MikroTik

erlinden

Could it be roaming related? Do you have RSTP configured?

erlinden

One VLAN? What is the purpose of having a single VLAN?
Can you share the config?

/export file=anynameyoulike

Remove serial and any other private info and post between code tags by using the </> button.

erlinden

Running both 5GHz radios on the same frequency is terrible for roaming. As well your 2.4GHz radios might transmit on the same frquency...

Next, accesslist rules I prefer to order as filter rules: specify what is accepted, block (reject) what isn't on the end of the chain.

erlinden

Get the export:

/export file=anynameyoulike

Remove serial and any other private info, post in between code tags by using the </> button.

erlinden

The things I noticed is that you have two bridges, please remove bridge1-Public, it serves no purpose. Are you sure you want to have all ports on the same bridge? Could there be a loop in the network? Could you provide a network diagram? My first guess would be introducing spanning tree protocol: ht...

erlinden

Can you share the config, just to rule out anything on that part?

/export file=anynameyoulike

Remove serial and any other private info and post in between code tags by using the </> button.

erlinden

You might want to change this: add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN into: add action=accept chain=input comment="allow access from LAN" in-interface-list=LAN add action=accept chain=input comment="DNS from VLAN&qu...

erlinden

Any reason why you are not using 10.172.12.0/23 ?

erlinden

I would use CAPsMAN, that will give you the option to manage the network with one device. There are some thing to make it work great: Use latest stable, currently 7.15.3 Install wifi-qcom-ac on the hAP ac3 (instead of wireless package) Set the cAP ax into CAPS Mode Resources on this topic: https://m...

erlinden

Perhaps having a DHCP scope consisting of a single IP address can do this for you? Bind the DHCP server to this interface (port) and set a short lease time.

erlinden

There is only one correct CAPsMAN version managing ax (wifi-qom) devices. This is part of RouterOS version 7.13 and up.
No need to install anything additional (like wifi-qcom-ac or wireless) for having CAPsMAN.

erlinden

Very good combination, the wifi-qcom-ac is only beneficial if you need wireless on your hAP ac3. Otherwise, @infabo mentioned, you can uninstall it.

erlinden

If I recall correctly however, ping (ICMP) is allowed inbound by default. I prefer to block this via firewall rule.

Actually, ICMP traffic is accepted. It is used for more then ping only.

erlinden

I have found this: /interface bridge vlan add bridge=bridge comment=Gasten tagged=bridge vlan-ids=30 add bridge=bridge comment=IOT tagged=bridge vlan-ids=20 I would expect to see VLAN filtering on the port(s) as well. Currently the VLAN config is incomplete. Is there a trunk/hybrid port to the switc...

erlinden

For feedback or help, the config is required:

/export file=anynameyoulike

Remove serial and any other private info.

There is no option to run wired? Wireless backhaul is consuming a lot (at least halve) of your wireless bandwidth.

erlinden

If you run the wifi-qcom-ac package on the cAP ac (instead of the wireless package) you should be fine. Here you can find the documentation: https://help.mikrotik.com/docs/display/ROS/WiFi#WiFi-CAPsMAN-CAPsimpleconfigurationexample: Could you add the ouput of this command as well? /interface/wifi ex...

erlinden

I would like to advise you to reset the CAP to CAPS Mode:
https://help.mikrotik.com/docs/display/UM/cAP+XL+ac

erlinden

This explenation, which is part of the official MikroTik documentation, will explain exactely how to configure this setup:
https://help.mikrotik.com/docs/display/ ... uardtunnel

erlinden

Can you share the config?

/export file=anynameyoulike

Remove serial and any other private info and post between code tags by using the </> button.

erlinden

Can you share the config:

/export file=anynameyoulike

Remove serial and post between code tags by using the </> button.

Also, here is a great reference when it comes to VLAN:
viewtopic.php?t=143620

erlinden

If no VLAN's are involved, the D-Link will do just fine (assuming it has gigabit ports). The cAP ac does handle the wifi-qcom-ac pretty well (in my experience), though I red someone having out of memory problems (therefor a daily reboot was introduced). Haven't seen that problem myself (uptime over ...

erlinden

Can someone help?

Depends on how you want it to work exactly. Fyi, legacy supports CAPsMAN forwarding, wifi-qcom(-ac) doesn't.

erlinden

And how can i disable the port for everyone else

Add a drop rule on the forward chain that drops everything else:

add action=drop chain=forward

Make sure this rule is at the end of your rules.

