Capsman can't edit CAPs wifi interfaces

[palmighty]

I am new to mikrotik. For starters, I got the RB5009UG, and a cap ax, just one for now. I understand that for 1 AP capsman is overkill, but I wanted to check it out.

The config on the router is literally the default config, bar the pppoe client I added. On the cap ax I reset it to CAP mode, and just added the premade wifi interfaces to the bridge. All works - if I edit the wifi on the CAP (locally managed mode) it works, but if I make them managed by capsman, it rightfully says “Managed by capsman at mac%localBridge traffic processing on CAP”, but on the capsman side It says the following message:

“Operated by CAP mac%bridge, traffic processing on CAP”.

What is that?? What’s the difference between Managed by, and Operated by? And why do they point to each other? CAP says it’s managed by capsman, Capsman side says it’s “operated by” the CAP.

The result is that on the capsman side, I can not edit the wifi - all is greyed out. On the CAP side, i can still edit the wifi, even though the manager is set exclusively to capsman.

Capsman is listening on the one and only router default bridge (all LAN ports), and on CAP side the cap looks for capsman on it’s own localBridge (ether1 + all wifis).

I repeat, the config is more or less default, aside from changes noted above.
For the example below I only made one wifi interface managed by capsman to demonstrate the problem.

Here is how it looks on the cap:

Here is how it looks like on capsman (rb5009):

The config:

