. It's not even mentioned on block diagram (whereas for other devices where I know it works, it clearly is indicated as USB). I even seem to recall Normis (MT staff) mentioned it somewhere (would have to look for it)....

Best to fire ticket to support.
They are the only ones able to tell if and when it can be supported.

Just to check:
did anyone create a ticket to support about this ?
Otherwise chances are high they do not know about it ...

Not an expert either so my personal view. Functionally both are mostly the same. In some edge case (which I can not directly imagine) the second version will catch more so I guess it is the better option. On second option: why use 2 rules for hw-offload or not ? Since I have been looking into this m...

My initial comment to move that one rule to the top was based on the rest not being secure enough already. The only true way to solve this: Use outgoing vpn to some public accessible ip ( either your own or some cloud server) and use that as pivot point to get back in. And then you can close that op...

Whenever you change something in firewall, clear all connections or wait 10 minutes or reboot.

Move this rule as first on input chain

add action=accept chain=input comment=WinBox dst-port=8321 protocol=tcp

Open terminal
/export file=anynameyouwish
Move file to PC
Open file with text editor and remove serial number, passwds, public IP,...
Post contents between [code] [/code] quotes for easier readability.

That recommendation was repeated in post #11 and #12
I was going to post again in my view starting from default would be the ONLY sensible starting point but alas ... some are more interesting in patching holes instead of starting from a clean, known to be working config.

My view:
Then you did not reset to default config.
You can also do this from Winbox/webfig, you know ? System / reset configuration.
Uncheck Caps mode
check Keep users.
Uncheck No Default config
Check Do not backup

hmmm... 24 is not a nice binary number like 16 or 32 (110000 vs 10000/100000). Using a subnet mask is out then. You can add those addresses in an address list and use that one in your firewall rule, I would think ? Address list SERVER_RANGE (or whatever), add all addresses from 192.168.88.1 to 192.1...

Why the question asking the question? Typically the LTS is acutally the most stable version available, who doesnt want that (rhetorical question)! However, I have moved off vers6 on my main router recently to ver 7.16, as an LTS for ver7 seems unlikely. :-) yep sir, you’re correct. more stable than...

Personal view: To be honest, the way MT handles their versions, LTS-label is not really worth a lot to me. Some may value it as being super stable (based on what ??) but there will always be bugs in it which are sorted out in subsequent non-LTS versions. Which is the more stable then ? LTS or the ne...

There is no LTS version yet for ROS7 and since Hex Refresh came out of factory with 7.15.3 (I have one right here on my desk), you can not go lower.

But I have the same remark: why the question for LTS ?

Observation:
user passwd the same as user name ? Then it could just as well be kept blank. Gives the same level of security.

Prepare everything in Excel or whatever and then use text functions to create the script. Or any other text processing tool of your preference. I once had to move over about 100 DHCP leases based on Mac address from Win DHCP server to RB5009 and used that approach via Excel. Export from MS Windows D...

@gjmelena
And your point is ?? It's not really clear from your post.

PS I always use create enabled on capsman provisioning, simply to avoid numbers creeping up whenever a reboot/reconnect happens for whatever reason.

Or change ISP ?
A party blocking VPN is not worth to receive your money.

Yes, the second device is wired to the capsman. Now you are contradicting yourself :D Either it is directly connected and then there is no issue. Or it is daisy-chained (controller wired to cap wired to 2nd cap) in which case there should not be a problem either if that first cap is in full bridged...

Please implemnt column vertical divider lines as it's much easier to read data and recognize where one info ends and a new one starts.

Agree.

On Windows 11 you can't really see it unless you start hovering over the area with your mouse. Inefficient.

Stickers already exist:

https://merch.mikrotik.com/products/sticker-sheet-2
https://merch.mikrotik.com/products/sticker-sheet

Configure 2GHz radio and leave 5GHz as it is ...

Vlan and qcom-ac using capsman is ... special.
With ax it is really easy.

No, you do not have to use VLAN.

If you setup devices separately, you can use this approach on each.
https://tangentsoft.com/mikrotik/wiki?n ... ns%20VLANs

But to be honest, once you get how vlans work, they make things easier.

And the solution is ?
Might help others having the same issue as you...

First, please have a look at the
Code: Select all
code
tag. That makes it easier to read configs.

Fixed.