I prefer the "allow specific traffic and drop everything else" way of thinking.

erlinden

Allow on Source Address List, with dst port 587, protocol 6 (tcp), on the forward chain. This should be sufficient information...

erlinden

Now I see...you don't want to have your IP address of the accesspoint in the same range as the office IP. Normally (I assumed because of the VLAN ID) you would have a management VLAN where you do the IP assignement of all hardware involved. To get it to work you can set the BAS_VLAN to ID 100. Not s...

erlinden

Looks like MGT and CORP VLAN are messed up. I.e. the different network ranges are incorrect. Start with a basic setup and follow the topic by the letter. Then make changes as desired.

In regards to no access, are you using Winbox? Does it show up on discovery?

erlinden

Here is some knwoledge dump:
https://help.mikrotik.com/docs/pages/vi ... d=56459266

erlinden

Did you follow this wiki step by step?
https://wiki.mikrotik.com/wiki/Manual:Netinstall

As far as I know all ax devices are v7. Any reason for wanting to run v6?

erlinden

Gentlemen, what is the difference between firmware V6 and V7, which is better?

better?

erlinden

Yes, I know. And I'll tell my corporate laptop it should disconnect more often

erlinden

If you post an export of your config, we can have a look:

/export file=anynameyoulike

Post the content here without serial and any other private info en place it in between code tags by using the </> button.

erlinden

Would be beneficial if all people with problems share their config (at least the /interface/wifi part) to validate settings. Additional tip: when going up and down in versions you might run into some strange problems. Actually, I did...hence some steps that might be of use. I would advise (in case y...

erlinden

And in addition to @holvoetn complete answer: when upgrading through CAPsMAN, all packages are required (and installed). Manual upgrade is, as far as I know, the only way to miss packages.

erlinden

Could it be a cache problem? Have you tried using an InPrivate session?

erlinden

Removing and adding the slave interfaces did the trick...working as expected and befor.
Will stick to MikroTik longer.

erlinden

It is indeed, hence you should install the wireless-7.xx.x-mipsbe.npk package (which is located in the \MIPSBE\Extra packages file.

erlinden

I did configure it with VLAN on the bridge, and the HOME network is working perfectly with VLAN ID 50, GUEST on VLAN ID 51 isn't (actually, it created interfaces dynamically with VLAN ID 1 for the GUEST network, hence there were MGT VLAN IP addresses assigned, as that is the untagged VLAN on eth0 of...

erlinden

Thanks as well, @mkx. Really appreciate your help! This is my current config: /interface bridge add admin-mac=xxxxxxxxxxxx auto-mac=no name=bridge-lan /interface ethernet set [ find default-name=ether1 ] name=ether1-trunk set [ find default-name=ether2 ] name=ether2-camera-rechts set [ find default-...

erlinden

Ok, I have adjusted as you configured it and removed the learning part.
Will monitor if this is of any help...thanks!

erlinden

The default rules are enough for protection. Because your picture is no showing (better post /ip/firewall export), it is hard to say what you did. And I'm not going to read some website.

erlinden

The only thing I see in your config that jumps out at me is the independent-learning value.

Thanks gotsprings !

Another difference I notice is that you have switch1-cpu added to all your /interface ethernet switch vlan
May I ask what is the purpose of that?

erlinden

Can you please add the requirements (apart from being outside and handling 20 caravans)?

erlinden

Bringing this topic back to live. I made all the adjustments to get rid of the VLAN ID = 1 necessity. All is working well, except for wireless and VLAN. For some reason I see in ARP and DHCP (leases) that wireless clients do sometimes get both IP addresses from the HOME or Guest VLAN AND the MGT VLA...

erlinden

This could very well be a user problem. Could you share the switch's config?

/export file=anynameyoulike

Remove serial and any other private info and place in between code tags by using the </> button.

erlinden

Your life would be much easier if you choose to go VLAN all the way. Lots of (correct) and great examples can be found in this topic: https://forum.mikrotik.com/viewtopic.php?t=143620 In regards to the firewall, you could consider allowing explicitely and dropping everything else. Just make sure tha...

erlinden

Sorry for missing the link. And thanks @jadaz!

The explanation of any setting can be found here:
https://help.mikrotik.com/docs/display/ROS/WiFi

erlinden

Keepalive should be set on the "client" peer (as well as the is-responder).

erlinden

From the documentation: is-responder (yes | no; Default: no) Specifies if peer is intended to be connection initiator or only responder. Should be used on WireGuard devices that are used as "servers" for other devices as clients to connect to. Otherwise router will all repeatedly try to co...

erlinden

If a wired conneciton is fast, then it is not related to the routing part of the router. I also notice that the 2.4GHz radio is broadcasting on channels 1, 3 and 6. In an ideal world (funny in the 2.4GHz context) you would only use channels 1, 6 and 11. Might want to configure frequencies 2412, 2437...

erlinden

Not only that, but the new capsman is not compatible with the older one. So if you have older devices and you buy a new one, you are SOL. Bit harsh, there are two paths you can walk in this use case: - if only ARM devices involved, upgrade them with the wifi-qcom-ac driver. - it is possible to run ...

erlinden

Can you add both the logging and the config?

