MikroTik

tafkamax

I understand all of your points. After learning more about the topic I feel I am going to tinker more with the settings and position of the ax2. The house is not that big and having the doors open the range should be more imho. The house is old, but most of walls should be made from wood. I found ou...

tafkamax

Ok thanks for the tips. I should have bought the ax3 then... :/

tafkamax

I have an LTGG with hAP ax2 at my countryside and the hap ax2 wifi can't reach all of the rooms in the building, although it is not that big. I am trying to extend the range of the wifi the best I can. I have moved the 5ghz wifi1 interface to a different SSID and currently I am looking at other sett...

tafkamax

Well one workaround was this:

- name: generate new ssh keys
  expect:
    command: 'ssh {{ inventory_hostname }} "{{ routeros_ip_ssh_command }} regenerate-host-key"'
    responses:
      (.*)regenerate current SSH host keys(.*): 'y'

tafkamax

I am trying to automize my routeros appliances. I am doing it both ways - with SSH and with the SSL API. As I want to do something quickly I will focus on the SSH module first as the API needs to intricate certbot things I don't want to program atm for all the certs for my AP-s. But doing it with th...

tafkamax

Regarding MLAG: MT is an excellent Router vendor, but they make lousy Switches. Use another vendor (like FS, D-Link...) for device-overlapping aggregation-groups. MT screwed that in such an overcomplicated way up, it seems they (itself) are unabled to fix it. Same with the "Loopback Detection&...

tafkamax

When will they fix MLAG?
Sorry, but this is a pointless post.
No one can help you here without information about what is not working with MLAG, nor what your config looks like :-/

viewtopic.php?p=1040526#p1040526

tafkamax

When will they fix MLAG?

tafkamax

Is this still relevant? I am looking into CRS518 as core switch with MLAG with also Fortigates in front.

tafkamax

I am looking into using CRS518 switches in a MLAG pair for Ceph backend traffic.

It is really unfortunate that MLAG is implemented poorly, hope they will fix this issue.

tafkamax

Can I use netinstall-cli to install routeros 6 pkgs ? I have an use case where I have an hAP Lite that I want to test a setup on and I wanted to use netinstall. I downloaded the RouterOS 6 version of netinstall and I don't like that it doesn't allow me to define an interface. Can I use an routeros 7...

tafkamax

I've used netinstall to update multiple CAP AX to 7.11.2 from 7.8(factory firmware) with linux netinstall-cli.

The important part was, that I needed to disable all other networking. E.g computer WiFi.

tafkamax

Following up on this discussion here, I'm trying to understand the differences I had things set up with VLAN ID on the bridge port, and I had set frame type to `admit-only-untagged-and-priority-tagged` for security However, then I tried to set the VLAN ID in Datapath, that stopped working and I had...

tafkamax

I have been batteling with cap-ax and wifiwave2 with capsman for a few weeks now. It seems the issue is something deep. Some weird magic is going on where client requests are being filtered somewhere in the capsman host machine. The wifi clients can ping the GW and other clients in the vlan, but can...

tafkamax

I don't know what to do! It is a super weird problem

I tried to downgrade 7.12beta9 to 7.11.2, for the CAPSMAN host it worked, but for the AP-s the automatic provisioning did not work! Like wtf...

Can I submit a bug request or something regarding all the issues I've had?

tafkamax

I am one step closer to solving the problem!

Connect client to wifi

Walk away from AP

Client changes to another AP

Can't ping GW anymore

Do "forget connection"

Remove the lease for the client device from mikrotik dhcp-server UI

Reconnect

Voila, can ping GW again!

tafkamax

Hmm currently it seems to work some of the times. The clients can connect to one specific AP. When moving away from that AP to the location of another AP. The device does not reconnect. When moving back to the original spot it reconnects. I had 802.11r (FT) enabled and when connected to the first AP...

tafkamax

Turns out inside the CAP-s you have to turn off vlan-filtering=no for the CAP bridge! Because it dynamically creates the vlans.

Now the clients hop between the AP-s, but some super weird behavior with "no internet access" now after the hop from inital AP.

tafkamax

Hmm I happened upon another problem. I can't seem to get firewall rules for allowing only DHCP correct. The router is the DHCP server for the wifi clients. I want to allow only dhcp, so the clients cant see the mikrotik UI. Unfortunately it doesn't work so easily. Here is my current configuration. A...

tafkamax

So we got the new setup working correctly. With CAPSMAN managing the datapaths. Here is our working conf. For this to work the defined VLAN has to be name=vlan6, we used to have l3vlan6. So this is a "hidden" feature or quirk. I thought that only interface and vlan-id were important in con...

tafkamax

In the end it was that the /interface/wifiwave2/configuration was missing the datapath that uses vlan6...

tafkamax

Reading the forum and googeling I seem to have a common problem with my wifi setup. Disclaimer: IT WORKED BEFORE! We tried to turn on 802.11r (FT) for our network. After that none of the clients could connect. They kind of connect, but don't get DHCP address. And adding static address manually also ...

tafkamax

Your idea is solid, the execution is flawed. The Managment vlan or trusted vlan should be sent via ethernet on ether1 to the capax. The capax should get its static IP address on this vlan method --> https://forum.mikrotik.com/viewtopic.php?t=182276 Now you should also setup ether2 as an off bridge ...

tafkamax

You can't use IP address for management interface from the same subnet as any other interfaces on router have ... the address space then overlaps. So use e.g. 192.168.188.1/24 on ether2. Since this is going to become an out-of-band management port, you'll either have to use static settings on manag...

tafkamax

I am trying to make ether2 on my CAP AX a standalone mgmt port, so I can work on my bridge and ether1 as it will all become VLAN-ed. But I don't have access to any of these vlans as I am doing the configuring from home, but the L3 router is at work, with all the switches and vlans. Currently dumping...

