CAPsMAN datapath VLAN – DHCP offers not delivered to clients after upgrade to ROS 7.19.x

Sergey-s · August 25, 2025, 12:02pm

Hello,

After upgrading to RouterOS 7.19.x (tested with 7.19.4), DHCP clients connected via CAPsMAN with VLAN datapath stopped receiving IP addresses.

Setup:
- CAPsMAN controller: CCR2004-16G-2S+, RouterOS 7.19.4
- CAP devices: Mikrotik cAP ax, tested with 7.19.4 and downgraded to 7.17.2
- Guest WiFi is bridged through VLAN ID 2, handled via CAPsMAN datapath (no local forwarding, traffic terminates on controller bridge with VLAN filtering).
- DHCP server is running on the controller (bridge with VLAN filtering configured).
Problem:
- On CAP devices running 7.19.x, DHCP server logs show:

dhcp2 offering lease 192.168.200.xxx for XX:XX:XX:XX:XX:XX without success

- Clients remain in “offered” state and never receive an IP.
- If the same CAP devices are downgraded to 7.17.2, DHCP works normally without changing the configuration.
Conclusion:
- This issue appears only on CAP devices upgraded to 7.19.x.
- The controller can run on 7.19.4 without problems, but CAPs must stay on 7.17.2 for DHCP to function.

Could you please confirm if this is a known bug in 7.19.x CAPsMAN datapath VLAN handling?
Is a fix expected in upcoming releases (7.20/7.21)?

erlinden · August 25, 2025, 12:56pm

Strange, no problems with this version. From what version did you come?
Could you share the CAPsMAN config?

/export file=anynameyoulike
Remove serial and any other private info, post as Preformatted text by using the </> button.

From your limited information, I guess you are doing VLAN halve: partly VLAN and partly not.

Sergey-s · August 25, 2025, 2:11pm

/interface bridge
add arp=proxy-arp name=bridge-lan vlan-filtering=yes
add name=bridge-video vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] 
set [ find default-name=ether2 ] 
set [ find default-name=ether9 ] 
set [ find default-name=ether10 ]
set [ find default-name=ether11 ]
set [ find default-name=ether12 ] 
set [ find default-name=ether13 ] comment="Wi-Fi AP"
set [ find default-name=ether14 ] comment="Wi-Fi AP"
set [ find default-name=ether15 ] 
set [ find default-name=ether16 ] 
set [ find default-name=sfp-sfpplus1 ] disabled=yes
set [ find default-name=sfp-sfpplus2 ] disabled=yes
/interface vlan
add interface=bridge-lan name=vlan-guest vlan-id=2
/interface wifi channel
add band=5ghz-ax disabled=no frequency=5180 name=5G-AX width=20/40mhz-Ce
add band=2ghz-n disabled=no frequency=2412 name=2G-AX width=20/40mhz-Ce
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disable-pmkid=yes disabled=no ft=\
    yes ft-over-ds=yes group-encryption=ccmp group-key-update=5m \
    management-encryption=cmac management-protection=required name=\
    sec2G-equipment
add authentication-types=wpa2-psk,wpa3-psk disable-pmkid=yes disabled=no ft=\
    yes ft-over-ds=yes group-encryption=ccmp group-key-update=5m \
    management-encryption=cmac management-protection=required name=\
    sec5G-equipment
add authentication-types=wpa2-psk,wpa3-psk disable-pmkid=yes disabled=no ft=\
    yes ft-over-ds=yes group-encryption=ccmp group-key-update=5m \
    management-encryption=cmac management-protection=required name=\
    sec2G-Guest
add authentication-types=wpa2-psk,wpa3-psk disable-pmkid=yes disabled=no ft=\
    yes ft-over-ds=yes group-encryption=ccmp group-key-update=5m \
    management-encryption=cmac management-protection=required name=\
    sec5G-Guest
/interface wifi configuration
add channel=5G-AX datapath.bridge=bridge-lan .vlan-id=2 disabled=no mode=ap \
    name=cfg-5G-Guset security=sec5G-Guest security.ft=yes .ft-over-ds=yes \
    ssid=Guest-5G
add channel=2G-AX datapath.bridge=bridge-lan .vlan-id=2 disabled=no mode=ap \
    name=cfg-2G-Guset security=sec2G-Guest security.ft=yes .ft-over-ds=yes \
    ssid=Guest-2G
add channel=5G-AX disabled=no mode=ap name=cfg-5G-Equipment security=\
    sec5G-equipment security.ft=yes .ft-over-ds=yes ssid=Equipment-5G
add channel=2G-AX disabled=no mode=ap name=cfg-2G-Equipment security=\
    sec2G-equipment security.ft=yes .ft-over-ds=yes ssid=Equipment-2G
/interface wifi steering
add disabled=no name=steering1 rrm=yes wnm=yes
/ip pool
add name=dhcp_pool0 ranges=10.33.0.20-10.33.0.254
add name=dhcp_pool1 ranges=192.168.200.20-192.168.200.254
add name=dhcp_pool2 ranges=192.168.200.2-192.168.200.254
/ip dhcp-server
add address-pool=dhcp_pool0 interface=bridge-lan name=dhcp1
add address-pool=dhcp_pool2 interface=vlan-guest name=dhcp2
/port
set 0 name=serial0
/certificate settings
set builtin-trust-anchors=not-trusted
/interface bridge port
add bridge=bridge-lan interface=ether3
add bridge=bridge-lan interface=ether4
add bridge=bridge-lan interface=ether5
add bridge=bridge-lan interface=ether6
add bridge=bridge-lan interface=ether7
add bridge=bridge-lan interface=ether8
add bridge=bridge-lan interface=ether9
add bridge=bridge-lan interface=ether10
add bridge=bridge-lan interface=ether11
add bridge=bridge-lan interface=ether12
add bridge=bridge-lan interface=ether13
add bridge=bridge-lan interface=ether14
add bridge=bridge-lan interface=ether15
add bridge=bridge-video interface=ether16
add bridge=bridge-lan interface=ether2 pvid=2
# vlan interface already configured on bridge
add bridge=bridge-lan interface=vlan-guest pvid=2
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/interface bridge vlan
add bridge=bridge-lan tagged=bridge-lan,vlan-guest,ether13,ether14 vlan-ids=2
/interface l2tp-server server
set use-ipsec=yes
/interface wifi cap
set discovery-interfaces=bridge-lan
/interface wifi capsman
set enabled=yes interfaces=bridge-lan package-path="" \
    require-peer-certificate=no upgrade-policy=none
/interface wifi provisioning
add action=create-dynamic-enabled disabled=no master-configuration=\
    cfg-2G-Equipment slave-configurations=cfg-2G-Guset supported-bands=\
    2ghz-ax
add action=create-dynamic-enabled disabled=no master-configuration=\
    cfg-5G-Equipment slave-configurations=cfg-5G-Guset supported-bands=\
    5ghz-ax
add action=create-dynamic-enabled disabled=no master-configuration=\
    cfg-2G-Guset supported-bands=2ghz-ax
add action=create-dynamic-enabled disabled=no master-configuration=\
    cfg-5G-Guset supported-bands=5ghz-ax
/ip address
add address=10.33.0.1/24 comment=Local interface=bridge-lan network=10.33.0.0
add address=10.35.0.1/24 comment=Video interface=bridge-video network=\
    10.35.0.0
add address=192.168.200.1/24 comment=Guest interface=vlan-guest network=\
    192.168.200.0

