Can't get wifi interfaces on hAP ax S out of "bound" condition

Hi,

I have a hAP ax S that is behaving weirdly. I can't seem to get the wifi interfaces to work -- they are in "bound" condition all the time, despite a /interface/wifi/reset 0,1. ROS 7.23.2, multiple reboots didn't help, disabling and re-enabling the wifi-mediatek driver package didn't help either (yes, with reboots ;-)). I can configure the interfaces with ROS, no error messages or anything, but no wifi shows up in the air. Scanning with the interfaces (e. g., /interface/wifi/scan 0) finds zero wifis even though there are plenty of active networks in the air. Am I looking at a hardware issue or is this some sort of deep config screwup that can be fixed by netinstall (but not by a wifi config reset)? Unfortunately, I can only access the device remotely right now, otherwise I would have tried... But if I'm likely looking at a hardware issue then I'd rather replace it than trying to revive the wifi interfaces.

If anyone has seen anything like this before, any pointers are greatly appreciated -- that's a problem that I've never seen before, so I'm pretty stymied...

Thanks & Cheers,

Toby.

Without seeing your config, it is impossible to speculate with any level of accuracy.

One thing I have seen (on other models) is if something like a freq is set to an invalid value, this type of behavior is seen.

(And I would think that pretty much anynsetting should be correctable without netinstall . . . either via dirext tweaks, or reset to a default config.)

And you see a status of "bound" . . . Anything else? You should also see "master"

Indeed, I have not posted my config, as I wrote that I had reset it. My apologies. Here it is:

[admin@JSS10-Router] > /interface/wifi/export
# 2026-07-29 17:22:42 by RouterOS 7.24rc3
# software id = 8N3P-8L23
# 
# model = E62iUGS-2axD5axT
# serial number = < removed by mod >
/interface wifi capsman
set ca-certificate=auto certificate=auto interfaces=""

And this is what it looks like:

[admin@JSS10-Router] > /interface/wifi/print detail
Flags: M - MASTER; B - BOUND; X - DISABLED, I - INACTIVE
0  MBX default-name="wifi1" name="wifi1" l2mtu=1560 mac-address=D0:EA:11:2D:EA:6D arp-timeout=auto radio-mac=D0:EA:11:2D:EA:6D

1  MBX default-name="wifi2" name="wifi2" l2mtu=1560 mac-address=D0:EA:11:2D:EA:6E arp-timeout=auto radio-mac=D0:EA:11:2D:EA:6E

Again, any pointers would be greatly appreciated.

THX & Cheers,
Toby.

"Configuration" when asked means WHOLE configuration, not the /interface/wifi one.

The issue may lie in something seemingly completely unrelated.

You are correct. I certainly don't see what might live outside /interface/wifi that might interfere with this, but you are right. Here is the complete config.