1- Your choice. See later. 2- wifi is using qcom drivers. Wireless is using MT own developed drivers. With arrival of AX line, MT decided to use qcom drivers. qcom-ac was also made to get wave2 compatibility for older HW having compatible chipsets. 3- Who knows ? :D 4- It just has been redone with w...

It doesn't harm, true.

But if everything is already handled before, it doesn't make sense. That's all.

Not sure where to start, quite a bit of things which are off. You may want to start reading this excellent tutorial on setting up VLAN: https://forum.mikrotik.com/viewtopic.php?t=143620 Where is the firewall ? Where is DHCP server for the rest of your network ? Where is address assignments for route...

Simple explanation. The rule doesn't get hit. As a test, disable the forward, invalid rule. See what happens. It's not because a rule doesn't count it is not working. It simply means all the rest before, catches everything before it gets there. But in default firewall, that specific combination is n...

And now all notifications from the past weeks are coming through

And where is the virtual wifi in that config ??

If you add it again, don't forget to attach it to bridge.

Netinstall
Start from default
Learn.

Yes, for managing wave2 radios it is already there.

That container thing I saw as well.
Luckily it was pretty straightforward to bring them back to life.

As long as the second device gets sufficient power and it can " see" capsman controller network-wise, no problem.

IF , and that's intentionally in capitals, AC3 uses wifi-qcom-ac drivers.
Then wave2 capsman will work on hex.

If AC3 still uses legacy wireless, you need to load wireless package as well on Hex but storage space might become very restricted.

That would be my take as well.
Given the inexperience of the user, no offense intented, it's best to start from default with a netinstalled device.

Looks like someone emptied that firewall.
I hope you haven't got it connected to a WAN interface ?

Well, that planned netinstall came earlier then expected.
Wanted to partition my device for future mishaps. Completely bricked.

Luckily I had an export from 3 days ago. Biggest problem was getting netinstall to work (after some attempts with Windows. I used container on AX3, first time right).

Write to support@mikrotik.com

Same advise ...

As of 7.13 wireless or wifi-qcom, depending on your device, is a separate package.

I have a couple of mAP devices running just fine with ROS7 incl wireguard and IPSEC tunnels.

And still you don't answer all questions... ether4 on RB5009 to the swith. ether10 and ether12 from the switch to CAP devices. Which incoming port on the switch ? From your switch config I see there is a trunk specified for ether1 and 12 for VLANs 20 and 30. /interface bridge vlan add bridge=bridge ...

You did not specify which is the port from your RB5009 going to the switch ?
Which port on the switch does it come in ?

Which ports on switch are feeding CAP devices ?

Also, it is generally advised NOT to use VLAN1. Use VLAN all the way or don't use it all.

You do not specify which router, which switch, which APs (capsman behavior w.r.t. VLAN is quite different when talking about legacy wireless or wave2 wifi) You do not specify how things are connected. And you do not show your config, what you already tried. So I doubt anyone can have a clue, without...

Errmm ... that's an article from 2014 ?!

... something weird happened in 7.17RC...

Really ?
viewtopic.php?p=1111415#p1111415

Has been a while since I used "old" capsman but I assume it still works more or less the same with the wave2 version. When updating, it's started all at once. And since all package files then need to come from your controller, it may feel like it takes more time since you may create a bott...

I've seen LTE interface disappear due to FW crash on modem (FW bug on AX Lite LTE with FG621-EA modem, some versions ago). You could recreate it but it vanishes again shortly after creating (when the crash happens again). But this should show in logs. It might be possible you have to go back to ROS ...

To make it simple;

Requirements
Container package is compatible with arm arm64 and x86 architectures. Using of remote-image (similar to docker pull) functionality requires a lot of free space in main memory, 16MB SPI flash boards may use pre-build images on USB or other disk media.

Use external devices more suited for this type of action (and those usually come with a HEAVY price tag).
Not L7 filters on Mikrotik.

Are you expecting us to make your config ?
You may as well ask ChatGPT, who knows what comes out given the limited info you provided.

First show what you already did yourself and you need to describe in a lot more detail what's needed where.

For starters ... why create 2 VLANs yet overlapping subnets ? Use 192.168.0.0/24 for first vlan Use 192.168.1.0/24 for second vlan Much easier. You may want to read this nice tutorial: https://forum.mikrotik.com/viewtopic.php?t=143620 Secondly: supout should NEVER be posted here. Only communicated t...

