I am currently struggling with something which, based on the Mikrotik wiki and various other resources, should work fine. I’ll explain the setup below but the crux of my issue is that when a device connects to an SSID it isn’t getting an IP address that corresponds to the DHCP server of a VLAN.
The setup is as such: RB4011 (CAPSMAN) > CRS328 > CAPs (CAPSMAN Forwarding)
On the RB4011 I have setup VLAN 41, 42, and 43 along with some wireless configurations, and a DHCP server for each VLAN.
The CRS328 is basically just a switch at this point, not really doing anything apart from the fact it has Bridge VLAN filtering enabled in case the customer wants to connect wired devices to the various VLANs in the future.
The APs are in CAP mode and have not been modified in anyway apart from Bridge VLAN filtering from when I was testing some other things. Can disable this if necessary.
AP 1 has a master configuration SSID setup and two slave configuration SSIDs. The master has a Datapath configuration of:
Bridge: Bridge1
VLAN Mode: Use Tag
VLAN ID: 41
Local forwarding and client to client forwarding Disabled
When someone connects to this SSID they just get a 169 address rather than the address corresponding to VLAN 41 so they are clearly not getting it from DHCP. I don’t believe it’s a wireless configuration issue as if I remove the above config and change to Local Forwarding and setup the relevant Tagged and Untagged ports on each device along the chain I am able to get a 192.168.88 address (the default address for my Router’s bridge).
Further to the above, when someone connects to the master SSID, the WLAN interface appears as Tagged on my router’s Bridge VLAN table.
Not sure where to go from here. Any assistance would be greatly appreciated.
This is the CAPsMAN config for the SSID I am testing on. Also any config on the CAP that wasn’t configured by CAPsMAN has been removed (Bridge VLAN Filtering).
On hAP ax2 with version 7.13 I found that using capsman and vlan, the capsman master interfaces must be set tagged. By setting them without tags, DHCP does not pass.
Also, I noticed and also which slave if created dynamically the same way
To confirm, when you say the CAPSMAN master interfaces, do you mean the master wireless interfaces? If so when someone connects to them they appear in the Bridge VLAN Table of my CAPSMAN router as Current Tagged for their relevant VLANs so this seems correct to me.
If you mean the interface that leads to the managed devices then this is also tagged.
yes I am referring to this. Clients connecting to capsman’s WiFi do not necessarily need to know the VLAN ID behind it. Anyone who connects to WiFi may not even understand anything about networks. So I would say it would be correct to use the wireless interface in access (untagged) and specify the pvid in the bridge port. I expect it to work this way. Untagged traffic from the client is encapsulated in the VLAN of the corresponding pvid indicated for the WLAN interface. Maybe I’m wrong?
All the resources I have seen state to ‘Use Tag’ on wireless interfaces which dynamically adds them as tagged in the Bridge VLAN Table of the router. I don’t think Mikrotik would assume that every device connecting to a wireless network would be VLAN aware, seems like a massive oversight.
With this manual adjustment it will work just fine (and offcourse clients don’t have to be VLAN aware).
This is not the case for ax devices, there you can stick to the default CAP configuration.
@PrimeYeti: please consider using the qcom-ac package and 7.13.x RouterOS. By upgrading you will get some nice wave2 options.
I’ve managed to get it working but I’m not entirely sure how? Main thing I’ve changed is adding the bridge port as tagged in Bridge VLAN Filtering for all VLANs on the CAPsMAN router. Although when i remove it it doesn’t seem to make a difference in Torch (everything still comes through with correct VLAN) but I’m not sure if it’s just playing catch up maybe?
Forgot to say I think I found the reason. I didn’t have the CPU port (bridge) tagged in Bridge VLAN Filtering for each VLAN on the CAPsMANager. Thanks for the help!