cAP ax 5GHz not working in CAPsMAN

I have a CCR2004-16G-2S+ with CAPsMAN and it’s currently managing a hAP ax3 in CAPs mode without issue. All clients connect to it and each client is automatically steered to the 5GHz radio. Everything is on RouterOS v7.13.1.

I’m trying to replace the hAP ax3 with a cAP ax and have it do the exact same thing with the same CAPsMAN configuration the hAP ax3 is using. This is the second cAP ax I’ve tried. I get the cAP ax added to CAPsMAN, set the configurations. I then disable the 2GHz and 5GHz radios on the hAP ax3 and devices automatically connect to the cAP ax. However, everything is connecting to the 2GHz radio. When I disable the 2GHz radio on the cAP ax and leave the 5GHz radio enabled, nothing ever connects to the 5GHz radio on the cAP ax.

This is the second cAP ax I’ve tried that’s done this. The configurations look fine, and they work fine with the hAP ax3. No idea why 5GHz does not work properly on the cAP ax. The hAP ax3 and cAP ax are using the same Qualcomm chipset. Why is the cAP ax behaving this way?

Configuration is pretty generic, most things left unchanged/delivered. As explained, when I disable all cap-wifi’s except for cap-wifi4, it doesn’t even broadcast its SSID. I check on a mobile device and the SSID isn’t even listed.

cap-wifi1 is hAP ax3 5GHz
cap-wifi2 is hAP ax3 2GHz
cap-wifi3 is cAP ax 2GHz
cap-wifi4 is cAP ax 5GHz


/interface wifi configuration
add channel.skip-dfs-channels=all country="United States" disabled=no mode=ap name=cfg1 security.authentication-types="" .encryption="" .ft=no .ft-over-ds=no ssid=MikroTik
add channel.skip-dfs-channels=all .width=20mhz country="United States" disabled=no mode=ap name=cfg2 security.authentication-types="" .encryption="" .ft=no .ft-over-ds=no ssid=\
    MikroTik
/interface wifi
add configuration=cfg1 configuration.mode=ap disabled=no name=cap-wifi1 radio-mac=78:9A:18:46:D1:47 security.authentication-types=wpa2-psk .connect-priority=0/1 .encryption="" \
    .ft=yes .ft-over-ds=yes .group-key-update=1d .wps=disable
add configuration=cfg2 configuration.mode=ap disabled=no name=cap-wifi2 radio-mac=78:9A:18:46:D1:48 security.authentication-types=wpa2-psk .connect-priority=0/1 .ft=yes \
    .ft-over-ds=yes .group-key-update=1d .wps=disable
add configuration=cfg2 configuration.mode=ap name=cap-wifi3 radio-mac=78:9A:18:59:76:FB security.authentication-types=wpa2-psk .connect-priority=0/1 .encryption="" .ft=yes \
    .ft-over-ds=yes .group-key-update=1d .wps=disable
add configuration=cfg1 configuration.mode=ap name=cap-wifi4 radio-mac=78:9A:18:59:76:FA security.authentication-types=wpa2-psk .connect-priority=0/1 .ft=yes .ft-over-ds=yes \
    .group-key-update=1d .wps=disable
/interface wifi cap
set certificate=none discovery-interfaces=all enabled=yes
/interface wifi capsman
set enabled=yes interfaces=all package-path=/ require-peer-certificate=no upgrade-policy=suggest-same-version

You’re not provisioning one of cAP ax’ radio interface … both cap-wifi3 and cap-wifi4 configuration stanzas have same MAC set to radio-mac property.

That’s not it. Both radios have different MAC addresses as well.

2GHz is 78:9A:18:59:76:FB
5GHz is 78:9A:18:59:76:FA

Tried re-provisioning both radios anyway to no avail. 5GHz on the cAP ax still not working. Nothing connecting to it.

I’ve also noticed that using a Security profile for all APs is broken as delivered. I can create/configure a Security profile in CAPsMAN with the desired security options. However, even if I select security authentication like WPA2 PSK and save the profile, then tell an AP to use that profile, the AP doesn’t even set itself to use WPA2 PSK. I have to go into the Configuration for the AP and manually set it to use WPA2 PSK.

So using a Security profile on the cAP ax doesn’t resolve the original issue either. 5GHz shows as running in its status but it’s not broadcasting an SSID so nothing can connect to it.

It sounds like CAPsMAN in v7.13 and above just flat out is broken.

The only thing I haven’t tried yet is rolling back the firmware.

Tried rolling back the firmware on the cAP ax to no avail.

I’m just going to send this unit back if I don’t have an answer by Thursday and just assume that v7.13 is broken for the cAP ax.

Absolutely ridiculous.

Befor doing a downgrade (which is probably not necessary), can you check why in your config there is encryption=“” 4 times?
Looks to me like a misconfiguration, at least you don’t want this current setting.

Steep learning curve…don’t give up yet.

You can also reset configuration and begin from scratch.

It’s not broken, you are using it wrong.
First thing you should do is removing all the empty(!) authentication-types and encryption settings. Then start with a minimal configuration where anything but the SSID and security password is set to default. Once this is working you can start refining settings.