Even for 5GHz I use 20MHz in that setup. All cAP AX and AX3 devices. Stable as a house AND more options to stay on below-DFS channels (scanners in use there don't support higher channels so I had to cut down channel width to create more possibilities to avoid overlaps). That one higher channel is fo...

Moved to beginner basics

You do know that was a response to a 6-year old thread ??

Add route for subnet using gateway where it needs to go to.

So ... routing.

Correct.

Nice link :lol: Want to emphasize again that even after 2 years some users (yeah, me included) have a much higher success rate using Linux for netinstall. Recently I even started using a container option on AX3 (am going to move it to Hex Refresh which I recently added to home lab setup). Another op...

Or some cheap VPS in the cloud and install CHR on it, then use that one as pivot point for all Wireguard connections ? Shouldn't be too expensive ? Anav always claims it's about 7$ / month but I don't know what supplier provides it. The IP address doesn't need to be static per se. You can also use a...

If your device is passing the requirements, you can also use Mikrotik's Back To Home.
It's meant for those cases where one side is behind CGNAT.

Just checked the details of the ticket again ... The problem was that with 7.17b4, after changing device mode to advanced, routerboard settings could be changed without first changing that setting (it was "yes" without doing anything). It seems that part has been "corrected" (7.1...

On routerboard, there is an important thing to be taken into account... upgrade or autoupgrade FW to latest version. There have been quite a bit of fixes lately where this upgrade was needed for some corrections to work afterwards. E.g. *) ethernet - improved linking after reboot for hAP ax lite dev...

I could do the corner, but I'd be surprised if it make much difference. Line of sight will be better for most of the area so it will make a difference. 2 APs, let alone table mounted, would fail the WAF (wife acceptance factor) immediately. In fact, it is likely that the AP on the outside of the wa...

Since this version has some specific changes related to certificates for capsman, it might be needed to clear certificates on capsman controller.

Just one more question - how can I disable TKIP as encryption method and the legacy standards - a/b/g and leave only n/ac/ax? Currently I haven't checked any of the cyphers and I guess that all of them are acceptable. As for legacy standards, in legacy wireless drivers this was possible to specify....

Personal view:
the fact 7.16.2 is being made, makes me think/hope it might take a bit longer before 7.17 becomes stable since all bug fixes here, are also available in 7.17 chain.
And that might be a good thing so more issues can be ironed out for 7.17.

@EdPa, While I fully understand the rationale for this message in my view the problem here is not the message itself but the fact it currently looks too much like an error (which it is not for a lot of cases, certainly not when no cable or active connection is present). There is also a partially dou...

(thread moved) Why not use the corner then ? 2024-11-27_07-36-23.jpg Added options: (as much as I prefer not to, sometimes it can be of use) Can you use powerline adapters in order to be able to place 2 APs in diagonal corners (left bottom and right top) ? If so, I'd go with wAP AX, table mounted. V...

You do not need wireless (unless that RB5009 acts as capsman controller for legacy wifi APs).
If you only have AX or Qcom-AC APs, remove wireless from RB5009.

As of 7.13 support is default available in base ROS package to act as capsman controller for wave2 devices.

Return to default config.

Then use Webfig or Winbox to simply disable wifi interfaces (don't delete, use disable

).

You are surprised no valid frequency is selected with a config line like this ? set [ find default-name=wifi1 ] channel.band=5ghz-ax .frequency=2300-7300 Steps to be taken 1- start from default config 2- use proper country setting 3- scan your environment, see which channels are free or least used 4...

I have capsman setup with cAP AX devices in warehouse environment where I set the channel width to 20Mhz. No need for more speed with warehouse scanners. I prefer stability there. At home however (really interference-free environment "thanks to" modern building methods, not even GSM signal...

Without RIF file, we can't fix issues that only some people have observed. For your convenience I upgraded again to 7.17rc1. Result: 2024-11-26_20-26-16.jpg Nice empty windows. Supout could not be created (dead hang and frequent disconnect from Winbox). Downgrading resulted in dead device. I had to...

some post moved to new place.
viewtopic.php?t=212859

Continue the complaining there please.

I see the same behavior in Winbox4 or Webfig on RB5009 (7.17b6) and Hex Refresh (7.17rc1) for ports with no cable in it.
So big possibility it's just that and nothing else.

Or you want my config as well ?

Sweet, now I don't have to try :lol: And yet I did ... tiny teeny container run from usb1 and it seems to work. 2024-11-26 17:09:33 container,info,debug layer sha256:4c3160818a1f052453d094c490acbae70caa44bbed5fe8ea47be90c560c515fc downloaded 2024-11-26 17:09:33 container,info,debug import successfu...

