MikroTik

erlinden

Apart from upgrading RouterOS, did you also upgrade firmware (/system/routerboard)?
Anything in the logging that could be helpfull?
Can you share your current config?

/export file=anynameyoulike

Remove serial and any other private info, post between code tags by using the </> button.

erlinden

As far as I know it is a binary clone. So it should contain everything.

erlinden

From the documentation: https://help.mikrotik.com/docs/spaces/ROS/pages/40992852/Backup (RouterOS V7.x) https://wiki.mikrotik.com/Manual:System/Backup (RouterOS V6.x) Quote from the latter: RouterOS backup feature allows you to save your current device's configuration, which then can be re-applied o...

erlinden

Weren't you on the "My Mikrotik wifi6 works like a charm"-train all the time?

It does

Have done a lot of tweaking finding out I already had best settings.

erlinden

Out of everything I tested, enabling both FT and FT over DS and setting Connect Priority to 0/1 is the solution that made the errors stop. For me, specifically adding the connect-priority=0/1 (in combination with default settings mostl) made my Samsung S21+ and iPhone 11 roam without disconnecting ...

erlinden

It is still not able to receive ip from the isp1 router.

Where is your DHCP client?

erlinden

Any reason you haven't updated the RB5009 to version 7.16.2 (which is currently the latest stable release)?
Make sure to upgrade firmware as well...

erlinden

One needs to know what factory firmware version is installed.
My guess would be version V7.x, which does not have a LTS version up till now.

Is it necessary to have an LTS?

erlinden

This is the correct documentation, assuming that the accesspoints are running wifi-qcom(-ac):
https://help.mikrotik.com/docs/spaces/R ... iFiCAPsMAN

erlinden

Please share the current configuration to help you:

/export file=anynameyoulike

This will create a file (which can be found at files) that you can download.
Remove serial and any other private info and post between code tags by using the </> button.

erlinden

You know the difference between RouterOS and firmware?

erlinden

Just attempted to upgrade to 7.17 RC - have to rollback immediately. No devices will connect to 5 GHz - have no time to spend on further investigation, but something appears not to be OK for sure... Next time choose a moment where you can do some investigation. There could be a perfect good reason ...

erlinden

Allow VPN connections to router( from public internet)?
Why would it be safer than secured ssh access?

An additional layer of security?
Bit worried you asking this question.

erlinden

Could you please share your config, at least the wifi part?

/interface wifi export

Remove serial and any other provate info.
With this config we can provide you with some tips and tricks.

erlinden

https://help.mikrotik.com/docs/spaces/ROS/overview

erlinden

Good to hear, Netinstall requires some patience (but always has worked for me).
I like to buy second hand (as well), and will always perform a netinstall....just in case.

erlinden

The config would really help:

/export file=anynameyoulike

Remove serial and any other provate info, post between code tags by using the </> button.

erlinden

Have you tried swapping the power supply? That would be my best guess...

erlinden

Do some testing with an accesspoint (if you have one laying around). Then you get the best indication on attenuation.

Furthermore, what are your requirements? What will WiFi be used for?

erlinden

If the deivce isn't shown in Neighbors using Winbox (either connected to one of the ethernet ports or via wifi if available) I would do a netinstall: https://help.mikrotik.com/docs/spaces/RKB/pages/1409054/Problems+with+Netinstall Make sure to follow it by the letter. Btw: You can either connect usi...

erlinden

Aah, thanks @infabo! That makes sense (from the quote I posted).

erlinden

Local wifi interfaces aren't provisioned as CAPS: CAPsMAN cannot manage it's own wifi interfaces using configuration.manager=capsman, it is enough to just set the same configuration profile on local interfaces manually as you would with provisioning rules, and the end result will be the same as if t...

erlinden

Yes I use cap ax APs, I have made the changes still getting loads of disconnects and very poor WiFi performance. When I bought the mikrotik kit I understood that wireless might not be top of the line, but I did not expect it to be so bad... Hopefully they can resolve it... Can you post the current ...

erlinden

The only way to do this, is to uninstall the qqireless package and install the wifi-qcom-ac package on the cAP ac. More info can be found here: https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-Advancedexamples And here: https://help.mikrotik.com/docs/spaces/ROS/pages/40992872/Pack...

erlinden

I would expect that the VLAN's are configured, specifically per port. Can you share the config, so that we kow what you are talking about? Assuming it is configuraed with RouterOS: /export file=anynameyoulike Remove serial and any other private info, post between code tags by using the </> button.

erlinden

Can someone look through my config too, as I am getting loads of SA Query timeout/ "not responding" errors in the log. Also extremely poor network performance of WiFi.. Can you add/change a couple of things: /interface wifi channel add band=2ghz-ax disabled=no frequency=2412,2437,2462 nam...