Edit: Basic setup guide on the offical Mikrotik YouTube channel: https://www.youtube.com/watch?v=37aff6d14Xk

Okay, so:

Configured a security profile with the desired authentication type and encryption ciphers (which contradicts what’s documented here: https://help.mikrotik.com/docs/display/ROS/WiFi#WiFi-SecurityProperties)

Configured both radios on the cAP ax to use the security profile via CAPsMAN
Doesn’t reflect the desired changes from the security profile (so no authentication types or ciphers are selected- CAPsMAN is obviously broken here.)
Manually set the authentication types and ciphers for each radio
Enabled the cAP ax radios, disabled the hAP ax3 radios
Everything goes to 2GHz network on cAP ax. I disable the 2GHz. Nothing goes to 5GHz.

Here is my configuration

/interface wifi configuration
add channel.skip-dfs-channels=all country="United States" disabled=no mode=ap name=cfg1 security.authentication-types="" .encryption="" .ft=no .ft-over-ds=no ssid=MikroTik
add channel.skip-dfs-channels=all .width=20mhz country="United States" disabled=no mode=ap name=cfg2 security.authentication-types="" .encryption="" .ft=no .ft-over-ds=no ssid=\
    MikroTik
/interface wifi security
add authentication-types=wpa2-psk connect-priority=0/1 disabled=no encryption=ccmp,gcmp,ccmp-256,gcmp-256 ft=yes ft-over-ds=yes group-key-update=1d name=sec1 wps=disable
/interface wifi
add configuration=cfg1 configuration.mode=ap name=cap-wifi1 radio-mac=78:9A:18:46:D1:47 security=sec1 security.authentication-types=wpa2-psk .encryption=\
    ccmp,gcmp,ccmp-256,gcmp-256
add configuration=cfg2 configuration.mode=ap name=cap-wifi2 radio-mac=78:9A:18:46:D1:48 security=sec1 security.authentication-types=wpa2-psk .encryption=\
    ccmp,gcmp,ccmp-256,gcmp-256
add configuration=cfg2 configuration.mode=ap name=cap-wifi3 radio-mac=78:9A:18:59:76:FB security=sec1 security.authentication-types=wpa2-psk .encryption=\
    ccmp,gcmp,ccmp-256,gcmp-256
add configuration=cfg1 configuration.mode=ap disabled=no name=cap-wifi4 radio-mac=78:9A:18:59:76:FA security=sec1 security.authentication-types=wpa2-psk .encryption=\
    ccmp,gcmp,ccmp-256,gcmp-256
/interface wifi cap
set certificate=none discovery-interfaces=all enabled=yes
/interface wifi capsman
set enabled=yes interfaces=all package-path=/ require-peer-certificate=no upgrade-policy=suggest-same-version

I would remove your current configuration and start from here:

#create a security profile
/interface wifi security
add authentication-types=wpa3-psk name=sec1 passphrase=HaveAg00dDay
 
#create configuraiton profiles to use for provisioning
/interface wifi configuration
add country=Latvia name=5ghz security=sec1 ssid=CAPsMAN_5
add name=2ghz security=sec1 ssid=CAPsMAN2
add country=Latvia name=5ghz_v security=sec1 ssid=CAPsMAN5_v
 
#configure provisioning rules, configure band matching as needed
/interface wifi provisioning
add action=create-dynamic-enabled master-configuration=5ghz slave-configurations=5ghz_v supported-bands=\
    5ghz-n
add action=create-enabled master-configuration=2ghz supported-bands=2ghz-n
 
#enable CAPsMAN service
/interface wifi capsman
set ca-certificate=auto enabled=yes

https://help.mikrotik.com/docs/display/ROS/WiFi#WiFi-CAPsMAN-CAPsimpleconfigurationexample:

The above configuration will handle different radios by setting the supported-bands. Just make sure that the config above is adjusted to your preferences.

I’ve already reset everything from scratch and reconfigured twice to no avail.

Like I said, all of this works fine on a hAP ax3. 5GHz does not work on the cAP ax using the same configuration- and as far as I can tell, that’s the only thing that doesn’t work.

Watching the CAPsMAN MikroTik video on YouTube. Toms claims you can just configure a security profile and set the AP to use that profile. I’m sure that works in theory, but so far in practice, it doesn’t apply all of the desired security settings from the profile to the AP.

So the documentation AND the YouTube instructions DO NOT match what’s actually happening in CAPsMAN when applied.

Am I supposed to be using the “routeros” v7.13.1 package to manage CAPsMAN on the CCR? Or am I supposed to use the “wireless” package?

According to documentation, I should be using routeros with WiFi6 APs. Okay, so that’s what I’ve been doing on the CCR.

Wireless package is for non wifi-qcom devices (like all ac and older using the wireless package).
As you are using the cAP ax, you only need the 7.13.x routeros (on CAPsMAN and CAP) to get this up and running.

Still don’t know why there is a difference between hAP ax3 and cAP ax, I would expect them both to work. Though again, creating your CAPsMAN config from scratch should give a working environment.

Is there anything in the log?
Have you followed all directions in the documentation, also on the CAP?