Now you're using a canon to kill a mosquito ...
Config export is not needed here if it is a mere representation issue.

Sweet, now I don't have to try

[1] For the love of God, they're not going to release a stable version on Black Friday like they did sometimes in the past... It's already a hectic day in the life of every network operator... Another little surprise as a software update wouldn't be pleasant. And ?? You're not letting updates pass ...

Okido, glad you found it yourself.
Usually one will remember it a lot better then next time

It might help if you show us export of your config and a bit more info on what you are trying to do (which port trunk/access and which vlan). Terminal export file=anynameyouwish Move file to PC Edit file, remote serial, obfuscate remaining sensitive info Post back between [ code] [/ code] quotes for...

Checkout this VLAN tutorial, the part about switch:

viewtopic.php?t=143620

It's not "all ports". Some are active. What client are you using to represent this info ? Which ROS version ? Is something plugged in on those ports ? If not, that may be the reason together with the new style info is being represented in Winbox4/Webfig (7.17beta/rc) I am seeing this too w...

Not necessarily something I plan to do but just a pitfall to keep in mind when things are not going as foreseen when you used that method before.

you can use /interface/wifi/radio provision to provision you local radios according to your provisioning rules. Thats it. Also documented. https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-RadioProvisioning Woah ! I wasn't aware of that option. Nice ! But there is a caveat That be...

Nope, didn't have the time to do so ( and to be honest, totally forgot).
I had to get my network back up because I had to start working.

I may try again this evening.

Upgraded home-RB5009 from 7.17beta6 to rc1, containers, capsman, ... Winbox3.41 - lots of dialogs with empty info at first (Files, Wireless Registration, Capsman Remote Cap, DHCP Lease, ...). Only after sometimes minutes the info came through. - some containers started, some not. No reason visible w...

When using VLAN on Mikrotik devices, it is generally advised here to NOT use VLAN 1.
Some devices from other brands can do funny things with pvid=1 making the whole thing break down when it passes Tik gear.

Can you provide a simple drawing (can be on paper) about your understanding of mesh network and what it should look like in total ?
And why the need for a mesh network ?

Yes you can.
When using ROS version 7.13 or higher, load wireless package as well and you have both environments.

First comments: 1- remove serial from export of config ! 2- One of the least smart things one can do is rename interfaces. Really ! You're making it harder for yourself and others to review config files. Especially so if you are encountering issues and hunting for problem causes. 3- What packages ar...

I have both wifi-qcom and wifi-qcom- ac.

Your ac3 is running wireless or wifi-qcom-ac ?
The former doesn't have WPA3 but I ask to be sure.

Unlikely.

I have a bunch of IoT devices REFUSING to connect to 2GHz when WPA3 is added to the mix.
I have a separate SSID ONLY using WPA2 (nothing else security-wise) and then they're happy.

Start by simply blocking ALL incoming traffic, then see what happens.

Regarding unmanaged switch, especially when it does not handle VLAN tagged frames correctly: one thing I have already done in the past to circumvent such an issue is using EOIP link between router and AP to virtually bypass unmanaged switch. EOIP link is then used as trunk for VLAN traffic. Ofcourse...

You posted your question in the tutorial thread about Using VLAN in RouterOS but it seems you haven't read it...

So again:
viewtopic.php?t=143620

Correct once again

1. Hardware Check -Power Supply: Ensure the mAP Lite is receiving adequate power. If you’re using a USB adapter, try a different adapter with at least 1A output. -LED Behavior: Compare the LED activity to show power and other interfaces. If power supply is not sufficient, the thing will not power o...

Hey @muaazteladia, welcome to the forum! Great to see more knowledgeable and dedicated people joining us. Have a nice weekend!

Errm. NOT !
Couple of things in that response which are blatantly wrong if you know your stuff.

Did you write this, or was it generated by ChatGPT ?

Its sounds very GPT like....

To be honest ... I've seen other posts where I had the exact same feeling.

The wAP Ax Is a very new device, so there are not reports on how It behaves. It is standing on my desk here since a little over 2 weeks, under capsman control via RB5009. It behaves really stable (ZERO drops that I can tell on my PC, using Azure Remote Desktop which is VERY sensitive to drops) and ...

- 60db is a pretty good signal already.