erlinden

Couple of things in regard to VLAN are going wrong. First of all, when going VLAN, please go VLAN all the way. So that every network has its VLAN ID (other then 1). Next, you want to have a trunk port configured to which the cAP AX is connected to. This requires VLAN configuring on both RB4011 as we...

erlinden

Also consider replacing with the cAP AX, depending on how the current accesspoints are mounted.
What is the main reason of the upgrade? What are you expecting?

erlinden

If you want to go that way, don't forget to increase transmission power of your mobile devices as well.
The power used is restricted by regulations. Only (correct, in my opinion) way to solve this is add an accesspoint.

erlinden

What is the purpose of having this VLAN? From your config (quick scan) you seem to have a single VLAN on the LAN side. Can you give an explanation of your network? Or better, a network diagram?

erlinden

Nothing special, just a different WAN interface. Can you share your current config?

/export hide-sensitive file=anynameyoulike

Remove serial and any other private info, post between code tags by using the </> button.

erlinden

First get your requirements, as smart as possible. Both technical and functional. Make a network diagram with all devices involved. In regards to your questions: 1. It depends on what you want and how you configure it. 2. It depends. 3. Sure. 4. My RB951 I have had since 2004(?) is still supported. ...

erlinden

I would at least start only supporting wpa2-psk (with aes). Just out of security perspective.

erlinden

Anything about this stand out to you as clearly wrong? Not clearly wrong (at first sight), I totally love the concept of DRY. So, something like this: /interface wifi configuration add name=homeapcfg country="United Kingdom" mode=ap ssid="HOME" add name=iotapcfg country="Un...

erlinden

Did you update both RouterOS and firmware?

Pretty sure support would like to have your supout file. If you have the chance...

erlinden

Could you give these settings a try, @Jef61: /interface wifi configuration add name=homeapcfg country="Netherlands" mode=ap \ ssid="Kraailook" channel.skip-dfs-channels=10min-cac \ security.authentication-types=wpa2-psk,wpa3-psk \ .passphrase="[Moet je nog even zelf invullen...

erlinden

how come be so dificult

To be honost...the administrator is crap or the router is crap. Because the latter is supporting port forwards I would bet my money on the first.

This is pretty much basic networking stuff.

erlinden

Setting it fixed will most probably cause IP conflicts, the router will not be happy about it. Only options I can think of: Select an IP address outside of the DHCP scope Set that IP address in /ip address (make sure to fill in all relevant information) Forward to that IP address You will always nee...

erlinden

Different approach: why do you want it?

erlinden

Why not ask the administator of the router?
You might get into lots of problems when you configure an IP address yourself. And by asking how to do it...you will.

erlinden

Never ever touch QuickSet (unless the device is reset to defaults).

erlinden

My appologies, I have never seen that eth1 is a combined port. No LAN entries with ether1 or ether 2. Shall I delete the marked line with ether1? Change ether1 to ether2 No entry for ether1. Shall I just delete that marked entry for ether2? Change ether2 to ether1 DHCP Client is not enabled and poin...

erlinden

Befor you follow these steps (which are explained quit well!):

The eth1 is a PoE in port, you will have to connect the cAP AX to eth5 of the hAP AX3 to have it powering the cAP AX.

erlinden

Anything in the logging?
Why version 7.6?

erlinden

How do I configure new forwarders in my DNS server settings?

Please check the documentation:
https://help.mikrotik.com/docs/spaces/R ... 748767/DNS

erlinden

FFS, creating a profile just to make fun.

@mndtrip:
*) wifi - added station-roaming support (additional fixes);

In addition, I used the config supplied by @tangent:
https://tangentsoft.com/mikrotik/wiki?n ... ome+WiFi&p

You may want to try this to see if it helps.

erlinden

I have made all the changed you mentioned but still have the same issue.

Please post the updated config.

erlinden

Still No solution for this problem.... An ideas how can solve it? Can you share your config? I read a lot of people running into problems, while others have perfectly stable connections. It might be config related, at least that is pretty easy to analyse. /interface wifi export Remove serial and an...

erlinden

Not only will it do the trick, there is a MikroTik video on YouTube explaining how to do it (though it uses a hAP AX2 as CAP):

https://www.youtube.com/watch?v=bHotZT41w3E

The hAP AX3 is able to provide PoE to the CAP.

erlinden

Can you share your current wifi settings?

/interface wifi export

Remove serial and any other private info and post between code tags by using the </> button.

erlinden

Can you share the CAP config as well?

From the log I understand that the connection between the CAPsMAN and the CAP's is interrupted. Which explains the behavior. Any idea why this is happening? Are all devices connected with network cable? Are the cables tested? What is the number of link downs?

erlinden

Can you share your config?