/export file=anynameyoulike

Remove serial and any other private info, post in between code tags by using the </> button.

erlinden

You have to come up with your requirements first. If you are aiming for 99.99% uptime, there might be better solutions.
I can tell you it is working perfectly for me, and that might give you the impression it is perfect for you too. But again, only you can tell.

erlinden

So, "down a couple of times" during a period of years can be considered acceptable, right?

Is it acceptable to you? That is all that matters.

erlinden

Have been using it for years. Setup is very easy (checkbox), I noticed that the service has been down a couple of times.

erlinden

You would need to implement VLAN filtering on the bridge.
If you read this topic, you can find the AccessPoint.rsc which contains an example. In this example, all wifi interfaces are VLAN filtered, you just have to make the guest wifi interfaces so called "access ports".

erlinden

It depends, especially as these requirements are far from complete.

And where does the maximum number of accesspoints come from?
Why are you assigned with this task?
What is the budget?

Choosing hardware is the least difficult part of this job.

erlinden

Well, then start by describing the issue you need to resolve first.

The topic name might give an indication

But agreed, both problem description and the requirements are very welcome!

erlinden

Some feedback requires insights into the config:

/export file=anynameyoulike

Remove serial and any other private info and post here inbtween code tags by using the </> button.

erlinden

A topic which is really going to help you:
viewtopic.php?t=143620

erlinden

Giving this a go! Disabled it on 5Ghz interface and switched back from WPA2/3 to WPA/WPA2.

Why use WPA (when you can use open)?

erlinden

Better (best?) idea is using VLAN's. Please read this great topic to get loads of informations and examples:
viewtopic.php?t=143620

erlinden

Because the frequency isn't set, it could take up to 10 minutes until the 5GHz radio is broadcasting.
You can set the frequency to 5180 (channel 36) manually to avoid this situation.

Does the log give any info?
At what frequency is the radio broadcasting?

erlinden

How do I enable the capsman server on one of the AX2? I dont see a Capman option to enable it and set certificate options.

https://help.mikrotik.com/docs/display/ ... ionexample:

erlinden

Yeah...or misconfigured. You make it a bit challenging coming up with a reason with the little info you provide.
Can you post:

/export file=annameyoulike

Remove serial and any other private info.

erlinden

As I mentioned in the article above, I really don't understand it very well, but maybe I can write the config details here as soon as possible and get ideas from you. Thank you.

Sure, no problem. It would be really great to have the config of the cAP ac as well, just to compare.

erlinden

What makes you think it is better and what makes you think it is not. Might be interesting to lower transmission power to get better performance.

erlinden

Then it would be interesting to see your complete config:

/export file=anynameyoulike

Remove serial and any other private info.

erlinden

Standalone AP or using CAPsMan?

CAPsMAN:

RB4011, 2x RB960 (v6.49.13), 1x Powerbox Pro (v6.49.13), 2x cAP AX, 1x wAP ac

erlinden

I ran into a problem with VLAN's: wireless clients got MGT VLAN addresses assigned as well as HOME VLAN addresses. Found out from looking at the DHCP leases and IP ARP entries. After downgrading to 7.15.3 the problem was solved.

Yes, all information was supplied to support.

erlinden

Don't use VLAN ID = 1 explicitely /interface vlan add comment="Core infrastructure/Management VLAN" interface=Bridge name=VLAN1 vlan-id=1 add comment="Servers' VLAN" interface=Bridge name=VLAN250 vlan-id=250 Also, I'm missing VLAN 3249 as part of the /interface vlan (while it is ...

erlinden

By using hybrid ports to the CAPs, one can leave them in defaults CAPS Mode. Only identity can be adjusted (if wanted).

erlinden

Indeed, just replace the existing executable with the new one.

erlinden

Winbox can be downloaded on the download page:
https://mikrotik.com/download

https://mt.lv/winbox64 (64 bit)
https://mt.lv/winbox (32 bit)

erlinden

One disadvantage of this config, @neki, is that you have to manually adjust the CAPs (as they expect to be able to reach the CAPsMAN untagged by default).
As far as I know, you can't enable bridge VLAN filtering on ax devices. Only on ac devices, using the wifi-qcom-ac driver, this is supported.

erlinden

From v7.13.x you get the "new" CAPsMAN (capable of managing ax devices) "for free". It is added in the menu under wifi. The documentation will give you some more insights: https://help.mikrotik.com/docs/display/ROS/WiFi#WiFi-WiFiCAPsMAN The "old" CAPsMAN is part of the ...

erlinden

Downgrade is nearly as easy as upgrading: you have to manually copy the (current) packages to the router en press the downgrade button.
As always, make a complete export (/export file=anynameyoulike) that can be restored any time.

erlinden

Bit of an assumption: connect everything to the MikroTik and you will be fine.
If not (possible), make a small network diagram including all clients.

erlinden

Here you can find the official documentation including an example:
https://help.mikrotik.com/docs/display/ ... uardtunnel

erlinden

Then I found out you have to install QCOM package. So might try updating again.