# 2026-07-29 17:46:39 by RouterOS 7.24rc3
# software id = 8N3P-8L23
#
# model = E62iUGS-2axD5axT
# serial number = < removed by mod >
/interface bridge
add admin-mac=D0:EA:11:2D:EA:68 auto-mac=no comment=defconf name=bridge \
    vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] comment="Client access port"
set [ find default-name=ether2 ] comment="Client access port"
set [ find default-name=ether3 ] comment="Client access port"
set [ find default-name=ether4 ] comment="Golden port"
set [ find default-name=ether5 ] comment="Client access port"
set [ find default-name=sfp1 ] comment="(Unused)"
/interface lte
set [ find default-name=lte1 ] comment="Primary Uplink"
/interface wireguard
add comment="JSS10 Access" listen-port=5192 mtu=1420 name=wg-JSS10
add comment=ProtonVPN listen-port=1 mtu=1420 name=wg-proton
/interface vlan
add comment="Internal clients" interface=bridge name=vlan-client vlan-id=101
add comment="Guest clients" interface=bridge name=vlan-guest vlan-id=103
add comment=Infrastructure interface=bridge name=vlan-infra vlan-id=99
add comment="IoS clients" interface=bridge name=vlan-ios vlan-id=104
add comment=Lab interface=bridge name=vlan-lab vlan-id=105
add comment=Proton-Tunneled interface=bridge name=vlan-proton vlan-id=109
add comment=Services interface=bridge name=vlan-service vlan-id=100
add comment=IPv4-only interface=bridge name=vlan-v4 vlan-id=107
add comment="Work clients" interface=bridge name=vlan-work vlan-id=102
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=trusted
/ip pool
add comment="Internal clients" name=pool-client ranges=\
    192.168.101.100-192.168.101.199
add comment=Work name=pool-work ranges=192.168.102.100-192.168.102.199
add comment=Guest name=pool-guest ranges=192.168.103.100-192.168.103.199
add comment="IoS clients" name=pool-ios ranges=\
    192.168.104.100-192.168.104.199
add comment=Lab name=pool-lab ranges=192.168.105.100-192.168.105.199
add comment=IPv4-only name=pool-v4 ranges=192.168.107.100-192.168.107.199
add comment=Proton-Tunneled name=pool-proton ranges=\
    192.168.109.100-192.168.109.199
/ip dhcp-server
add address-pool=pool-client interface=vlan-client lease-time=1d name=\
    server-client
add address-pool=pool-work interface=vlan-work lease-time=1d name=server-work
add address-pool=pool-guest interface=vlan-guest lease-time=1h name=\
    server-guest
add address-pool=pool-ios interface=vlan-ios lease-time=1h name=server-ios
add address-pool=pool-lab interface=vlan-lab lease-time=10m name=server-lab
add address-pool=pool-v4 interface=vlan-v4 lease-time=1d name=server-v4
add address-pool=pool-proton interface=vlan-proton lease-time=1d name=\
    server-proton
/routing table
add fib name=ProtonVPN
/interface bridge port
add bridge=bridge comment="Client access" frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether1 pvid=101
add bridge=bridge comment="Client access" frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether2 pvid=101
add bridge=bridge comment="Client access" frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether3 pvid=101
add bridge=bridge comment="Golden port" frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether4 pvid=99
add bridge=bridge comment="Client access" frame-types=\
    admit-only-untagged-and-priority-tagged interface=ether5 pvid=101
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge comment="MAC access to JSS10-Router" tagged=bridge \
    vlan-ids=1
add bridge=bridge comment=Infrastructure tagged=bridge untagged=ether4 \
    vlan-ids=99
add bridge=bridge comment=Clients tagged=bridge untagged=\
    ether1,ether2,ether3,ether5 vlan-ids=101
add bridge=bridge comment="Work clients" tagged=bridge vlan-ids=102
add bridge=bridge comment="Guest clients" tagged=bridge vlan-ids=103
add bridge=bridge comment="IoS clients" tagged=bridge vlan-ids=104
add bridge=bridge comment=Lab tagged=bridge vlan-ids=105
add bridge=bridge comment=IPv4-only tagged=bridge vlan-ids=107
add bridge=bridge comment=Proton-Tunneled tagged=bridge vlan-ids=109
/interface list member
add comment=defconf interface=bridge list=LAN
add interface=wg-JSS10 list=LAN
add interface=wg-proton list=WAN
add interface=vlan-infra list=LAN
add interface=vlan-service list=LAN
add interface=vlan-client list=LAN
add interface=vlan-work list=LAN
add interface=vlan-guest list=LAN
add interface=vlan-ios list=LAN
add interface=vlan-lab list=LAN
