I unplugged PoE Ethernet. Plugged it back in. Waited for 10 seconds until LED is green and then unpressed it. It should turn the CAP AX to cap mode. Correct?
Well I know ive redacted some stuff. But here it is.
As far as I understand, the person who setup the old setup wrote something like this:
APs are connected to the network essentially without configuring, only the admin user replaces the password.
To add to the central management, you need to hold down the AP reset button before you put the power on, and then count to ten and track the lights.
If the steps are done correctly, the device will register with the central administration.
Next, you need to enable the CAP interface created in the router and say Configuration: wifi in the interface settings. A more polite name for the device in the Remote CAP tab doesn’t hurt either.
To get access to the AP web interface, some port forwards have been made in the NAT rules of the router wall. Yeah, it’s a lazy solution, but enough for us.
Before, of course, you should set up a more permanent address corresponding to AP mac in your router’s DHCP leases.
The last moves are to open the AP Web Interface and press enter in the terminal to confirm the central management conf and set the admins user password.
This last move is quite important, because otherwise the conf will be forgotten after the restart, and this confirmation dialog will only be in the terminal of the web interface. The Latvians.
I wanna continue with this setup. As it works. OK
The router is behind NAT. So There are three vlans. NR 6 is for ??? The two other vlans are for the mikrotik mgmt (web,ssh) and also access to the internet.
The WiFi clients should not see the mgmt as they get their IP from 10.0.0.0/12 pool. ccr2004-config.rsc (10.7 KB)
Will the configurations of the capax be identical, same vlans etc… or do the capax’s serve different groups of users and thus not be identical in most respects.
All to say is your wasting your time.
Here is an easy capax setup that you only need to basically change the IP address of the capax on the trusted network for each device.
Each port on the main upstream router only needs to be a trunk port to ether1 on the capax ,carrying the correct vlans.
No capsman settings required, AND WIFI settings contain only WIFI parameters!!! Too easy.
I fully recommend that if the capax is not easily accessible (in terms of plugging in a laptop to ether2 for troubleshooting) that you run a second wire on install to a location where you can plug the other end of the ethercable into a laptop.
…
/interface bridge
add ingress-filtering=no name=bridgecap1 vlan-filtering=yes
/interface ethernet
set [ find default-name=ether2 ] name=emergaccess
/interface vlan
add interface=bridgecap1 name=Trusted-vlan11 vlan-id=11 { mandatory, management vlan must be identified in /interface vlan - do not put any other vlans here!! }
/interface list
add name=management
/interface wireless
{ As required phuck capsman }
/interface bridge port
add bridge=bridgecap1 ingress-filtering=yes frame-types=admit-only-vlan-tagged interface=ether1
add bridge=bridgecap1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged interface=WLAN1 pvid=11 comment="trusted wifi"
{ note: if no management wifi required, then ignore the above line }
add bridge=bridgecap1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged interface=WLAN2 pvid=ab comment="wlan for vlan ab"
add bridge=bridgecap1 ingress-filtering=yes frame-types=admit-only-untagged-and-priority-tagged interface=WLAN3 pvid=cd comment="wlan for vlan cd"
/ip neighbor discovery-settings
set discover-interface-list=management
/interface bridge vlan
add bridge=bridgecap1 tagged=bridgecap1,ether1 untagged=WLAN1 vlan-ids=11
{ note: if no management wifi required then add bridge=bridgecap1 tagged=bridgecap1,ether1 vlan-ids=11 }
add bridge=bridgecap1 tagged=ether1 untagged=WLAN2 vlan-ids=ab
add bridge=bridgecap1 tagged=ether1 untagged=WLAN3 vlan-ids=cd
/interface list member
add interface=Trusted-vlan11 list=management
add interface=emergaccess list=management
/ip address
add address=192.168.10.X/24 interface=Trusted-vlan11 network=192.168.10.0 comment="IP of capax1 on trusted subnet"
add address=192.168.55.1/24 interface=emergaccess network=192.168.55.0 comment="ether2 access off bridge"
/ip dns
set allow-remote-requests=yes servers=192.168.10.1 { Note: Done so all dns requests use trusted subnet }
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=192.168.10.1 comment="ensures route avail through trusted subnet gateway"
/ip service
/system ntp client
set enabled=yes
/system ntp client servers
add address=192.168.10.1
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=management
…
For CAPAX2, copy config and paste and make some very minor changes:
to make things clear, simply change bridge to bridgecap2
modify IP address of Trusted-Vlan ( aka IP address of capax2 to the applicable IP
ensure correct vlans are identified to WLANS on /interface bridge ports
ensure correct WLANS are indentified on /interface bridge vlans.
A lot of information to understand. I guess my main point is that it used to be easy to add a CAP to our capsman, with just changing it to caps mode. Now with these capax it doesnt seem to cooperate.
Our other setup uses: RouterBOARD 3011UiAS and 8 x RBwAPG-5HacT2HnD