If you really want to improve that situation ...
( drum roll)

add a cat6 cable.
Or powerline.
Or Moca.

You get where I am going to by now

RB5009 does have IPSEC HW acceleration.
For quite a while already.

It's not a mute point if one of both ends is a Tik... as was indicated ?

Shht ! Don't jinx it !!

Your point 3 is where I beg to differ.

I tested connections between 2 Tiks using HW offload.

RB5009 to RB5009
Hex Refresh to RB5009
AXLite to RB5009

WG won each time.

AC or AX band selection are physical settings always driven by master radio. If you set radio to AX, AC clients should connect just fine. Same with 2GHz AX radio and N clients. I have plenty of IoT clients only using N connecting to 2GHz AX radio. Just make sure your security settings are OK. Usuall...

Should be fine.
WAP AX can use 160MHz wide channel so there should not be that much difference ( provided your environment allows you to use it. Read: relatively interference free).

Unify and wAP AX both use 1gb ether ports, so that's probably going to be your limiting factor anyhow.

You will never win that battle...
If e.g. they start using VPN, you will not see anything about their actions.

Wild idea: how about applying queues so their bandwidth is limited to normal browsing and mail traffic ?

Without config, nobody can tell.

PS L009 doesn't run ROS6.

Why do you set AX device to 2GHz-N ?
Leave it blank, it will choose on it's own what it should be.

Most IoT devices (in my experience) are only accepting WPA2 at most. Nothing else.

In 95% of cases: 1 bridge for whatever you want to throw at it. As for VLAN: you may want to check this excellent tutorial: https://forum.mikrotik.com/viewtopic.php?t=143620 Use the wifi interface in your bridge settings. If the radio on your RB4011 is being listed as dynamic, it means you have it c...

Some members here never took an exam yet are far more knowledgeable then those being listed as consultant...

My 0.02€...

Make sure it is properly reset.
Out of the box it should broadcast an SSID.
That's where you need to connect to for further config since default ether will be considered WAN and blocked for entry by firewall.

Don't set vlan on datapath.
Use interface as with other ports via bridge.

Wireless capsman menu might be there but doesn't do anything anymore if you use wifi-qcom-ac driver.

Do not setup local radio under capsman.
Treat it as a local radio with vlan etc.

That's the page for AC3.
You can tell seeing arm version instead of arm64.

Different thing.

Page for AX3 is correct.

And the only correct driver for AX3 is wifi-qcom.
NOT wifi-qcom-ac.

Repeat...

When testing Tik to Tik with both devices capable of HW offloading IPSEC, WG is still faster.

Since one side is Tik, performance will always be dictated by the slowest one.

Wireguard will be faster given same underlying HW.

Do the test yourself.
I already did. Hence my conclusion.

Interesting ... 7.11.3 may contain a bug then for that part.

But in the mean time we're already at 7.16.1.

Once you define a port properly as trunk, pvid setting doesn't matter anymore.

Drop IPSEC.
It will also be SW based on CHR side and therefor even be slower then WG.

When testing Tik to Tik with both devices capable of HW offloading IPSEC, WG is still faster.

My view ...

I had a strange behaviour after updating my both CHR CAPsMAN (AX) from 7.17beta6 to 7.17RC1. Both devices lost their CAPsMAN config. All entries were emty (wifi -> Config, Channel, Security, datapath aso.) Next I tried to re-import the settings from an RSC-file, but the import hangs while importing...

I cleaned it up as you said and understood a little more. However, I think that the edit "add bridge=brLAN ingress-filtering=yes frame-types= admit-only-vlan-tagged interface=ether4" fixed the fact that I could see the other IPs coming from Ubiquiti and now I cannot which is perfect. I be...

I am going to assume you are using the other ports as untagged for ... vlan 1 ? Something does show on your screenshot indicating it. Rule (somewhere between 1 and 3) for Mikrotik admin: Avoid vlan 1. If you use vlan on Mikrotik, use it all the way. Set proper tagged/ untagged ports with correct vla...

My mistake. It should be there. It's not listed in pheripherals section but others.

What's the point if there is no temperature sensor ?

3. I am not sure if this is LEGAL. your slave WLAN for wireguard has a different BAND from the master. Is this allowed, I know the frequency and such is copied over......... I believe the virtual WLAN can have ONLY its own SSID, and security setting and can be assigned to a different subnet/vlan. T...