add interface=vlan-v4 list=LAN
add interface=vlan-proton list=LAN
add interface=vlan-infra list=trusted
add interface=vlan-service list=trusted
add interface=vlan-client list=trusted
add interface=vlan-work list=trusted
add interface=vlan-proton list=trusted
add interface=wg-JSS10 list=trusted
add interface=lo list=trusted
add interface=lte1 list=WAN
/interface wifi capsman
set ca-certificate=auto certificate=auto interfaces=""
/ip address
add address=10.168.98.254/24 interface=wg-JSS10 network=10.168.98.0
add address=192.168.98.254/24 comment=Infrastructure interface=vlan-infra \
    network=192.168.98.0
add address=192.168.100.254/24 comment=Services interface=vlan-service \
    network=192.168.100.0
add address=192.168.101.254/24 comment=Client interface=vlan-client network=\
    192.168.101.0
add address=192.168.102.254/24 comment=Work interface=vlan-work network=\
    192.168.102.0
add address=192.168.103.254/24 comment=Guest interface=vlan-guest network=\
    192.168.103.0
add address=192.168.104.254/24 comment="IoS clients" interface=vlan-ios \
    network=192.168.104.0
add address=192.168.107.254/24 comment=IPv4-only interface=vlan-v4 network=\
    192.168.107.0
add address=192.168.105.254/24 comment=Lab interface=vlan-lab network=\
    192.168.105.0
add address=192.168.109.254/24 comment=Proton-Tunneled interface=vlan-proton \
    network=192.168.109.0
add address=10.2.0.2/30 interface=wg-proton network=10.2.0.0
/ip cloud
set update-time=no
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,9.9.9.9,1.1.1.1,8.8.4.4
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="Wireguard access from LAN" dst-port=\
    5182 in-interface-list=LAN protocol=udp
add action=accept chain=input comment="accept DNS/udp coming from LAN" \
    dst-port=53 in-interface-list=LAN protocol=udp
add action=accept chain=input comment="accept DNS/tcp coming from LAN" \
    dst-port=53 in-interface-list=LAN protocol=tcp
add action=drop chain=input comment=\
    "drop all not coming from trusted interfaces" in-interface-list=!trusted
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    in-interface-list=WAN
/ip firewall mangle
add action=mark-connection chain=prerouting comment="Mark connections going th\
    rough the ProtonVPN interface without explicit routing" in-interface=\
    wg-proton new-connection-mark=ProtonVPN routing-mark=!ProtonVPN
add action=mark-connection chain=postrouting comment=\
    "Mark connections explicitly routed through ProtonVPN" \
    new-connection-mark=ProtonVPN routing-mark=ProtonVPN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
/ip route
add comment="ProtonVPN route" dst-address=0.0.0.0/0 gateway=10.2.0.1 \
    routing-table=ProtonVPN
/ip service
set ftp available-from=127.0.0.1/32
set telnet disabled=yes
set www-ssl certificate=JSS10-Router.cer_0 disabled=no
set winbox disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ip ssh
set forwarding-enabled=both host-key-size=4096 strong-crypto=yes
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="accept DNS/udp coming from LAN" \
    dst-port=53 in-interface-list=LAN protocol=udp
add action=accept chain=input comment="accept DNS/tcp coming from LAN" \
    dst-port=53 in-interface-list=LAN protocol=tcp
add action=drop chain=input comment=\
    "drop all not coming from trusted interfaces" in-interface-list=!trusted
add action=drop chain=forward comment="drop all from lab interface" \
    in-interface=vlan-lab
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/ipv6 nd
# automatic dns option advertising is not started, re-apply dns config
set [ find default=yes ] advertise-dns=yes
/routing rule
add action=lookup-only-in-table comment=\
    "Route traffic from Proton VLAN through the ProtonVPN table" disabled=no \
    interface=vlan-proton table=ProtonVPN
/system clock
set time-zone-autodetect=no time-zone-name=Europe/Berlin
/system identity
set name=JSS10-Router
/system logging
add action=echo topics=firewall
add action=disk topics=firewall
add action=disk topics=critical
add action=disk topics=error
add action=email topics=firewall
add action=email topics=critical
add action=support topics=lte,!packet
/system ntp client
set enabled=yes
/system ntp client servers
add address=0.arch.pool.ntp.org
add address=1.arch.pool.ntp.org
add address=2.arch.pool.ntp.org
add address=3.arch.pool.ntp.org
/system package update
set channel=testing