/export file=anynameyoulike

Remove serial and any other private info and post between code tags by using the </> button.

erlinden

So sad to read that PCUnite's topic is not sufficient. That is absolutely straight forward.
Can you share your current config and explain what you exactly want?

erlinden

Can you add lease-time to dhcp-server:

/ip dhcp-server
add address-pool=dhcp_pool1 interface=bridge name=dhcp1 lease-time=8h

By default it is 10m, which can cause problems.

erlinden

Is quad9 DoH ever going to work properly on Mikrotik ? Has been running pretty stable for some time (think at least 6 hours), but then all of a sudden: DoH server connection error: remote disconnected while in HTTP exchange DoH server response not OK: 403: dns query not allowed DoH server response ...

erlinden

Do some manual VLAN filtering on the CAP, like this: /interface bridge add admin-mac=xxxxxxxxxxxx auto-mac=no frame-types=admit-only-vlan-tagged name=bridgeLocal vlan-filtering=yes /interface vlan add interface=bridgeLocal name=vlan99_base vlan-id=99 /interface wifi datapath add bridge=bridgeLocal c...

erlinden

How does your router know the IP adress of dns.quad9.net?

/ip dns
set allow-remote-requests=yes cache-size=409600KiB servers=9.9.9.9 use-doh-server=https://dns.quad9.net/dns-query verify-doh-cert=yes

Mostly default settings, no DNS entries in the log so far.

erlinden

Is quad9 DoH ever going to work properly on Mikrotik ?

Can't reproduce this behavior.
Can you share your /ip dns export?

erlinden

Personally I would start with one and do some testing. By the number you mention I assume this is a live environment? While doing the upgrade, you might want to consider upgrading to wifi-qcom-ac instead of the wireless driver. But that would be the next step and requires some more investigation. Ha...

erlinden

You prefer ICQ ?

BBS?

erlinden

As the complete bandwidth of 2.4GHz radio is 40MHz wide, I would advise to use bandwidth=20mhz. Roaming works better when you use non overlapping channels. Don't use vlan id=1, instead use something above 1. Don't set antenna-gain to 0, leave it default or set correctly. Missing country, which makes...

erlinden

VLAN filtering should be done on a single bridge:

/interface bridge
add name=GUEST-LAN vlan-filtering=yes
add name=LAN vlan-filtering=yes

Now you have two bridges.

Please read this great topic about VLAN's:
viewtopic.php?t=143620

erlinden

The cAP ac is both with wireless and with wifi-qcom-ac ridicoulisly stable. Though I do prefer the wifi-qcom-ac driver. Has been running for years and years without problems. But it requires some good configuring and tiny tweaking.

erlinden

So extensive they missed 2 reboot steps to make it clear, as shown by the last posts in this thread

Part of the uninstall process is a reboot.

And that is explained here:
https://help.mikrotik.com/docs/spaces/R ... 2/Packages

erlinden

Are you trying to corrupt seniors??

We need to get on a skype/discord chat so we can discuss losing my capsman virginity.

Never too old to lose one's virginity.

And I would call myself...ehm...senior (as well?).

But...Skype? Really!?

erlinden

Was able to upgrade through the App of both my RB4011 and cAP AX. The (two) wAP AX's do not upgrade (hangs on "Download in progress", nothing else happens). Nothing in the logging. Will try with Winbox tonight (currently off site). Anyone else having the same issue? For who is interested, ...

erlinden

There is extensive documentation, also on replacing:

https://help.mikrotik.com/docs/spaces/R ... ss'package

erlinden

From the documentation: Hold this button during boot time and release after LED light stops flashing to reset SwOS configuration and load primary backup firmware. Access to primary firmware allows the reinstallation of the main firmware. Did you perform the reset like this? Netinstall is RouterOS on...

erlinden

Have you tried with a different browser (or at least tried in-private)?

erlinden

Totally agree (except for the 2.4GHz preference, haven't seen that).
And you can run CAPsMAN (new style), @anav! The object oriented implementation

erlinden

Honestly, maybe it's just my opinion but i have a feeling that cAP ac works better than all of this ax stuff...

I wouldn't want to go back (from cAP ac to cAP AX to wAP AX). But that is just my opinion

erlinden

Hey, which logs I could enable to see more detail in the moment it happens. I want to be able to see more detail to be sure if this could be a threat or not.

You haven't mentioned what the log is currently mentioning.
And still waiting for the config...

erlinden

The official documentation (including examples) can be found here:
https://help.mikrotik.com/docs/spaces/R ... ionexample:

erlinden

You want multi VLAN's untagged on a port? Can you explain why?

erlinden

Why?

