Hi,
I would like to solve the connection of the hAP ax3 router and the cAP ax access point with VLAN and CAPsMAN under ROS7 based on the description.
Unfortunately, there are problems with it.
I would use the Router-Switch-AP (all in one) configuration on the router, while the AccessPoint config on the access point. Of course, I modified it and set up CAPsMAN, but it doesn’t want to connect.
Is there a solution for this?
Thank you for your help
Though there is a lot of information missing, I would like to advice you:
Can you share the config from both CAPS and CAPsMAN?
/export file=anynameyoulike
Remove serial and any other private info, post between code tags by using the </> button.
Thank you very much for your help, I can attach a config.
Here is ax3 config but it is not yet complete and may contain unnecessary parts:
/interface bridge
add name=bridge1 vlan-filtering=yes
/interface vlan
add interface=bridge1 name=BLUE_VLAN vlan-id=10
add interface=bridge1 name=GREEN_VLAN vlan-id=20
add interface=bridge1 name=GUEST_VLAN vlan-id=99
/interface list
add name=WAN
add name=VLAN
add name=BLUE
add name=GUEST
/interface wifi channel
add disabled=no frequency=2412,2437,2462 name=ch-2x width=20mhz
add disabled=no frequency=5180,5260,5500,5765,5825 name=ch-5x \
skip-dfs-channels=all width=20/40/80mhz
/interface wifi datapath
add bridge=bridge1 name=MAIN vlan-id=10
add bridge=bridge1 name=GUEST vlan-id=99
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disabled=no encryption=\
ccmp,ccmp-256 ft=yes ft-over-ds=yes name=Security_MAIN
add authentication-types=wpa2-psk,wpa3-psk disabled=no encryption=\
ccmp,ccmp-256 ft=yes ft-over-ds=yes name=Security_GUEST
/interface wifi configuration
add country=Hungary datapath=MAIN disabled=no mode=ap name=MAIN security=\
Security_MAIN ssid=MAIN_Network
add country=Hungary datapath=GUEST disabled=no mode=ap name=GUEST security=\
Security_GUEST ssid=GUEST_Network
/ip pool
add name=BLUE_POOL ranges=192.168.2.201-192.168.2.240
add name=GUEST_POOL ranges=192.168.6.201-192.168.6.240
add name=GREEN_POOL ranges=10.0.10.201-10.0.10.240
/ip dhcp-server
add address-pool=GUEST_POOL interface=GUEST_VLAN name=GUEST_DHCP
add address-pool=BLUE_POOL interface=BLUE_VLAN name=BLUE_DHCP
add address-pool=GREEN_POOL interface=GREEN_VLAN name=GREEN_DHCP
/interface bridge port
add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged \
interface=ether2 pvid=10
add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged \
interface=ether3 pvid=10
add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged \
interface=ether5 pvid=20
add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged \
interface=ether4 pvid=99
/ip neighbor discovery-settings
set discover-interface-list=BLUE
/ipv6 settings
set disable-ipv6=yes
/interface bridge vlan
add bridge=bridge1 tagged=bridge1 untagged=ether2,ether3 vlan-ids=10
add bridge=bridge1 tagged=bridge1 untagged=ether5 vlan-ids=20
add bridge=bridge1 tagged=bridge1 untagged=ether4 vlan-ids=99
/interface list member
add interface=ether1 list=WAN
add interface=GUEST_VLAN list=VLAN
add interface=BLUE_VLAN list=VLAN
add interface=GREEN_VLAN list=VLAN
add interface=GUEST_VLAN list=GUEST
add interface=BLUE_VLAN list=BLUE
/interface wifi capsman
set enabled=yes interfaces=bridge1 package-path="" require-peer-certificate=\
no upgrade-policy=none
/interface wifi provisioning
add action=create-dynamic-enabled disabled=no master-configuration=MAIN \
slave-configurations=GUEST supported-bands=5ghz-ax,5ghz-ac,5ghz-n,5ghz-a
add action=create-dynamic-enabled disabled=no master-configuration=MAIN \
slave-configurations=GUEST supported-bands=2ghz-n,2ghz-g,2ghz-ax
/ip address
add address=192.168.2.254/24 interface=BLUE_VLAN network=192.168.2.0
add address=192.168.1.225/24 interface=ether1 network=192.168.1.0
add address=192.168.6.254/24 interface=GUEST_VLAN network=192.168.6.0
add address=10.0.10.254/24 interface=GREEN_VLAN network=10.0.10.0
/ip dhcp-server network
add address=10.0.10.0/24 dns-server=10.0.10.254 gateway=10.0.10.254
add address=192.168.2.0/24 dns-server=192.168.2.254,8.8.8.8 gateway=\
192.168.2.254 netmask=24
add address=192.168.6.0/24 dns-server=192.168.6.254,8.8.8.8 gateway=\
192.168.6.254