THX & Cheers,
Toby.

Either I am blind, your config exports were truncated, or ??? But I don't see an SSID set anywhere . . . . or a country, or most other Wifi stuff.

???

Indeed. As I wrote in my original post, I did a /interface/wifi/reset 0,1, so the config is completely empty, but the interfaces are still bound. (And they are not used in any bridge either.) Plus, scanning with either interface doesn't seem to pick up any wifis (of which there are plenty in the air around the router).

Cheers,
Toby.

Frankly, I'm not sure that the bound state is relevant to your issue, since they need to be bound to work.

Also, not sure that "bound" in this context has anything to do with a bridge. From the docs on wifi, bound is:

"True for master interfaces that are currently available for WiFi manager.

True for a virtual interface (configurations linked to a master interface) when both the interface itself and its master interface are not disabled and the master interface has a bound flag."

Had you reset to a non-blank config, I suspect that they would be up.

Also, not sure if scan is valid with no country or other frequency set defined on the interface yet

(And are these local, or capsman/remote?)

It may well be that the bound status is not the core of the problem, yes. I have, of course, tried to configure a regular wifi (I do have a dozen or so MT APs in production, so while I certainly cannot and will not claim to be an expert, especially with regard to wifi configuration, I do think that I can manage to set up a basic wifi), and while ROS says the wifi is all set up and running, there is no wifi on the air to be seen. Also, with a completely blank configuration, the wireless interfaces should be able to run a scan and see all the wifis that are around, but this devices doesn't see anything whatsoever. I have tested the scanning on a different device -- a scan immediately after a reset works perfectly, and the device is not tagged as bound, although admittedly I didn't have another hAP ax S for the testing, so the test was run with a different driver. Hence I am not sure I can rule out a configuration issue.

I am completely at a loss as to what is going on. Also, the device did have wifis up and running, but users started complaining that they were not seeing the wifis were unstable, so I tried to reconfigure them, but as it turns out, the users haven't seen any wifi since, which is why I started investigating and seeing this weird "bound" phenomenon that I cannot explain. (Also, to answer your question, the device was locally managed.)

Like I wrote, I do lean towards a hardware issue, but I did want to ask around if someone had seen this "permanently bound" thing before, or maybe had a hint as to what might block the interfaces, because I am fresh out of ideas. %-/

THX & Cheers,
Toby.

Huh, how about that. So I just got my hands on another AX AP -- my previous tests were on a non-AX device. Turns out that indeed the interfaces are flagged as bound even without any configuration (so immediately after a reset). That explains why I cannot get rid of the flag.

However, I still seem to have a problem -- a scan does work on a completely blank configuration (after a reset) on the test device, but not on the problematic device. Hm. %-/

Unfortunately, even the new test doesn't rule out misconfiguration because the test device is not a hAP ax S but an ax², so it doesn't run on a mediatek chipset and hence runs a different driver, so the scan not working might still be a config issue. Hm. If anyone who happens to have a hAP ax S could confirm that a scan should work right after a reset, that'd be helpful...

THX & Cheers,
Toby.

Sorry, I wasn't meaning to diminish your skills, it's just that the complaint was "Wifi interfaces won't go on air" and then you posted a config that was incapable of doing so . . . . I can only comment on what I see. Had you posted a config that you thought was good and it was still failing, my comments and suggestions would likely have been different.

I can't say much RE: scan, since the only time I have tried it, it took the AP off air to scan, kind of painting me into a corner (granted, on an AC, and fortunately I had a watchdog setup that restarted it), so have held off on doing much with that function.

I assume that your test device was also cleared via the same command(s) and not just at a default config?

Good morning,

I completely understand. Condensing what has already happened and what has been tried and what the actual problems were into a post that is as compact as possible is not easy, and I am afraid I failed to convey crucial information in my original post. %-/ Apologies for that, didn't mean to waste everybody's time.

Yes, I've cleared the test device with the same commands before trying the scan. So I guess since I was misguided vis-a-vis the bound flag (I understood this to mean that some config was still blocking the use of the device, which apparently is not true for the wifi drivers), that may not be the actual problem, so I'll set up a minimal configuration for what I reckon should be a working wifi config and see whether that works, and if not, post the config here, I guess...