Any device can be downgraded to the "Factory Firmware", which can be found at /system routerboard.
Please have a look at the extensive documentation, some questions can be answered easily:

https://help.mikrotik.com/docs/spaces/R ... g+RouterOS

erlinden

Please elaborate on the "none of the certificates worked correctly". What are the certificates used for?

erlinden

It's a bit odd...you are setting channel to 5240, while in the screenshot it shows 5500. /interface wifi set [ find default-name=wifi1 ] arp-timeout=auto channel.band=5ghz-ac .frequency=5240 .skip-dfs-channels=all .width=20/40mhz configuration.country=Russia .mode=ap .ssid=MikroTik-8075C3 disabled=n...

erlinden

Start with default firewall filter rules, your current rules are...creative. Did you configure the router? Is it public facing?

Also, your VLAN config is creative, have a very good look at this very good topic:
viewtopic.php?t=143620

erlinden

Documentation is also providing this info: reselect-interval (time interval; Default:) Specifies when the interface should rescan channel availability and select the most appropriate one to use. Specifying interval will allow the system to select this interval dynamically and randomly. This helps t...

erlinden

Can you supply a network diagram with all devices involved?

erlinden

/interface wireless set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-Ce \ disabled=no distance=indoors frequency=auto hide-ssid=yes installation=\ indoor mode=ap-bridge ssid=Mikrotik wireless-protocol=802.11 set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\ 20/4...

erlinden

Wasn't this introduced in the 7.17 beta release? Only available through the beta channel, which has to be selected manually? But I might not understand you correctly...

erlinden

/ip address add address=192.168.0.2/24 interface=bridge1 network=192.168.0.0 add address=192.168.11.2/24 interface=sfp-sfpplus1 network=192.168.11.0 /ip dhcp-client add interface=sfp-sfpplus1 From the above, I get the feeling that on the sfp you set an IP manually and you get an IP through DHCP. As...

erlinden

Both my wAP AX's where supplied with 7.15.x.

erlinden

Okay. It actually makes sense, when I think of it: all lists are consulted in parallel. Thanks for the info.

erlinden

Can you show your config?

/export file=anynameyoulike

Remove serial and any other private info, post between code tags by using the </> button.

erlinden

It is indeed, though IP spoofing is possible. Couple of things: FTP can be run active and passive (if memory serves me well). Active means that the other site has to have port 20 open, passive would require an additional range of ports open on the router. The reason for advising to netinstall is tha...

erlinden

From the documentation:
https://help.mikrotik.com/docs/spaces/R ... ionexample:

If you prefer video, check YouTube:
https://youtu.be/bHotZT41w3E?si=PiGRpP_0vQHPQzyd

Feel free to ask additional questions if you fail configuring.

erlinden

What is the exact purpose of running your own DNS server?

erlinden

any help to setup my own dns server?

Please first confirm your problem, is it DNS?

erlinden

Why do you use a (single) VLAN? To understand (more?) about VLAN, please have a look at this great topic: https://forum.mikrotik.com/viewtopic.php?t=143620 Next, configure CAPsMAN as mentioned here: https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-CAPsMAN-CAPsimpleconfigurationexa...

erlinden

Is DNS the problem? Did you do a proper analyses on why it takes a long time? In such a case I like to use the Developer Tools (F12) which can give you a good indication on where the problem is. From your config: /ip dhcp-client add interface=ether8-WAN You can expand that with use-peer-dns=no to ma...

erlinden

Haven't tested, can you add more lines? By using the + simbole and using the same field to filter on?

erlinden

Besides lots of improvements (though not working for you), MikroTik is constantly requensting their users to provide information. So I don't agree with you, @woland.

erlinden

Still?
MikroTik (or its community) can't help you on this.

erlinden

What do you mean test multiple files? Also what logs? In hAP logs I don't see anything suspicious. What if you start multiple downloads, is the combined speed higher? iperf3 -c proof.ovh.net -p 5206 -R -P 8 (gets you 8 streams), does that make a difference? As the hAP ac is single core, that is not...

erlinden

No need to get picky, you are on a user forum with professionals. Though they might react a bit direct (as a Dutchman I think they do), they also provide you valuable information. I'll try to be as polite as I can...perhaps you can do the same? From the post from @tangent: Use L2TP (which works perf...

erlinden

The log should show which user failed logging in and which user did succeed.
Can you confirm this?

erlinden

How do you exactly test? Have you tried with multiple files? What protocol is used? Does the log give any hints?

erlinden

From the test results (https://mikrotik.com/product/RB962UiGS- ... estresults) you should be able to reach a bit over 300 Mbps.
What RouterOS version and firmware version are you running?

erlinden

In the end it is all about supply and demand. Asus is targeting a different audience then MikroTik. Either make a suggestion to MikroTik for implemention or accept it. it stands to reason that common sense should prevail and it should be implemented on the MT as well. it stands to reason that common...

erlinden

Mmmm...FTP and security in one sentence. Can you elaborate a bit more why you want to use FTP? And why on a router? Would a container perhaps solve this problem? What is the purpose? Do you consider file sharing a routers task?