The disadvantage of upgrading manually is that you could miss an additional package.
You can add it later any time, just add package.

When upgrading automatically, this won't happen.

erlinden

It isn't...at least, it shouldn't be.
Please test with iPerf to get better insights on the wireless speed. Using speedtest does include a lot of (possible) influencing factors.

To get best performance, please consider using the wifi-qcom-ac driver.

erlinden

Might be a cashing thingy...have you tried reinstalling winbox?
What RouterOS and what Winbox version are you using?

erlinden

Are you using RouterOS or SwOS?
Can you share the config of the switch?

Could there be any queue active on the port (or VLAN)?

erlinden

Looks like your CAPsMAN has some errors: /interface wifi provisioning add action=create-dynamic-enabled disabled=no master-configuration=*4 \ slave-configurations=*3 supported-bands=5ghz-ac add action=create-dynamic-enabled disabled=yes identity-regexp=.*AC.* \ master-configuration=*3 name-format=2G...

erlinden

A complete export of /ip/firewall would be very helpfull. Even better...a complete export:

/export file=anynameyoulike

Remove serial and any other private info.

erlinden

The wireless interfaces look disabled, can you enable them?

erlinden

Happy to hear, you can mark your topic as solved. Will probably give me some karma points

erlinden

If the IPS is blocking the ports , and even if you play with 443 that will not help to establish connections. Not sure why is that,

Are you stating that on the same port and with same protocol OpenVPN will work while Wireguard does (sometimes) not?

erlinden

Have you checked the log?

erlinden

Incorrect cpu architecture? Bit more info would be usefull...

erlinden

You can add "fast transition", which should make it more easy for clients to roam: /interface wifi security add authentication-types=wpa2-psk ft=yes ft-over-ds=yes name=JUJUMAESIN-SEC passphrase=[whatever you use] What signal does the client have when connected to the CAP instead of the ro...

erlinden

Signal is okay! Frequency was my mistake, please try eiher 5180 or leave it empty (for automatic selection). The latter will choose based on a scan.

erlinden

Did you follow this guide to the letter?
https://help.mikrotik.com/docs/display/ ... forWindows

erlinden

Seems a bit low(er) than possible. What is the signal value?
Could you change frequency to 5120 (channel 36)?
Did you perform a frequency scan? Any other wifi networks that could be interferring?

erlinden

If that is the device you test with...yes.
This information can be found either on /interface/wifi/registration (are you using Winbox?) or on the laptop (are you using Windows?).

erlinden

I have found out several topics as well in cookbook, but it seems that it will be not for my setup, so I have to read and find something else.

Here in the documentation you can find it:
https://help.mikrotik.com/docs/display/ ... %22package:

erlinden

Can you post at what connection rate the client is connected?

erlinden

Can you set local-forwarding to true:

/caps-man datapath
add bridge=bridge-guest name=guest local-forwarding=yes

erlinden

Within days/weeks the wAP AX will be introduced. Which, if I understood correct, will be smaller.

Accorindg to @Normis:

wAP ax will be a very small device and is coming very very soon (question of days or weeks)

erlinden

wAP ax will be a very small device and is coming very very soon (question of days or weeks)

erlinden

The new CAPsMAN does only support wifi-qcom and wifi-qcom-ac devices. The latter is supported on ac devices, using the ARM processor. Unfortunately, the RB951 is a MIPSBE device, hence you can't find it. If you want it to be managed by your switch, you have to add the wireless package and run two in...

erlinden

Set extension-channel to either Ce (40MHz) or Ceee (80MHz) on the 5GHz radio to get higher conenction rates. You might as well let the CAPsMAN (actually the CAP) choose a channel itself, as is configured on the hAP ac3.

erlinden

Why did you set bandwidth to 20MHz on the 5GHz radio? This will probably make a huge difference, when set to 80MHz (Ceee). No need to set VLAN ID 1 on the datapath. Instead of using "2412,2422,2432,2442,2462", you better use 2412,2437,2462 for non overlapping channels. When setting transmi...