First enable changing of routerboard settings in device mode.
This will require a reboot.

Then you can change the setting.

Best to contact support with your specific requests.

support@mikrotik.com

Same issue for me... Mokrotik support any feedback? is frame routing supported by chateau 5G???

Ask support via support@mikrotik.com to be sure.
This is a user forum, they don't read everything on this place.

FWIW I had AX3 and now wAP AX on my desk. Since I have that wAP AX I use my laptop only via wifi. Zero disconnects. And using Azure Remote Desktop when working from home I would know immediately ... that environment is HIGHLY allergic to disconnects, even for a split second. (Using AX3 I also have u...

No screenshots please !
Export of config.
And a clear description of what your problem is and what you want to achieve.

Got 5 or 6 of those installed with customer.
They are very good.

One can dream....

Side note: one added benefit from this whole situation ... spammers have little interest the past days for this place.
It's remarkably quiet on that front

The ether1 is PoE-Out on the A x 3: The A C 3 has it on port 5: I knew that :lol: One of the comments I had when I first got AX3. I have some installations with AC3 powering other stuff and all of a sudden it was changed to ether1 with AX3. This is the key thing to look for: POE IN and POE OUT and ...

Connect PC to ether3 Connect using Winbox Change Interface List WAN -> remove ether1, add ether2 Change Interface list LAN -> remove ether2, add ether1 Change bridge ports -> remove ether2, add ether1 IP DHCP Client: change client to ether2 And that should be it. Reboot router to be sure (firewall w...

Re: New Hex: be careful how you use the ports. Ether1 is differently connected then ether 2-5 which results in ether1 always passing CPU. Makes a big difference depending on your config. RB5009 is the more future proof option IMHO (and can be rack-mounted if you get the mounting brackets, 4 in 1U if...

Caps mode for wave2 only became available as of 7.8. So use latest stable.

No, you can't!? One level up you can define custom steering settings which can refer to an existing neighbor-group, but as far as I can tell there is no possibility to create your own custom neighbor-group. Really ? /interface/wifi/steering> add neighbor-group=test name=test DONE. Don't confuse wit...

Looks like my residential IP was blocked - using Tor to post this. They must be dropping address blocks that originated attacks, and I got caught on the crossfire.

Fire ticket to support to have it unblocked, or at least get explanation.

What's wrong with the default settings ?

You may have to uninstall wireless driver on the RB4011 and add wifi-qcom-ac. You will loose 2.4GHz radio on that device but 5GHz radio can be used as local radio with WPA3. Not within capsman. Just a minute ... It will also be able to be used as capsman controller for AX devices. Now comes the nift...

Not really.
Just got error page referring to overload.

Added info for clarification: as of 7.13 you are required to load the wireless or wifi package as well when doing netinstall. Not only main ROS package. BTW that Help page you linked to, go 1 level up and then see what's written there, section Old 802.11ac ARM CPU devices: https://help.mikrotik.com/...

Not even sure if I have it right but it works, its snappy, no complaints.

Now, was this so hard to admit ?

That first article you link to refers to a table with supported switch chips and models. Neither 88E6393 ( swich used in RB5009) nor RB5009 are mentioned there. The second link you mention is related to netpower, which is mentioned in the first table. So why do you think those instructions would app...

How many caps and connected to which power source ? Sure it can handle the combined load ?

And logs on controller please.

That's not how it works in my head.

Once wireguard tunnel is up, you pass firewall. Period.
Firewall doesn't know nor care what goes through that tunnel.

If peer settings have a dedicated ip, you can always contact that address IF wireguard is active.

That's the whole point of a VPN.

The whole point of using a VPN like Wireguard is to travel through firewall if needed.

So what's the problem ?
Netwatch to peer IP address.

Also check log files both on AP and controller around the time disconnects happen.
They might give you a better idea to find the reason.

As already mentioned before
Traffic- gen: I can understand why that's blocked by default.
Bandwidth test / speedtest: You always need a target device responding before it does anything. So why block this as well ?

Pretty sure it is there on SXT with R11-e.
So it must be related to the modem ?

Already asked support about it ? Most likely they forgot to add it in Winbox with the new modem.

Already launched a support ticket ?
You do know MT staff doesn't frequent this place that much ?

PS the problem is with forum, not website. Just to get the requirements correct ...

Edit: SUP-171456 created

It is pointless to post any configuration as the device has been reset many times and there is no config set on it that could cause the problem. Bold statement. It is the config anyhow ... and if you don't show it, how can we point out to you what's wrong ? Start with upgrading to latest stable (7....