Next to that, would you consider FTP to be secure...at all?

erlinden

At a signal of -60dB, why would you expect it to roam?

erlinden

I even tested with a live tv channel playing on the tablet and there was abojt a second drop off when it switched. Is that good?

What is the logging showing? It doesn't sound as fast transitioning.

Thanks @holvoetn, wasn't aware of that.

erlinden

Nice picture! We should start with the correct terminology. Mesh means wireless backhaul. So in your case, RB951Ui-2HnD (2F) should only be configured as ap. RB951Ui-2HnD (1F) should be configured both ap-bridge (to connect to 2F) and have a virtual adapter configured as a,p assuming you want to mak...

erlinden

erlinden

Where is the bridge on both routers? Any asterisk in a config should be examined carefully, i.e. (specifically the out-interface): /ip firewall filter add action=accept chain=forward disabled=yes dst-address=192.168.12.240 dst-port=80 in-interface=ether4 out-interface=*A protocol=tcp src-address=188...

erlinden

The gateway should be set to the IP address of your router. You might want to consider using DHCP client (on the bridge) that handles correct IP addressing. By using static leases, you can use dedicated IP addresses.

erlinden

Good for you!

erlinden

Are their provisioning rules which match the new radios?
Can you share the wifi config of the CAPsMAN?

/interface wifi export file=anynameyoulike

Remove any private info, post between code tags by using the </> button.

erlinden

Feel free to share your config to get some feedback. Also, by playing with the antenna orientation, different results can be expected. /export file=anynameyoulike [or] /interface wifi export file=anynameyoulike Remove serial and any other private info, post between code tags by using the </> button.

erlinden

Can you set country code in correspondence with the country you are in (the NTP setting indicates something else)?
What is the status of the radio of the Netbox?

/interface/wifi/radio/print detail 
/interface wifi print

erlinden

YES! I have replaced a wAP ac (outside) and a cAP AX (inside) with the wAP AX. Can see any difference inside, the connection is stable (which is most important to me) and the wife is also happy (by the looks in comparison with the cAP AX). It is available (at least in Europe), where do you live? The...

erlinden

Were both RouterOS and wireless package included during netinstall?

erlinden

Can you share the configs:

/export file=anynameyoulike

Remove serial and any other private info, post between code tags by usnig the </> button.

erlinden

Turned out my provision rules did not meet the new MAC address on the 5GHz radio and therefore wasn't provisioned. The 2.4GHz provision rule wasn't bound to a MAC address "filter" and could therefore be provisioned.

erlinden

Difficult to advise, as some relevant information is missing. What is the signal and what are the tx and rx rates in that case?
Ofcourse you can play with tx power, as well you can add access lists to block clients when a thresshold is reached.

erlinden

Why do your AP have a firewall? I prefer to follow the documentation on the CAP, in combination with bridge VLAN filtering for the ethernet ports. By leaving the 5GHz channel to auto, it is possible that the AP's are using the same frequencies. That could be a reason for having bad roaming experienc...

erlinden

Received 2 wAP AX's. Really like them (same case as wAP ac). One strange thing: I had to manually provision the 5GHz radio to get that to work. Not sure what caused this.

erlinden

Have a look at this great topic:
viewtopic.php?t=192736

erlinden

Can't help you on that. CAPsMAN is what I have most experience with (besides VLAN). Only remark I have, I would use VLAN's instead of multiple bridges. Think it will simplify the firewall as well. (Simple) Queues with VLAN's is pretty easy (like setting minimum bandwidth), but not sure if that solve...

erlinden

Perfect, thank you very much. I will do the configuration and report back.

You are very welcome. The radio mac address van be found on the Radios tab (in Winbox).

erlinden

Is the power supply provided with the RB5009 sufficient? That is a 24V 1,5A power adapter.

erlinden

By leaving a lot on auto, you never know what will happen. I.e. all frequencies can be equal making roaming terrible. What I would do, is configure per radio: /interface wifi channel add disabled=no frequency=2412 name="CH 1 (2412)" width=20mhz add disabled=no frequency=2437 name="CH ...

erlinden

A lease time of 10 minutes is

Adjust it to what makes sense, i.e. 4 or 8 hours. Or more.

Is adding to the address list necessary?

erlinden

To rule out DHCP, can you change lease time?
Could you share your config?

/export file=anynameyoulike

Remove serial and any other private info.

erlinden

i think what it really slows down is 100% cpu all the time

What is it doing? What is consuming all the cpu cycles?
Can you share your config?

/export file=anynameyoulike

Remove serial and any other private info.

erlinden

InterVLAN is accepted by default, you would have to add a filter rule on the forward chain, blocking this traffic. Or...accept only what is allowed and drop verything else (as last rule on the forward chain).

erlinden

VLAN all the way, hybrid is not preferred. This way you can keep your config clean and readable.

erlinden

Is there a chance to escalate this issue? It seems that the developers of RouterOS 7.x do not know anything about this.