erlinden

Please elaborate , why are you asking this question on a other vendors forum? Seems to me this is a good question for the UBI forum (or perhaps you already asked there?). Or just join the MikroTik community (as I did) and get proper support. 8) I would expect that the Windows Unifi Controller/Docker...

erlinden

Well... Start by removing this radio MAC address: /interface wifi provisioning add action=create-enabled common-name-regexp="" disabled=no identity-regexp=\ "" master-configuration=config_internal_users radio-mac=00:00:00:00:00:00 \ slave-configurations=config_guests This will pr...

erlinden

English translation (thanks to Google): Hello, I want to make a foreach based on a list of IPs to check if they are assigned in the dhcp and take action to be positive No answers here...you might get some (paid) support here: https://mikrotik.com/consultants OR What have you done so far. What is wor...

erlinden

Can you share the config?

/export file=anynameyoulike

Remove serial and any other private info.

erlinden

Can you show exactely what IP addresses should be available for DHCP? You are aware that you can configure multiple pools? In addition, can you please share your (relevant part of the) config: /export hide-sensitive file=anynameyoulike Remove serial and any other private info and post here between c...

erlinden

Do you have examples on what changes you have made that weren't provisioned?

erlinden

Have you changed the IP pool? This is where you define the IP addresses that are available.

erlinden

Could you also show the provisioning?
https://help.mikrotik.com/docs/display/ ... ovisioning

erlinden

First step, forget Quickset (except for initial config...but then, still forget it). Do it manually, you will get so much more options (besides the knowledge you gain). As soon as I change anything in Winbox, the configuration is gone, I have to repeat everything over and over. This shouldn't be the...

erlinden

Are you refering to the part where this switch is (ab)used as router?

erlinden

Just follow this help page: https://help.mikrotik.com/docs/display/ROS/WiFi#WiFi-WiFiCAPsMAN My tips: - use fixed channels for the 5GHz channels, 40MHz bandwidth (by creating a config/provision rule per CAPS filtered by MAC address) - when not using EAP, use wpa2-psk only with CCMP (only) as encrypt...

erlinden

Can you show the config as well?

/export file=anynameyoulike

Remove serial and any other private info en post between code tags by using the </> button.

erlinden

Can you give it a try with:

WPA2-PSK (only) and CCMP (as encryption)?

erlinden

Really would like to have a peek at your config:

/export file=anynameyoulike

Remove serial and any other private info.

erlinden

Are you running the CAP's in default CAPS Mode? Are the CAP's connected to a hybrid port (where MGT VLAN is untagged)? Would you be willing to share your config?

Thanks!

erlinden

I agree except I ran into the problem that clients also received MGT VLAN IP addresses when connecting with a wifi-qcom-ac CAP. Then I started over following the CAPsMAN VLAN description in the help pages (https://help.mikrotik.com/docs/display/ROS/WiFi#WiFi-CAPsMAN-CAPVLANconfigurationexample:). Th...

erlinden

For me it works when adding VLAN ID 1 on the switch.

erlinden

Can you post the ouput of:

/ip/upnp print
/ip/upnp/interfaces print

erlinden

When using CAPsMAN you can push upgrades. Set package-path and place the packages in that path.
See here:

https://www.youtube.com/watch?v=1Ct6aJXTE5g

erlinden

Yes!

erlinden

Can you change this rule, where the to port is the default Winbox port?

And change this rule in the firewall as well:

/ip firewall filter
add action=accept chain=input dst-port=8291 in-interface=ether1 protocol=tcp

erlinden

Something like CAPsMAN (for Wifi) or Dude (for complete environment)?

erlinden

Yes it is behind NAT and does not have a public IP address.

Did you do port forwarding on the NAT device as well?

erlinden

I would prefer through VPN over making a service available publically.
Is your MT behind NAT, or does it have a publically available IP address?
Who removed all filter rules that are part of the default?

erlinden

If you can't access it after a reset (sure the credentials are correct?) and it won't go into CAPS Mode, you could consider to perform a netinstall:
https://help.mikrotik.com/docs/display/ROS/Netinstall

erlinden

As the wireguard interface isn't part of the LAN interface list AND doesn't have an accept rule on the input chain, it is blocked (hence you can't ping it). You can test this by either adding an additional rule: /ip firewall filter add action=accept chain=input comment="defconf: accept ICMP&quo...

erlinden

Enable logging on the drop rule to get insights why this rule isn't working.