Thanks a lot for your input!

Cheers,
Toby.

Housekeeping remark to tdussa:

I removed serial number from both your exports.
You should never post that info on public places.
Normally it shouldn't harm but if for some reason you opened the wrong gates (knowingly/unknowingly), someone having that serial might reach your device.
This doesn't mean they can get in but it's already a step into that direction ... so as a general rule: never post serial number when exporting config. Obfuscate it.

Thanks a lot, missed that! :slight_smile:

So I've configured the 5GHz interface with this command:

/interface wifi
set [ find default-name=wifi2 ] channel.band=5ghz-ax .skip-dfs-channels=10min-cac .width=20/40/80mhz configuration.mode=ap .ssid=testtest disabled=no \
    security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes .passphrase=XXXXX configuration.country=Germany

The wifi doesn't show up whatsoever (yes, I've waited for the channel scan to settle ;-)). %-/

On the ax2, this configuration works as expected, so unless there's a crucial difference between the wifi-mediatek and the "normal" wifi driver...

THX & Cheers,
Toby.

Doesn't show up where ?
On your client or on AX S ?

Can you leave out channel.band as well as width (that last one for now) ?
I am not 100% sure wifi2 is the 5Ghz radio ... besides, best to leave such things blank, they will be used at maximum possible setting anyhow.
Also, best to specify frequency so you KNOW where you should be looking.

By default AX devices favor higher ranges and if you just happen to check with a device not able to use that range ... you see nothing.

Doesn't show up on the AC device next to the hAP ax S. I am 100 % sure wifi2 is the 5GHz radio -- I mistakenly used wifi1 first but that gave me a frequency error. :wink:

So I've taken out channel.band and channel.width and added channel.frequency as suggested. I've picked 5480 because the hAP ac Lite that's doing the scanning should be able to see that (at least, it sees wifis on channel 5500, so 5480 shouldn't be too high). No wifi to be found. :frowning:

/interface wifi
set [ find default-name=wifi2 ] channel.frequency=5480 .skip-dfs-channels=10min-cac configuration.country=Germany .mode=ap .ssid=testtest disabled=no \
    security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes
[admin@JSS10-Router] /interface/wifi> print detail
Flags: M - MASTER; B - BOUND; X - DISABLED, I - INACTIVE
0  MBX default-name="wifi1" name="wifi1" l2mtu=1560 mac-address=D0:EA:11:2D:EA:6D arp-timeout=auto radio-mac=D0:EA:11:2D:EA:6D

1  MB  default-name="wifi2" name="wifi2" l2mtu=1560 mac-address=D0:EA:11:2D:EA:6E arp-timeout=auto radio-mac=D0:EA:11:2D:EA:6E configuration.ssid="testtest" .mode=ap
       .country=Germany security.ft=yes .ft-over-ds=yes .authentication-types=wpa2-psk,wpa3-psk channel.frequency=5480 .skip-dfs-channels=10min-cac

I'm not sure about that ... especially not since now leaving out that width, it will probably use 160MHz.

Try 5160 so there is no discussion if AC Lite should be able to see it or not.
And since you are using AC Lite to check, set width to 80MHz (or even 40).

Darn. Misread and used 5460 instead of 5160. Sorry.

But 5160 gives me no available channels as well:

# no available channels 
set [ find default-name=wifi2 ] channel.frequency=5160 .skip-dfs-channels=10min-cac .width=20/40mhz configuration.country=Germany .mode=ap .ssid=testtest disabled=no \
    security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes

So I picked out 5320 from the priority list of the interface. That is accepted by the interface:

/interface wifi
set [ find default-name=wifi2 ] channel.band=5ghz-ax .frequency=5320 .skip-dfs-channels=10min-cac .width=20/40/80mhz configuration.country=Germany .mode=ap .ssid=testtest \
    disabled=no security.authentication-types=wpa2-psk,wpa3-psk .ft=yes .ft-over-ds=yes

but is not detected by the hAP ac lite.