/interface bridge
add name=bridge1 vlan-filtering=yes
/interface ethernet
set [ find default-name=ether2 ] disabled=yes
/interface wifi datapath
add bridge=bridge1 disabled=no name=datapath1
/interface wifi
# managed by CAPsMAN F4:1E:57:3E:1B:EB%bridge1, traffic processing on CAP
# mode: AP, SSID: Equipment-5G, channel: 5180/ax/Ce/I
set [ find default-name=wifi1 ] configuration.manager=capsman .mode=ap \
    datapath=datapath1 datapath.bridge=bridge1 disabled=no
# managed by CAPsMAN F4:1E:57:3E:1B:EB%bridge1, traffic processing on CAP
# mode: AP, SSID: Equipment-2G, channel: 2412/n/Ce
set [ find default-name=wifi2 ] configuration.manager=capsman .mode=ap \
    datapath=datapath1 datapath.bridge=bridge1 disabled=no
# managed by CAPsMAN F4:1E:57:3E:1B:EB%bridge1, traffic processing on CAP
# mode: AP, SSID: Guest-2G
add datapath=datapath1 disabled=no mac-address=D6:01:C3:BF:65:0D \
    master-interface=wifi2 name=wifi3
# managed by CAPsMAN F4:1E:57:3E:1B:EB%bridge1, traffic processing on CAP
# mode: AP, SSID: Guest-5G
add datapath=datapath1 disabled=no mac-address=D6:01:C3:BF:65:0C \
    master-interface=wifi1 name=wifi4
/interface bridge port
add bridge=bridge1 interface=wifi1
add bridge=bridge1 interface=wifi2
add bridge=bridge1 interface=ether1
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/interface bridge vlan
add bridge=bridge1 tagged=bridge1,ether1 untagged=wifi3,wifi4 vlan-ids=2
/interface wifi cap
set caps-man-addresses=10.33.0.1 discovery-interfaces=bridge1 enabled=yes \
    slaves-datapath=datapath1 slaves-static=yes
/ip dhcp-client
add interface=bridge1
/ip service
set telnet disabled=yes
set ftp disabled=yes
set www disabled=yes
set ssh disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/system clock
set time-zone-name=Asia/Bangkok
/system identity
set name=AP-TH-01
/system note
set show-at-login=no

mkx · August 25, 2025, 5:57pm

Lots of setup on CAPsMAN device, related to vlan-guest interface, is crap. ROS even shows you that with a comment in section /interface/bridge/port (but it's not limited to that section). That kind of config was never ever correct, but recent ROS versions changed some VLAN config handling (some automagic added, some invalid settings detected), which might caused your setup to fail while it previously somehow miraculously worked.

erlinden · August 25, 2025, 6:08pm

One of the changes is that you don't add wifi interfaces to the bridge on the CAP. Also, you don't set VLAN (untagged) on the wifi interface on the CAP.

I think the documentation is describing perfecly:
WiFi - RouterOS - MikroTik Documentation

Also, you might want to go VLAN all the way (and no longer use a DHCP server on the bridge):

gwindalmir · September 17, 2025, 2:16am

I've noticed the same issue over the last two days, but I'm not using CAPsMAN. I do, however, have VLANs setup.
RouterOS was running fine for 42 days, then I started seeing dozens of "offering lease ... without success" messages every hour, and devices lose connectivity.

One affected IP is 172.20.0.252, which is my wireless AP (non-mikrotik). If I power cycle the PoE port it's on (located on another switch), then it works fine for a day (when the lease expires).

The config was too large to paste here, so I have it here: https://pastebin.com/p8cjwMuq