Hi Everyone,
I followed the quide for the CAP AX with the interface/wifi capsman https://help.mikrotik.com/docs/display/ROS/WiFi#WiFi-CAPsMAN-CAPVLANconfigurationexample. While the CAP AX is connecting and being populated, unfortunately the wifi networks ares are passing the dhcp requests to the main router on the correct vlan.
I have tried hacking the examaple with no luck.
Does anyone have a modified example where the CAP AX is connected to a management vlan? The management vlan has no wifi networks associated with it and only provides the connection between my network devices. All other traffic for the wifi is on the main, IOT or guest networks
Thanks in advance.
Assuming you are not using CAPsMAN, you can follow this great tutorial. Basically, you will add VLAN filtering on the bridge of the cAP ax and assign VLAN ID on the bridge ports:
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
If you connect a computer to the same network cable (as the cAP ax is connected to), does it recieve a MGT VLAN IP address?
Hi Erlinden,
Thank you for your response. I did read that tutorial and it was a good read. I did know most of the concepts in it and it did expand on some areas that I was less knowledgeable on.
Yes my wireless connected devices are picking up a DHCP from the MGMT network on all of the vlans. It is definitely something in the vlan configurations. Either on the 5009 that the CAP is connected to or in the CAP config. The fact that the CAP is connected on MGMT network port and it appears to be losing the tags for the other vlans or the traffic is remaining separated.
I will dump the configs later today and plan to look at the port of the 5009 with torch to see what is happening.
Try this out:
/interface bridge
add name=bridge1 port-cost-mode=short vlan-filtering=yes
/interface ethernet
set [ find default-name=ether2 ] poe-out=off
/interface vlan
add interface=bridge1 name=MGMT vlan-id=100
/interface list
add include=all name=Access
add name=Mgmt
/interface wifi channel
add band=5ghz-ax disabled=no frequency=5200 name=5GhzAX skip-dfs-channels=all width=20/40/80mhz
add band=2ghz-ax disabled=no frequency=2462 name=2GhzAX secondary-frequency="" skip-dfs-channels=all width=20mhz
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disabled=no encryption="" name=HomestarSec
add authentication-types=wpa2-psk,wpa3-psk disabled=no encryption="" name=StrongbadSec
add authentication-types=wpa2-psk,wpa3-psk disabled=no encryption="" name=TrogdorSec
/interface wifi configuration
add channel=5GhzAX country="United States" disabled=no mode=ap name=Homestar5Ghz qos-classifier=priority security=HomestarSec ssid=Homestar
add channel=2GhzAX country="United States" disabled=no mode=ap name=Homestar2Ghz qos-classifier=priority security=HomestarSec ssid=Homestar
add channel=2GhzAX country="United States" disabled=no mode=ap name=Strongbad5Ghz qos-classifier=priority security=StrongbadSec ssid=Strongbad
add channel=2GhzAX country="United States" disabled=no mode=ap name=Strongbad2Ghz qos-classifier=priority security=StrongbadSec ssid=Strongbad
add channel=2GhzAX country="United States" disabled=no mode=ap name=Trogdor2Ghz qos-classifier=priority security=TrogdorSec ssid=Trogdor
/interface wifi
set [ find default-name=wifi2 ] channel=2GhzAX configuration=Homestar2Ghz configuration.mode=ap disabled=no name=Homestar2Ghz security=HomestarSec
set [ find default-name=wifi1 ] channel=5GhzAX configuration=Homestar5Ghz configuration.mode=ap disabled=no name=Homestar5Ghz security=HomestarSec
add configuration=Trogdor2Ghz configuration.mode=ap disabled=no mac-address=4A:A9:8A:CA:1B:31 master-interface=Homestar2Ghz name=IoT2Ghz security=TrogdorSec
add configuration=Strongbad2Ghz configuration.mode=ap disabled=no mac-address=4A:A9:8A:CA:1B:30 master-interface=Homestar2Ghz name=Strongbad2Ghz security=StrongbadSec
add configuration=Strongbad5Ghz configuration.mode=ap disabled=no mac-address=4A:A9:8A:CA:1B:2E master-interface=Homestar5Ghz name=Strongbad5Ghz security=StrongbadSec
/ip smb smb-user
set [ find default=yes ] disabled=yes read-only=yes
/interface bridge port
add bridge=bridge1 interface=ether1 internal-path-cost=10 path-cost=10
add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged interface=Homestar2Ghz internal-path-cost=10 path-cost=10 pvid=160
add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged interface=Homestar5Ghz internal-path-cost=10 path-cost=10 pvid=160
add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged interface=Strongbad2Ghz internal-path-cost=10 path-cost=10 pvid=120
add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged interface=IoT2Ghz internal-path-cost=10 path-cost=10 pvid=200
add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged interface=Strongbad5Ghz internal-path-cost=10 path-cost=10 pvid=120
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=Mgmt
/ipv6 settings
set accept-router-advertisements=yes
/interface bridge vlan
add bridge=bridge1 tagged=ether1,bridge1 vlan-ids=100
add bridge=bridge1 tagged=ether1 untagged=Strongbad2Ghz,Strongbad5Ghz vlan-ids=120
add bridge=bridge1 tagged=ether1 untagged=Homestar2Ghz,Homestar5Ghz vlan-ids=160
add bridge=bridge1 tagged=ether1 untagged=IoT2Ghz vlan-ids=200
/interface list member
add interface=MGMT list=Access
add interface=ether1 list=Access
add interface=ether2 list=Access
add interface=bridge1 list=Access
add interface=Homestar5Ghz list=Access
add interface=Homestar2Ghz list=Access
add interface=MGMT list=Mgmt
/ip dhcp-client
add interface=MGMT
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set winbox port=56473
set api-ssl disabled=yes
/ip smb smb-share
set [ find default=yes ] directory=/pub
/system identity
set name=CapAX-1
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system routerboard settings
set auto-upgrade=yes
/tool mac-server
set allowed-interface-list=Access
/tool mac-server mac-winbox
set allowed-interface-list=Access
/tool romon
set enabled=yes
Thanks Gabacho4, I will give it a go.
Hi Gabach04, I got that config to work after some modification for my vlans.
Now onwards to the wifi CAPSMAN
Outstanding! Glad it was of help. That configuration is for a stand alone AP. The config for Capsman would be quite different because the bulk of the config is made on the Capsman device. Unless you have a large number of APs I don’t think Capsman is worth it. I set it up but reverted to stand alone AP as I only have 2.