As you know, assumption is the mother...etc.
Just contact support to address your problem.

erlinden

Are the current rules “good enough”?

Yes

erlinden

Must read: viewtopic.php?t=143620

Can you share your config?

/export file=anynameyoulike

Remove serial and any other proivate info.

erlinden

I always keep the SSID identical and play with transmission power (lower 2.4GHz transmission power a lot). My client devices are smart enough to select the 5GHz radio, or roam to it when available. Another disadvantage of having different SSID's is the lack of roaming. You have to change manually, u...

erlinden

What is up with the quotation marks?
Can you share your config?

/export file=anynameyoulike

Remove serial and any other provate info.

erlinden

It depends on what you want. I.e. you could have a edicated IoT network on the 2.4GHz, while your corporate/home network is on 5GHz (or both 2.4GHz and 5GHz). Shared SSID on two radios will support more clients. At the same time you have no control with what radio the client connects. So...what do y...

erlinden

Update fails due to a missing package (wireless to be precise). Step one: identify currently installed packages (routeros and at least wireless in your case) Step two: download all installed packages and drop them in folder. Then reboot. Alternatively, update through /system/packages/ automatically ...

erlinden

You could order your firewall rules, would make it more readable. Start with input chain, then forward chain. Currently it is a complete mess (to me). This rule should allow traffic from VLAN100 to VLAN200. Is it hit (either counters or log entries when logging is enabled)? Where do the spaces come ...

erlinden

Just give it a try and make sure it is configured properly.

erlinden

Don't use VLAN ID 1, this can cause (these kind of) problems. Check all asterikses, especially on /interface list member. Internet detect can cause strange problems, probably not related (but turn it off anyway). On /interface bridge port, set frame-types: Access ports - frame-types=admit-only-untag...

erlinden

Did you have a look at the log? Enabled wifi debug logging?
In regards to your question, could it be DFS check (of up to 10 minutes, depending on the selected frequency)?
Sure you want to use 40MHz bandwidth on the (saturated?) 2.4GHz radio?

erlinden

I want to use one as the main router and the other as a regular switch, creating an uplink between the two via the SFP port.
Is this possible?

Sure you want to have a switch act as a router?
What WAN-LAN throughput do you require?

erlinden

Transmission power is set on: /interface/wifi/configuration/tx-power Frequency is set on: /interface/wifi/channel/frequency Can you share your config? /export file=anynameyoulike I have made a config (and provision rule) per radio, so I can set everything the way I want it exactly. I.e. all channels...

erlinden

You could play with transmission power, by default it is set to maximum. Lowering could improve roaming.

erlinden

Don't use VLAN ID 1.
If you want to do VLAN filtering oin the bridge, you should enable it.

erlinden

You should set the correct IP address information to the wireguard interface.
It should be 10.90.200.4/32 but is currently 192.168.177.2/24

Also, Allowed IP's should be set to 0.0.0.0/0, ::/0, currently you only set ::/0.

erlinden

Thanks. Just to be specific both CAP AX and WAP AX data sheets state "PoE in .. 802.3af/at". Can they in fact also be powered by passive PoE?

Yes

erlinden

Newer is not always better. You can read changelogs to consider upgrading or not.

Can you provide us with a complete export?

/export file=anynameyoulike

Remove serial and any other private info.

erlinden

Why size would influence the decision? Being bigger I mean. Trying to understand

Do you have a partner?

erlinden

Agree with @infabo.

Can you also change

/interface wifi channel add band=2ghz-ax disabled=no name=2ghz skip-dfs-channels=10min-cac width=20/40mhz

to

/interface wifi channel add disabled=no name=2ghz frequency=2412,2437,2462 width=20mhz

erlinden

Wifi marketing shizzle is one way, while the wired connection is two way. Though I do agree the benefits...not all traffic is always through a single wired port. If you, i.e. use a NAS it could be beneficial. In the end, the shizzle is about theoretical maximum connection speed and has nothing to do...

erlinden

TLS is between client and server, the MikroTik has nothing to do with that. Is the date/time correct on all involved devices? Does it work when you (temporarily) test with IPv4 only? How is (one of the) domain names resolved? What did Fronius support answer? Remars: remove anything you have done adj...

erlinden

cAP AX is nearly three times the size of a wAP ax.
If you search the forum, there is real time comparison between the two.

erlinden

What is in itself the problem of remaining at 7.14.3 (at least for the time being)?
Is there specific functionality missing that was introduced from 7.15 upwards?

erlinden

Apart from using VLAN ID 1...sure.
Have a good read: viewtopic.php?t=143620

erlinden

I would like to install it on the ceiling instead of an old cAP, do you think it is suitable or is the antenna very directional?