tafkamax

OK wow, you do have to disable all other interfaces. After disabling wifi it worked. Version: 7.11.2(2023-08-31 14:41:16) Will reset to default config Interface Mask: 255.255.255.0 Using Client IP: 192.168.88.3 Using Server IP: 192.168.88.2 Starting PXE server Waiting for RouterBOARD... client: XXX ...

tafkamax

I have seem to have configured myself out of the admin interface on CAP AX. I have followed these instructions: https://help.mikrotik.com/docs/display/UM/cAP+ax And by pressing the reset button, I was hoping the admin password would default to the one on the sticker behind product, but that was not ...

tafkamax

I was able to use VLAN-s and now my wifi clients get the IP from the correct pool. But I can still see the administrator panel using 192.168.88.1, which is what I want to get rid of.

tafkamax

So in my old capsman configuration (not wifiwave2 capsman) I specified to use bridge-wifi and it worked. Because the AP-s sent the data to the Router CAPSMAN where it was "worked". But now only local mode is available. Where each AP sends already "worked" data to the capsman. Fo...

tafkamax

But the old capsman i used the forwarding logic? It's not there anymore for now. Forever ? That we don't know. So in my old capsman configuration (not wifiwave2 capsman) I specified to use bridge-wifi and it worked. Because the AP-s sent the data to the Router CAPSMAN where it was "worked"...

tafkamax

Hmm, could it be thath WifiWave2 Capsman has removed some functionality?

WifiWave2 CAPsMAN only passes wireless configuration to the CAP, all forwarding decisions are left to the CAP itself - there is no CAPsMAN forwarding mode.

But the old capsman i used the forwarding logic?

tafkamax

OK here is the setup. /interface bridge add admin-mac=02:E7:89:69:92:29 auto-mac=no fast-forward=no name=bridge-lan add name=bridge-wifi /interface ethernet set [ find default-name=ether1 ] comment="AP" set [ find default-name=ether2 ] comment="AP TODO" set [ find default-name=et...

tafkamax

Yes everything is from CCR2004. /interface bridge add admin-mac=02:E7:89:69:92:29 auto-mac=no fast-forward=no name=bridge-lan add name=bridge-wifi /interface ethernet set [ find default-name=ether1 ] comment="AP 1" set [ find default-name=ether2 ] comment="AP TODO" set [ find def...

tafkamax

Hmm everything works, but my clients for some reason get the DHCP through the LAN interface, but they should get the bridge-wifi one. Super weird. Instead of 10.0.0.0/22 my clients get addresses from 192.168.88.0/24. /interface wifiwave2 security add authentication-types=wpa3-psk name=sec1 /interfac...

tafkamax

My view: yes it will work since you're on 7.8 and there is NO caps mode config. Reset CAP to default. Connect ether1 to device which can serve for internet connection. Connect PC to ether2 and use Winbox to upgrade to latest stable. Was the first thing I did when I was implementing a CAPSMAN-setup ...

tafkamax

What version are your cap AX ? Factory 7.8 ? CAP reset-mode only came available as of 7.9 for AX devices which was a disaster for Wifi so I hope you're at least at 7.10-chain or even 7.11 ? Except for setting caps mode, you don't need to do anything on cAP AX. Nada. Hi, I am running 7.8 factory yes...

tafkamax

Will the configurations of the capax be identical, same vlans etc........ or do the capax's serve different groups of users and thus not be identical in most respects. All to say is your wasting your time. Here is an easy capax setup that you only need to basically change the IP address of the capa...

tafkamax

CAP as the CAP AX ? I havent done anything to it.
Indeed, just to be sure...

What's in between the router and the cAP ax?

CAP AX <-> (<- PoE out - Mikrotik PoE adapter - -> Data) <-> CCR2004 eth port1

tafkamax

So much to improve...but lets focus on the current problem.
Can you share the CAP config as well?

CAP as the CAP AX ? I havent done anything to it.

tafkamax

Well I know ive redacted some stuff. But here it is. As far as I understand, the person who setup the old setup wrote something like this: APs are connected to the network essentially without configuring, only the admin user replaces the password. To add to the central management, you need to hold d...

tafkamax

Well it does seem to get an IP.

2023-09-19_15-14.png

tafkamax

Solid green I assume?
Did the cAP ax request/get an IP address?

Uh how would I check that?

tafkamax

Just to be sure...you did reset the cAP ax to CAP mode?

I unplugged PoE Ethernet. Plugged it back in. Waited for 10 seconds until LED is green and then unpressed it. It should turn the CAP AX to cap mode. Correct?

Or do I need to log in to the CAP awell?

tafkamax

I still cant seem to find the AP in the Radios or Remote CAP. #create a security profile /interface wifiwave2 security add authentication-types=wpa3-psk name=REDACTED passphrase=REDACTED #create configuraiton profiles to use for provisioning /interface wifiwave2 configuration add country=REDACTED na...

tafkamax

For AX devices you have to use a different CAPsMAN: https://help.mikrotik.com/docs/display/ROS/WifiWave2#WifiWave2-WifiWave2CAPsMAN I have run into a issue where I downloaded the extra-package from: https://mikrotik.com/download Then I unzipped it and uploaded the npk package for wifiwave2 to /file...

tafkamax

For AX devices you have to use a different CAPsMAN:
https://help.mikrotik.com/docs/display/ ... ve2CAPsMAN

Thanks!

tafkamax

Hi I am configuring a new network based on an "old" one someone had created. I am using a CCR2004-16 Router and a bunch of cap ax-s. I can't get the AP-s to show up in my router capsman "Remote CAP" or anywhere for that matter. I have pressed down the reset button until the LED i...

Search found 47 matches