2025-02-11 14:18:51 by RouterOS 7.17.2

software id = HS9E-P0TQ

model = RB5009UG+S+

serial number = snip

/caps-man configuration
add channel.band=5ghz-a/n/ac country=snip distance=indoors installation=
indoor mode=ap name=Home5Config security.authentication-types=wpa2-psk
.encryption=aes-ccm ssid=“snip”
/interface bridge
add admin-mac=78:9A:18:C7:91:03 auto-mac=no comment=defconf name=bridge
port-cost-mode=short
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether1 name=pppoe-1
use-peer-dns=yes user=snip
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wifi channel
add band=5ghz-ax disabled=no frequency=5735-5815,5815-5875,5210-5250 name=
5GHz_mix skip-dfs-channels=all width=20/40/80mhz
add band=2ghz-n disabled=no frequency=2412-2467 name=2.4GHz_mix
skip-dfs-channels=all width=20/40mhz
add band=5ghz-ax disabled=no name=5GHz_mix_def
/interface wifi security
add authentication-types=wpa3-psk disabled=no encryption=“” name=
home_secure_wpa3psk
/interface wifi configuration
add channel=5GHz_mix_def country=snip disabled=no manager=capsman mode=ap
name=Home5Config security=home_secure_wpa3psk
security.authentication-types=“” ssid=“snip”
add channel=2.4GHz_mix country=snip disabled=no mode=ap name=Home2.4Config
security=home_secure_wpa3psk ssid=“snip”
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
add name=home-pool ranges=10.0.0.10-10.0.0.254
/ip dhcp-server
add address-pool=home-pool interface=bridge lease-time=10m name=home-dhcp
/caps-man manager
set ca-certificate=WiFi-CAPsMAN-CA-789A18C79102 certificate=
WiFi-CAPsMAN-789A18C79102
/caps-man manager interface
add disabled=no interface=bridge
/interface bridge port
add bridge=bridge comment=defconf interface=ether2 internal-path-cost=10
path-cost=10
add bridge=bridge comment=defconf interface=ether3 internal-path-cost=10
path-cost=10
add bridge=bridge comment=defconf interface=ether4 internal-path-cost=10
path-cost=10
add bridge=bridge comment=defconf interface=ether5 internal-path-cost=10
path-cost=10
add bridge=bridge comment=defconf interface=ether6 internal-path-cost=10
path-cost=10
add bridge=bridge comment=defconf interface=ether7 internal-path-cost=10
path-cost=10
add bridge=bridge comment=defconf interface=ether8 internal-path-cost=10
path-cost=10
add bridge=bridge comment=defconf interface=sfp-sfpplus1 internal-path-cost=
10 path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=pppoe-1 list=WAN
/interface ovpn-server server
add mac-address=FE:E6:6D:BD:99:C2 name=ovpn-server1
/interface wifi cap
set discovery-interfaces=LAN
/interface wifi capsman
set enabled=yes interfaces=LAN package-path=“” require-peer-certificate=no
upgrade-policy=none
/interface wifi provisioning
add action=create-dynamic-enabled disabled=yes master-configuration=
Home5Config radio-mac=D4:01:C3:F8:18:66 supported-bands=5ghz-ax
add action=create-dynamic-enabled disabled=no master-configuration=
Home2.4Config radio-mac=D4:01:C3:F8:18:67 supported-bands=2ghz-n
/ip address
add address=192.168.88.1/24 comment=defconf disabled=yes interface=bridge
network=192.168.88.0
add address=10.0.0.1/24 interface=bridge network=10.0.0.0
/ip dhcp-client
add comment=defconf disabled=yes interface=ether1
/ip dhcp-server lease
add address=10.0.0.2 client-id=1:d4:1:c3:f8:18:64 mac-address=
D4:01:C3:F8:18:64 server=home-dhcp
/ip dhcp-server network
add address=10.0.0.0/24 dns-server=10.0.0.1 gateway=10.0.0.1
/ip dns
set allow-remote-requests=yes cache-size=30480KiB
/ip dns adlist
add ssl-verify=no url=“> https://raw.githubusercontent.com/hagezi/dns-blocklists>
/main/hosts/pro.txt”
/ip dns static
add address=10.0.0.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=accept chain=input comment=
“defconf: accept established,related,untracked” connection-state=
established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=
invalid
add action=accept chain=input comment=“defconf: accept ICMP” protocol=icmp
add action=accept chain=input comment=
“defconf: accept to local loopback (for CAPsMAN)” dst-address=127.0.0.1
add action=drop chain=input comment=“defconf: drop all not coming from LAN”
in-interface-list=!LAN
add action=accept chain=forward comment=“defconf: accept in ipsec policy”
ipsec-policy=in,ipsec
add action=accept chain=forward comment=“defconf: accept out ipsec policy”
ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment=“defconf: fasttrack”
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=
“defconf: accept established,related, untracked” connection-state=
established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid”
connection-state=invalid
add action=drop chain=forward comment=
“defconf: drop all from WAN not DSTNATed” connection-nat-state=!dstnat
connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment=“defconf: masquerade”
ipsec-policy=out,none out-interface-list=WAN
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip smb shares
set [ find default=yes ] directory=flash/pub
/ipv6 firewall address-list
add address=::/128 comment=“defconf: unspecified address” list=bad_ipv6
add address=::1/128 comment=“defconf: lo” list=bad_ipv6
add address=fec0::/10 comment=“defconf: site-local” list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment=“defconf: ipv4-mapped” list=bad_ipv6
add address=::/96 comment=“defconf: ipv4 compat” list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment=“defconf: documentation” list=bad_ipv6
add address=2001:10::/28 comment=“defconf: ORCHID” list=bad_ipv6
add address=3ffe::/16 comment=“defconf: 6bone” list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=
“defconf: accept established,related,untracked” connection-state=
established,related,untracked
add action=drop chain=input comment=“defconf: drop invalid” connection-state=
invalid
add action=accept chain=input comment=“defconf: accept ICMPv6” protocol=
icmpv6
add action=accept chain=input comment=“defconf: accept UDP traceroute” port=
33434-33534 protocol=udp
add action=accept chain=input comment=
“defconf: accept DHCPv6-Client prefix delegation.” dst-port=546 protocol=
udp src-address=fe80::/10
add action=accept chain=input comment=“defconf: accept IKE” dst-port=500,4500
protocol=udp
add action=accept chain=input comment=“defconf: accept ipsec AH” protocol=
ipsec-ah
add action=accept chain=input comment=“defconf: accept ipsec ESP” protocol=
ipsec-esp
add action=accept chain=input comment=
“defconf: accept all that matches ipsec policy” ipsec-policy=in,ipsec
add action=drop chain=input comment=
“defconf: drop everything else not coming from LAN” in-interface-list=
!LAN
add action=accept chain=forward comment=
“defconf: accept established,related,untracked” connection-state=
established,related,untracked
add action=drop chain=forward comment=“defconf: drop invalid”
connection-state=invalid
add action=drop chain=forward comment=
“defconf: drop packets with bad src ipv6” src-address-list=bad_ipv6
add action=drop chain=forward comment=
“defconf: drop packets with bad dst ipv6” dst-address-list=bad_ipv6
add action=drop chain=forward comment=“defconf: rfc4890 drop hop-limit=1”
hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment=“defconf: accept ICMPv6” protocol=
icmpv6
add action=accept chain=forward comment=“defconf: accept HIP” protocol=139
add action=accept chain=forward comment=“defconf: accept IKE” dst-port=
500,4500 protocol=udp
add action=accept chain=forward comment=“defconf: accept ipsec AH” protocol=
ipsec-ah
add action=accept chain=forward comment=“defconf: accept ipsec ESP” protocol=
ipsec-esp
add action=accept chain=forward comment=
“defconf: accept all that matches ipsec policy” ipsec-policy=in,ipsec
add action=drop chain=forward comment=
“defconf: drop everything else not coming from LAN” in-interface-list=
!LAN
/system clock
set time-zone-name=snip
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