/ip dns
set servers=8.8.8.8,8.8.4.4
/ip firewall filter
add action=drop chain=input comment="Drop Invalid packets" connection-state=\
invalid
add action=accept chain=input comment="Allow VLAN" in-interface-list=VLAN
add action=accept chain=input disabled=yes dst-address=192.168.1.0/24 \
src-address=192.168.2.0/24
add action=accept chain=input comment="Allow Estab & Related & Untracked" \
connection-state=established,related,untracked
add action=drop chain=input comment="Drop all else" disabled=yes
add action=fasttrack-connection chain=forward comment=Fasttrack \
connection-state=established,related hw-offload=yes
add action=drop chain=forward comment="Drop Invalid Connection" \
connection-state=invalid
add action=accept chain=forward comment="Allow Estab & Related & Untracked" \
connection-state=established,related,untracked
add action=accept chain=forward disabled=yes dst-address=192.168.1.0/24 \
src-address=192.168.2.0/24
add action=accept chain=forward comment="Access Internet from LAN" \
connection-state="" disabled=yes in-interface=bridge1 out-interface=\
ether1
add action=drop chain=forward comment="Drop VLAN inter-VLAN routing" \
in-interface-list=VLAN out-interface-list=VLAN
add action=accept chain=forward comment="VLAN Internet Access only" \
connection-state=new in-interface-list=VLAN out-interface-list=WAN
add action=accept chain=forward comment="Allow port forwarding" \
connection-nat-state=dstnat
add action=drop chain=forward comment="Drop all from WAN not DSTNATed" \
connection-nat-state=!dstnat connection-state=new disabled=yes \
in-interface-list=WAN
add action=drop chain=forward comment="Drop everything else" disabled=yes
/ip firewall nat
add action=accept chain=srcnat disabled=yes dst-address=192.168.1.0/24 \
src-address=192.168.2.0/24
add action=masquerade chain=srcnat disabled=yes out-interface-list=WAN \
src-address=192.168.2.0/24
add action=masquerade chain=srcnat disabled=yes out-interface-list=WAN \
src-address=192.168.6.0/24
add action=masquerade chain=srcnat disabled=yes out-interface-list=WAN \
src-address=10.0.10.0/24
add action=masquerade chain=srcnat out-interface-list=WAN
/ip route
add disabled=no distance=1 dst-address=0.0.0.0/0 gateway=ether1 \
routing-table=main scope=30 suppress-hw-offload=no target-scope=10
add disabled=yes distance=1 dst-address=192.168.1.0/24 gateway=192.168.1.254 \
routing-table=main scope=30 suppress-hw-offload=no target-scope=10
/ip service
set telnet disabled=yes
set ftp disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-name=Europe/Budapest
/system identity
set name=cAP_Controller
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=84.2.46.19
add address=148.6.0.1
Here is cAP ax config but even this is not complete and there may be unnecessary parts in it:
/interface bridge
add name=bridgeLocal
/interface wifi datapath
add bridge=bridgeLocal comment=defconf disabled=no name=capdp
/interface wifi
set [ find default-name=wifi1 ] configuration.manager=capsman .mode=ap \
datapath=capdp disabled=no
set [ find default-name=wifi2 ] configuration.manager=capsman .mode=ap \
datapath=capdp disabled=no
/interface bridge port
add bridge=bridgeLocal comment=defconf interface=ether1
add bridge=bridgeLocal comment=defconf interface=ether2
/interface wifi cap
set caps-man-addresses=192.168.2.254 discovery-interfaces=bridgeLocal \
enabled=yes slaves-datapath=capdp
/ip dhcp-client
add interface=bridgeLocal
/system clock
set time-zone-name=Europe/Budapest
Thank you for your help.
Sorry, does anyone have any ideas or solutions to this problem?
Thanks for your help
When doing VLAN’s, read this topic:
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
Again, create a trunk port for the accesspoint (and configure the accesspoint with VLAN as well).
Use a management VLAN for CAPsMAN communication.
Can I use one of the existing VLANs for monitoring purposes in addition to the original traffic setup or do I need a separate VLAN for this purpose?
I have configured the ether5 port used to connect ax3 and cAP ax to be a member of all VLANs. Is this enough?
This is how CAPsMAN works now but I am not sure if this is the right solution. Do you have any suggestions?
Thank you for your help.