Hi, I'm still in the process of configuring my RB5009 with VLANs (learning quite a bit along the way). I'd like to set up two VLANs, vlan-10 and vlan-20. It should be possible to connect to vlan-10 from ether2 and to vlan-20 from ether3. It should also be possible to connect to vlan-10 and vlan-20 ...

It's known around here that quite some Quickset modes are missing since AX-line came out.
Having said that ... a lot of seasoned users rarely use it (if ever).
I never do.

That's for locking the AP to the first controller it finds (in case there are multiple).
I assume having multiple and switching over, will result in the same breakdown.

<interested in the answer to this one so following ...>

I think/ hope we all (most ?) here have the same intentions. Help others and learn something out of it while doing so.

Some members can be quite snappy and vocal but even for those I think the underlying motivation is the same.

I would strongly recommend to start from default and only change when you fully understand what the impact is.

Some rules are built-in and can effectively not be removed.

Do the log files show anything useful when it happens ?
Mac conflict somewhere?

At first sight it looks ok.

Have you tested it when moving around ?
You should see roaming messages in log file.

A config with capsman or pure wifi is basically only 1 line difference. Enabling of capsman controller on the controller. Setting controller to capsman or capsman-or-local on the AP radio. The rest is more or less the same (apart from possibly provisioning on capsman controller, there you have a dif...

First thing I do with every new device: Take picture from sticker with passwd, let OCR do its thing and put the info away so I can find it back. Then I add my own user and remove admin. And then we start ... kirasakuya: If you have a lot of devices, your distributor should be able to provide you a t...

Load wifi-qcom-ac drivers on it and then redo your tests.

I just upgraded following devices without any hitch (home/lab setup):
RB5009
AX2
wAP AX
AX Lite
Hex Refresh

What bloatware ? You either split everything out over the required tabs or you can (if you want) put almost everything on the configuration tab and simply apply. With old capsman it was exactly the same. Wave2 config and capsman setup is 95% to 99% the same. You just have to keep in mind (when using...

No offense but it strikes me as odd how you can easily SEE errors in config files w.r.t. VLANs, mangling, firewall, ... (and very extensively and fast too !) but you struggle with capsman setup ?

There is extensive documentation, also on replacing: https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-Replacing'wireless'package Hmmm ... To do this, it is necessary to uninstall the 'wireless' package, then install 'wifi-qcom-ac'. So extensive they missed 2 reboot steps to make ...

I just uploaded wifi-qcom-ac-7.16.1-arm.npk. It shows in FILES. Rebooted, but it was not installed and disappeared from FILES. Did it again and this time clicked DISABLE for the wireless package. Rebooted and same result. Am I doing this incorrectly? Assuming ROS version 7.13 or higher: First set w...

I don't quite understand the difference between should and advised. You asked if you should use it. No, you do not have to. Old wireless also works. That's what "should" means in the context of the question you asked. But it is advised, as in RECOMMENDED by most users here knowing what it...

"Should", no.
Advised, yes.

There is a remarkable difference in wifi performance when you can use wave2 drivers and as of 7.16 storage problem for those 16Mb-devices is reduced (not entirely gone but for simple AP function, it's ok).

Reset again to factory conditions.
But then you will loose your earlier created user account.

I rarely start from a blank device since with some ROS versions default settings can change.
I mostly start from default config when setting up a new device or when doing a major overhaul (tip: enable "keep users"

)

My way is to copy-paste blocks in terminal.
So you can see what response comes back (in case some typo was made or wrong command).

I never import scripts in total. Certainly not complete config.

Thanks for letting us know anyhow

You don't happen to have a device which already has a default factory passwd ?
Check for sticker.

Open your web browser, the default IP management address is 192.168.88.1, with username: admin and no password (or, for some models, check user and wireless passwords on the sticker)

Nobody has a crystal ball ... unfortunately. So it's hard to tell without knowing what exactly you are trying to do. From the error message I firstly assumed you are creating a virtual/slave wireless/wifi interface, which always needs to be tied to a master interface. But that on itself is already s...

Old or new capsman are conceptually the same.

Hmmm ... not if you want to use that same interface list later on to filter in a firewall rule ?
The aim is to drop wifi access but allow ethernet access.

Yes, so what ?
I got no problems with that setup.

Search found 6944 matches