I would expect the double quotes are the problem.

erlinden

These are the default firewall rules, with some irrelevant ones removed. :? If you want this device to work as router, you want a masquerade rule. But there is a lot more that is missing. If you want to have it working as switch, please read this great topic: https://forum.mikrotik.com/viewtopic.ph...

erlinden

Aah, thanks for the explanation. You are referring to the old version (which is part of the wireless package), while TS is using the new version. The new version lacks the forwarding options.

erlinden

Besides a lot of firewall rules....VLAN filtering isn't enabled on the bridge.

erlinden

Seems to me that there are more SSID/interfaces configured than can be handled. A quick peek on your config will give better insights, can you pleas share it? /interface/wifi export file=anynameyoulike Remove serial and any other private info and post in between code tags by using the </> button.

erlinden

My tips:
Change power supply (just to be sure)
Netinstall the device:
https://help.mikrotik.com/docs/display/ROS/Netinstall

erlinden

I have: - set identity on the CAP - use %I in the Name Format (as part of the provisioning From the documentation : name-format (string) Base string to use when constructing names of provisioned interfaces. Each new interface will be created by taking the base string and appending a number to the en...

erlinden

Local forwarding should be enabled on the datapaths because the AP is not directly connected behind the CAPsMAN Not sure what exactely you are referring to, but from the wiki: WiFi CAPsMAN only passes wireless configuration to the CAP, all forwarding decisions are left to the CAP itself - there is ...

erlinden

Yeah...as it seams. Remains the question...why should I add the "independent-learning=yes" for VLAN 1 on the switch?

And thanks for the addition, I added this indeed.

erlinden

Checked your conig (better to place it inbetween code tags by using the </> button): /ip address add address=192.168.10.1/24 interface=" WG-HQ" network=192.168.10.0 Should be: /ip address add address=192.168.10.1/32 interface=" WG-HQ" network=192.168.10.0 AND /ip address add addr...

erlinden

Mikrotik has a great explanation: https://help.mikrotik.com/docs/display/ROS/WireGuard#WireGuard-SitetoSiteWireGuardtunnel Did you add this part to the firewall as well (don't mind the used IP addresses...)? Additionally, it is possible that the "forward" chain restricts the communication ...

erlinden

I need some VLAN help. I run a router with 2 VLAN's: 50 (HOME) and 51 (Guests). I use CAPsMAN to manage my 2 cAP AX and 1 wAP ac. One cAP AX is connected to the RB4011 directly, the second (and the wAP ac) are conencted through the RB 960PGS. All devices are connected through trunk ports (VLAN 50 an...

erlinden

Can you try setting encryption to, mbach:

encryption=ccmp,gcmp,ccmp-256,gcmp-256

And use wpa2-psk only.

And enable debug, wifi logging to get some additional information.

erlinden

You can try a netinstall:

https://help.mikrotik.com/docs/display/ROS/Netinstall

erlinden

The VLAN bible of Mikrotik:
viewtopic.php?t=143620

Thanks snippan for the addition. I just wanted to add it...

erlinden

Did you succesfully import the certificate that is used? Anything in the log that might give an indication? Does it work if you (temporarily) disable certificate check?
Can you also check if https://1.1.1.1/dns-query does work?

erlinden

OK so if I'm reading this page right, I have to do specific config on -each- CAP in order for wifi to work on a VLAN. No, you don't. What is shown is a config if you want to do it manually from scratch. If you either reset it to CAPS Mode through the reset button or the menu option it will give you...

erlinden

If memory serves me well, it shows that there are no clients connected to the radio.

Do you want to have feedback on your config?

/export file=anynameyoulike

Remove serial and any other private info.

erlinden

What reasons could there be for the “Link downs” of a 5Ghz meter to trigger?

If you want some feedback, just share the config:

/export file=anynameyoulike

Remove serial and any other private info.

erlinden

From your config: /interface wireless security-profiles set [ find default=yes ] supplicant-identity=MikroTik add authentication-types=wpa-psk,wpa2-psk management-protection=allowed mode=\ dynamic-keys name=profile1 supplicant-identity=MikroTik Either remove wpa-psk or don't set any security. /inter...

erlinden

Looks like VLAN filtering is not enabled on the bridge. From the documentation: https://help.mikrotik.com/docs/pages/viewpage.action?pageId=46759946#WifiWave2(7.12andolder)-CAPsMAN-CAPVLANconfigurationexample: Here there is a distinction between 2.4GHz and 5GHz. Can you try to do the same? Are the S...

erlinden

I hope the manufacturer will be able to fix all the errors and shortcomings of hAP ax3 with updates.