Started over from scratch again. After having played with all of the available tabs in CAPsMAN, created profiles, configurations, etc. the WiFi ONLY works if I configure each AP directly in CAPsMAN via WiFi → WiFi tab, double-clicking on each “cap-wifi”. Doing this allows everything to work properly as expected on the hAP ax3. This new configuration when replicated to a cAP ax yields a 2GHz radio that works, but a 5GHz radio that DOES NOT. This configuration when applied to a cAP ax leads to ALL clients connecting ONLY to 2GHz. If I disable the 2GHz radio on the cAP ax and ONLY ENABLE the 5GHz radio, it doesn’t broadcast an SSID at all so you CANNOT CONNECT TO IT.

/interface wifi
add channel.skip-dfs-channels=all configuration.country="United States" .mode=ap .ssid=MikroTik disabled=no name=cap-wifi1 radio-mac=78:9A:18:46:D1:47 \
    security.authentication-types=wpa2-psk .connect-priority=0/1 .encryption=ccmp,gcmp,ccmp-256,gcmp-256 .ft=yes .ft-over-ds=yes .group-key-update=1d .wps=disable
add channel.skip-dfs-channels=all .width=20mhz configuration.country="United States" .mode=ap .ssid=MikroTik disabled=no name=cap-wifi2 radio-mac=78:9A:18:46:D1:48 \
    security.authentication-types=wpa2-psk .connect-priority=0/1 .encryption=ccmp,gcmp,ccmp-256,gcmp-256 .ft=yes .ft-over-ds=yes .group-key-update=1d .wps=disable
add channel.skip-dfs-channels=all .width=20mhz configuration.country="United States" .mode=ap .ssid=MikroTik name=cap-wifi3 radio-mac=78:9A:18:59:76:FB \
    security.authentication-types=wpa2-psk .connect-priority=0/1 .encryption=ccmp,gcmp,ccmp-256,gcmp-256 .ft=yes .ft-over-ds=yes .group-key-update=1d .wps=disable
add channel.skip-dfs-channels=all configuration.country="United States" .mode=ap .ssid=MikroTik name=cap-wifi4 radio-mac=78:9A:18:59:76:FA security.authentication-types=wpa2-psk \
    .connect-priority=0/1 .encryption=ccmp,gcmp,ccmp-256,gcmp-256 .ft=yes .ft-over-ds=yes .group-key-update=1d .wps=disable
/interface wifi cap
set discovery-interfaces=all enabled=yes
/interface wifi capsman
set enabled=yes interfaces=all package-path=/ require-peer-certificate=no upgrade-policy=suggest-same-version

So basically I’m stuck with a cAP ax I can’t use since 5GHz just flat out doesn’t work in CAPsMAN v7.13.x with this thing. This is most definitely a software issue. I’ve watched the YT videos, read the documentation, tried direct configuration of the AP and indirect using profiles to no avail.

Whatever. I’ll just leave this thread open while the distributor deals with the RMA process with MikroTik for the cAP ax unit. Maybe it gets fixed in the next ROS release? I’m giving things a few more days until I demand a refund or dispute the charge.

Late to the party here but can you do a full export of interface/wifi both on capsman and cap (both a hap ax2 and cap ax)
I have 3 cAP AX and I do not have this issue at all.

One thing that I wonder is you say that you can configure each wifi interface on the cap and that is the only way to get it to work? I have manager set on each interface to capsman and then local config does not work at all so what do you have this set to?

Set encryption to CCMP only and give it another try.

I would call it a user issue :laughing:

It is definitely a misconfiguration issue: all of the cAP ax that I have used/configured had wifi1 as the 5GHz interface and wifi2 as the 2.4GHz one. So if you disable wifi1 it shouldn’t be a surprise that you will not have 5GHz available.
Besides you were not willing to go from the simple configuration to learn where you did the misconfiguration of the device, rather went with one where you turned all the knobs that you found instead of not touching anything beside the ones described in the CAPsMAN - CAP simple configuration example.

Feel free to continue blaming the issue on what I’m doing even though I’ve already shown it’s a software issue. I don’t know how many times I can scream “everything works if I use a hAP ax3” and I would bet money if I swap the hAP ax3 with an ax2, it will still work. It’s also probably no coincidence that every recent post in this sub-forum is from someone having WiFi issues with the new CAPsMAN system in v7.13.x.

I’m using the product as delivered. I’ve even done this from scratch multiple times. What you see now is basically me just turning on what’s delivered in the new CAPsMAN and telling the cAP ax to talk to it, implementing a barebones direct configuration and 5GHz flat out does not work.

Regardless, I’m sending the cAP ax back and I’m actually going to swap the hAP ax3 with an ax2 and then I guarantee I will continue to prove that this configuration works with hAP models but not the cAP for reasons unknown.

Well I would love to help but need to see the config to do so.
I also think there is something strange in config but as you have devices that work I do not know. Want to look into the config as some things you can do should not be passable with manager at to capsman.

dont worry. i can not still add D53G-5HacD2HnD-TC&RG502Q-EA AC wireless to capsMan AX.