wAP can be securely fixed to any external wall or roof from the inside of the case

erlinden

/interface list member add interface=WAN-1 list=WAN add interface=bridge1 list=LAN Seems to me that, based on the config, the second bridge isn't part of the LAN address list. But from your config so many questions...why? Why multiple bridges (instead of using VLAN)? Why is your firewall so much ch...

erlinden

Can you post a complete export from both CAPsMAN and CAP (assuming they are different devices)? Currently it is incomplete, i.e. country code is missing (part of configuration). /export file=anynameyoulike Remove serial and any other private info and post between code tags by using the </> button.

erlinden

Either you want to be helped...or not. Provide all configs for all involved devices (I would expect four configs) and follow instructions afterwards by the letter. Again the hardware is capable, but it requires proper config. And from the error message you provided it is clear that your current conf...

erlinden

Tell the cAP AX it is a router and configure it like one. Just make sure the cAP AX has a static IP address (or have its MAC address registered).

erlinden

Too bad it isn't working for you. Unfortunately, MikroTik is not the right tool for everyone. I would really have liked to get you a working environment, hte hardware is more than capable. Especially the code @meki provided should have given you a working environment. Apart from the fact that US has...

erlinden

Yes! wAP AX, finally!!

erlinden

Is the regulation info hardware depending? I always thought that it was fixed?

erlinden

Shouldn't wlan1 also be part of the bridge?

erlinden

When I see "6.47.4", all alarm bells are ringing. Please consider upgrading the router while you are working on it.

erlinden

Can you please translate your responses to English? I now have to use Google Translate. Just use 20/40/80MHz as bandwidth (for 5GHz radios), they won't do more. Just use 20MHz bandwidth for 2.4GHz radios, the spectrum is already overcrowded. All configuration should be done on the CAPsMAN (that's wh...

erlinden

Does it all work now, yes all good, I was just trying to reason why!

Can't help you with that. Still, from a conceptual perspective I would use a /interface/wifi/security item per ssid. Personal preference...

But in the end...good to hear it works already.

erlinden

Channel can be set on the configuration, when selecting the corresponding radio (through it's MAC address) it will be set. If it shows incorrect frequency, it shows that you are assigning incorrect frequency to that radio (i.e. a 2.4GHz frequency to a 5GHz radio or vice versa). Auto is not that bad,...

erlinden

Just a couple of remarks that can be improved on your config: Use 20MHz bandwidth on the 2.4GHz radios Set fixed frequencies on all radios (and make them non-overlapping) When not setting band, it will support to newest supported standard: "Frequency band and wireless standard that will be used...

erlinden

Hope that helps! It seems that there is difference between security. And SSID (on purpose?). I would always make one item (per SSID) in /interface/wifi/security and use that on all interfaces. Because when specifying security items on /interface/wifi explicitely, it will override the selected secur...

erlinden

Rule 1: don't use VLAN ID 1
If you want to seperate networks (at least, I think that is the main reason for having multiple subnets), you might want to consider using VLAN's. Especially in the correct way, as described in the "Bible on VLAN":
viewtopic.php?t=143620

erlinden

You do know the IP address of the router? Set a fixed IP address on the computer, within the same subnet, and connect? Last resort (if everything fails) is using netinstall to reset the device completely. Ofcourse the config is whiped, but you should be able to reconfigure. Check this topic (and fol...

erlinden

Does it help when gain is set to 19? And when you unset TX Power (setting it to max power in accordance with regulations implicitly)? Is the antenna well attached to the NetBox? Have you followed all suggestions? Can you post a new export (/interface/wifi/export is sufficient) after making all chang...

erlinden

In an optimum situation (line of sight, no interference, no other clients) that is about the max you can expect. You can play with frequency to select the least crowded channel (i.e.5660).

erlinden

Perhaps you can play a bit with orientation? Hope that helps. And did you configure the same channels?
And, instead of looking at number of bars, please check the (TX and RX) rates. Signal power is often confused with signal quality.

erlinden

Anything can be overridden, could that have been the case? Can you share your config?

erlinden

/interface wifi set [ find default-name=wifi1 ] channel.band=5ghz-ax .frequency=5500 \ .skip-dfs-channels=all .width=20/40/80/160mhz configuration.antenna-gain=\ 20 .chains=0,1 .country=Russia .distance=2 .mode=ap .ssid=test \ .tx-chains=0,1 .tx-power=28 disabled=no Lets see: .frequency=5500 - Apar...

erlinden

To start with:
https://mikrotik.com/support

Next, stick to a single topic:
viewtopic.php?t=211894

erlinden

i Just tried to add WPA3 via sec1 and apply to 3 of my wifi interfaces but it didn't work. What didn't work? I tend to perform an export when in doubt if settings are correct: /interface/wifi/export Alternatively you can use a wifi scanner for getting insights wether i.e. WPA3 is available. Fwiw, W...