That would involve the users as well

If you want some feedback, just share the config:

/export file=anynameyoulike

Remove serial and any other private info.

erlinden

Turn it off and see if you can open the /ip/firewall/connections tab. That should be a good indication.

erlinden

so it's unlikely that I misconfigured something. What could be the problem? What are some ways to troubleshoot this issue? By default WPA2 and WPA3 are enabled. That gave me a lot of problems. To troubleshoot (together with you): What RouterOS version are you running? Can you share the config? /exp...

erlinden

/ip pool add name=default-dhcp ranges=192.168.88.10-192.168.88.254 /ip address add address=192.168.1.11/24 comment=defconf interface=bridge network=192.168.1.0 /ip dhcp-server network add address=192.168.0.0/24 comment=defconf dns-server=192.168.0.99 gateway=192.168.0.99 netmask=24 Looks like three...

erlinden

if u want to get to the trouble, then use the new CapsMan

Can you eleborate this? I'm onto the beta in my home environment (I know, just a small network). Haven't had any strange CAPsMAN things, at least for me it is working not any less stable than the stable version.

erlinden

To use all frequencies, just buy another 10 (or something) Netboxes. Or understand how wifi is working.
Furthermore, why don't you want to set a country?

erlinden

Are there more clients suffering from this?

You could add wireless debug logging to get some additional information.
Besides, can you perhaps share your config:

/export file=anynameyoulike

Remove serial and any other private info.

erlinden

Could it be that the imported certificate is expired or renewed?

erlinden

If you want to check "Verify DoH Certificate" (which you obviously do), you hwave to make sure the MikroTik has the Root CA installed.

Check this blog that explains the steps to get it to work:
https://www.shellhacks.com/mikrotik-dns ... loudflare/

erlinden

At least reset the accesspoint to CAPS Mode. Do you see any radios on /wifi/radios (that is on the CAPsMAN)?

Currently on smartphone, going through the config isn't easy.

erlinden

In a default situation the router won't block this (any) traffic outgoing.
Can you share your config (at least the /ip/firewall part)?

/ip/firewall export

or

/export file=anynameyoulike

Are you using LTE? Could be that the provider is blocking the traffic.

erlinden

Looks like the DNS server is disabled. To turn it on:

/ip dns
set allow-remote-requests=yes

erlinden

I was also getting the script error in my logs after upgrading to 7.15. "executing script from scheduler failed, please check it manually" The solution was to replace the word "system" with "routeros" Old - :set Var1 "$[/system package get system version]" Ne...

erlinden

Either get a new wAP ac or, if time wouldn't be of an issue, wait for a wAP ax.

erlinden

Assuming you are using the wifi-qcom-ac driver:
https://help.mikrotik.com/docs/display/ROS/WiFi

erlinden

Use wpa2-aes only for the time being. And only ccmp. And turn on debug logging on wifi to get some more insights.

erlinden

Wifi-qcom-ac is only supported on ARM devices.

erlinden

I use address list, create a list (i.e. WAN-IP) and add the address (blahblah.sn.mynetname.net).
Then you can refer to the address list (with its name).

erlinden

Does the switch have an IP address, gateway and access to the Internet?
Can you ping router/public DNS server?

erlinden

Are there any files that remained on the filesystem? You might need to delete them manually.
Or better...netinstall it with the latest v6 LTS (currently 6.49.13)

erlinden

If you are worried with security, you might want to reconsider this:

/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=ether1 type=external

Ports are scanned, up to you if you want to have it logged...or not.

erlinden

Also wanted to know why (default mikrotik rules) drop all not incoming from LAN supersede drop from wan not dstnated? It does not matter what order are they in, drop not dstnated is just not working. I also have hairpin NAT, might that be a problem? There is a difference between the input chain (ac...

erlinden

Cache size is configurable, you might want to increase the memory (if you haven't tried already?):

/ip dns
set cache-size=20480KiB

erlinden

Something is wrong with the initial scan for 5 GHz. Every time at boot, the frequency is set to 5500 on all APs. This does not happen for 2.4 GHz where APs receive different frequencies. That is something that is bothering me as well. This frequency is checked for 1 min before used, hence this situ...

erlinden

/interface wireless security-profiles set [ find default=yes ] supplicant-identity=MikroTik add authentication-types=wpa-psk,wpa2-psk,wpa-eap,wpa2-eap eap-methods="" \ group-ciphers=tkip,aes-ccm management-protection=allowed mode=dynamic-keys \ name=kokoriko supplicant-identity="&quo...

erlinden

/caps-man channel add band=2ghz-b/g/n name=2g4 Does the above really make sense to you? All you do here is set the band, not the channels. Ie, you wnat to set: frequency=2412,2437,2462 I never use auto, I want to decide which frequency gets used. How do you handle this, a config per radio? How do y...

erlinden

can wifi capsman be run on a mipsbe device?