[holvoetn]

It looks like you’re using the wrong capsman manager.
Uninstall wireless package from RB5009.

And follow instructions, since everything is to be done under Wifi menu structure:
https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-WiFiCAPsMAN

[palmighty]

I just did that. Deleted the wireless package. Now RB5009 has only routeros 7.17.2. CAP has the same routeros version and also wifi-qcom 7.17.2. The issue persists, RB5009 capsman says operated by CAP.

EDIT: on RB5009 capsman, I can see the radio, and I can provision the config. It updates the wifi interface with the new config but only on the Capsman side (still all greyed out, but e.g. new SSID is set). However the provisioning is not communicated to the CAP, and it still has the old config and ssid.

[erlinden]

It says exactly what it should. The interface “operated by CAP:MAC” shows which device (CAP) and which interface (MAC) it is.
Traffic processing on CAP might be some legacy (in the old CAPsMAN world, one could choose between two options: local or capsman).

Any adjustments should be done on the CAPsMAN, reset the CAP to CAPS Mode and everything is done there. Well…unless you wnat to do some complex VLAN config.

TLDR: You are just fine.

[palmighty]

You’re right… It is actually the CAP that shows outdated SSID, not the CAPSMAN. My phone shows the SSID has changed. Okay so provisioning configs from rb5009 works.

But I am unable to control the interfaces directly from capsman.
When I try to edit some option directly, not by provisioning, double clicking the interface, the menu looks like this:

(e.g. cant disable wifi, cant change bound config, or anything below for that matter)

Is this direct editing intentionally forbidden or something misconfigured on my side?

[holvoetn]

You have to change configuration.
And theoretically it should reprovision automatically but I always do it manually.

[erlinden]

And theoretically it should reprovision automatically but I always do it manually.

How do you trigger provisioning? I know that by performing a scan or disable/enable the interface on the CAP it is triggered. Also by pressing the provision button, but I red that that is only to register the CAPS (not for performing manual provision).

@palmighty:
You shouldn’t change settings directly on the interface. But if you want to any way, you should use “create-enabled” instead of “create-dynamic-enabled”:
https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-CAPsMANProvisioning

[holvoetn]

And theoretically it should reprovision automatically but I always do it manually.

How do you trigger provisioning? I know that by performing a scan or disable/enable the interface on the CAP it is triggered. Also by pressing the provision button, but I red that that is only to register the CAPS (not for performing manual provision).

Radios or Remote Cap tab, select required lines and hit "Provision". As simple as that.
For my setups it is quite easy since I use provisioning rules PER RADIO, so I know which ones to reprovision when needed.
I am aware quite a while ago Guntis mentioned this was not needed but I am sorry to say it is.

v7.16rc [testing] is released!

If there are examples where configuration was changed, but CAPs didn’t reflect the change, please let us know, and share with us supout.rif files from both CAP and CAPsMAN, they should be made before manual “provision” is performed to fix the issue. If you don’t explicitly configure reselect-interval no automatic rescan will take place, unless interface goes down - CAP-CAPsMAN communication was interrupted, restart, etc. Reselect-interval uses a background scan.

Otherwise it takes way too long before I see changes being populated.
And I am not alone with that observation.

[palmighty]

All is clear now, working as intended. Thank you kindly!