erlinden

But I mean, 5 GHz should be able to do 2.4 GBits.

erlinden

/system logging
add topics=debug,dhcp

erlinden

You make a neighbour group in steering. Two locations (and from the GUI there is a tab steering:

/interface/wifi/configuration/steering
/interface/wifi/steering

erlinden

no result after spending a lot of time on this. Too bad Can anyone ask to Mikrotik? Have you already contacted support? Sent an supout file? Why should we ask MikroTik? Is there any user who uses this NetBox 5AX ?? Have you searched this forum, there are more topics about the NetBox. please share r...

erlinden

Still you need to learn basic VLAN setup. @anav did an incredible job in his reply to this post. You missed all the relevant stuff (/interface /bridge/port and /interface/bridge/vlan) and misconfigured /interface/vlan. Compare your config with the example of @anav, specifically on my mentioned parts.

erlinden

From the documentation: netmask (integer: 0..32; Default: 0 ) The actual network mask is to be used by the DHCP client. If set to '0' - netmask from network address will be used. When set to 0, it will not show up in the export. When set to 24 it will. Wasn't aware of this, @mkx. Still, it will use ...

erlinden

Finally, the long awaited cAP AX product. However, lets hope MikroTik can release the needed AX driver improvements on their next ROS release...................... You mean wAP AX I assume? They are constantly improving and releasing new drivers and versions of RouterOS...no doubt it will become be...

erlinden

Change this...: /ip dhcp-server network add address=172.22.2.0/24 comment=VLAN2 gateway=172.22.2.1 add address=172.22.3.0/24 comment=VLAN3 gateway=172.22.3.1 add address=172.22.4.0/24 comment=VLAN4 gateway=172.22.4.1 add address=172.22.5.0/24 comment=VLAN5 gateway=172.22.5.1 ...to this: /ip dhcp-ser...

erlinden

What do you mean by first day launch? The apperance on the several webshops?
I pre ordered today here in the Netherlands.

erlinden

First, the bridge on the router should have VLAN filtering enabled: /interface bridge add name=bridge port-cost-mode=short Change to: /interface bridge add name=bridge port-cost-mode=short vlan-filtering=yes Can continue on all other parts (accesspoint at least), but you should first start reading a...

erlinden

I actually dont mind the AX3 now, setup is not intuitive and confusing with multiple menus that overlap and interfere with each other but once you stumble across a working config, and dont use capsman, it works well enough. For developers, used to program object oriented, the menu is actually prett...

erlinden

Use Winbox, connect through MAC address instead of IP address.

erlinden

there must be something else wrong.. could it be my docking station part of the problem?

Anything could be wrong. Just to make sure...can you share your config?

/export file=anynameyoulike

Remove serial and any other private info.

erlinden

Most threads nowadays are about the wifi-qcom(-ac) driver. You are still using the legacy/old wireless driver. So...no, I don't see a lot of threads nowadays about this driver. For security settings, start with basic before using more advanced stuff: / interface wireless security-profiles set defaul...

erlinden

Can you please share:

/interface/wifi/export

Remove any private info.

Update: it works on my machine. Could it be a typo?

erlinden

Any reason you want to work with multiple bridges (for wireless versus wired)? As there is nothing mapped on bridge2, my assumption would be that being the reason. If you want to make distinction, you might want to consider using VLAN's. For the time being, you can test with setting the brdige to br...

erlinden

Could you share your config?

/export file=anynameyoulike

Remove serial and any other private info and post in between code tags by using the </> button.

erlinden

Anyway moving on... Has anyone tried WPA3 on 7.17 beta4 yet ?

Running 7.17 beta4, mixed WPA2/WPA3 on dual cAP AX and wAP ac using multiple VLAN's. Windows/Linux/Android/iOS devices. Seems pretty stable. Disconnection caused by too weak signal. Installed yesterday, still have to do some testing.

erlinden

OpenVPN server generates debug messages with "unknown" topics. I'm not sure if this is the 7.16.1 issue, as I haven't run the OpenVPN server on previous versions of RouterOS. Show us the...config: /export file=anynameyoulike Remove serial and any other private info and post ebtween code t...

erlinden

Show us the...config:

/export file=anynameyoulike

Remove serial and any other private info and post ebtween code tags by using the </> button.

erlinden

Just to make sure: you leave the password empty and you get the message "incorrect password"? Did you reset by use of the reset button? Sure it is reset? You didn't specify a password for this device? Last resort: netinstall: https://help.mikrotik.com/docs/spaces/ROS/pages/24805390/Netinst...

erlinden

But, is hAP ax³ capable of routing a 1 GBIT internet at full speed ?

Yes it is:
https://mikrotik.com/product/hap_ax3#fndtn-testresults

Check Routing, 25 ip filter rules, 512 byte, Mbps to get a good indication of the WAN-LAN throughput.

Search found 2707 matches