Sure (comes with 7.13 and up), but it won't be able to manage its own wireless interfaces.

erlinden

Good that you have found the forum! More interesting information can be found on YouTube (though there is a lot of garbage on it as well). Make sure to follow MikorTik and have a lok at this video:

https://www.youtube.com/watch?v=37aff6d14Xk

erlinden

I think in the end that is most important.

In regards to doing wrong...your firewall config has some space for improvement. Being polite on this.
In addition, are you sure you want to have port 22 available publically?
Who manages this router? This due to the fact it is running 7.6.

erlinden

The answer is either 42 or NAT.

erlinden

Hmm, methinks someone is upset Italy crashed out of the EuroCup! ;-) Canada wasn't part of it in the first place :lol: Too bad my RB760iGS isn't able to download the file due to too little flash memory. Does anyone have a solution to that? Apart from downloading it as file and load it from file, as...

erlinden

Can you share your (relevant part of the) config in a working and non working situation?

Something like:

/interface/wifi export

erlinden

Well, as long as the bridge doesn't have VLAN filtering enabled, this won't work.
Have a look at this great topic for all your VLAN questions (and answers):

viewtopic.php?t=143620

erlinden

Can you check wether both routeros and wifi-qcom packages are installed (/system/packages) on both cAP AX's?
If they are...can you share the export of both cAP AX's?

erlinden

In that case, please share your current config. Then we can do a quick check. Especially the firewall would be interesting.

/export file=anynameyoulike

Remove serial and any other private info.

erlinden

I think by resetting B to CAPS Mode your problem will be solved.

If you post the current B config, we can know for sure:

/export file=anynameyoulike

Remove serial and any other private info.

erlinden

Can you share your current config?

/export file=anynameyoulike

Remove serial and any other private info.

erlinden

First download the file:
https://help.mikrotik.com/docs/display/ ... loudbackup

Afterwards you can "load" the file:
https://help.mikrotik.com/docs/display/ROS/Backup

erlinden

And less expensive (but more time consuming):
https://help.mikrotik.com/docs/display/ ... forwarding

If that doesn't work, port your complete config without serial and any other priivate info and post it here:

/export file=anynameyoulike

erlinden

Never mix country, in your case France and United States. Why did you specify two (instead of four) channels? Is there no interference? On a slave configuration you can't specify Country and Tx-Power, this is only set on the master radio/interface. @meiki, if you want to have fixed channels, there i...

erlinden

How do you do bandwidth test? When using the builtin test, it will consume cpu power (and hence loose performance). In that case, better to use a tool like iPerf.

In regards to the antenna gain...just use the antenna gain. This will make sure that you remain within regulations.

erlinden

Thanks @holvoetn, will try this later today.

Update: Yes, this is indeed solving the issue I had.

erlinden

It depends (as always...).

Does your ISP support this?
Does your ISP use AON or XGS-PON? Both are supported but the latter is more expensive.

erlinden

I'm running into the "client was disconnected because could not assign vlan". Is this due to the fact I'm running hybrid (both wifi-qcom and wifi-qcom-ac? Didn't have this with an wifi-qcom-ac only environment. Yes, I'm using FT. Would setting ft-preserve-vlanid to yes make sense in this c...

erlinden

Can you please share your config (hAP ax3):

/export file=anynameyoulike

Remove serial and any other private info and post in between code tags by using the </> button.

erlinden

This process should be automatic. Do you use a PPPoE connection, or is it standard DHCP?
Where is the RB connected to (and how)?
Are there any requirements from the ISP in regards to running your own router?
What ISP do you have?

erlinden

Just to summarize: Fortigate offers VLAN ID 3 for public Wi-Fi. Any other VLAN ID (or untagged) for anything else? That is offered to the RB5009, right? But there is no VLAN set on the WAN interface, right? You have to come up with a network diagram, showing all VLAN ID's and the Fortigate, RB5009 a...

erlinden

Can you also post the config of the cAP AX?
If you post it in between code tags (by using the </> button), it will become more readable.

erlinden

add action=dst-nat chain=dstnat comment=NAT_To_Qbittorrent dst-address-list=PublicDNS dst-port=55111 log=yes protocol=tcp to-addresses=192.168.5.39 to-ports=8080 Is your PublicDNS indeed your public IP address? Which rule is logging the mentioned log entry? Is there anything responding on 192.168.5...

erlinden

add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface=ether1 Because you are using a pppoe connection, your in-interface above is incorrect. Why was the connection-state added? It will probably work w...

erlinden

In my opinion, the error(s) lies in the CAP. For example, it lacks configuration.manager=capsman on the wifi devices of the CAP. Please add it. Or, better, reset to CAP mode. Fully agree on this, reset the cAP ax's to CAPS Mode: https://help.mikrotik.com/docs/display/UM/cAP+ax or /system/reset conf...

Search found 2408 matches