Hello all,
I struggle with configuring CAPSMAN, multiple SSIDs and proper VLAN tagging when connecting to a particular SSID on the main router - as if the VLAN in datapath is not taken into consideration.
I have wAPG-5HaxD2HaxD (AP) serving as a CAPSMAN server. I have L009UiGS-2HaxD acting as a main router (i.e. DHCP, gateway to the internet etc.). AP and Main Router are interconnected through RB2011 using LACP bonding.
The topology can be visualized as follows:
[wAPG-5HaxD2HaxD] (CAPSMAN SERVER) ---------- [RB 2011] ---------- [L009UiGS-2HaxD] (MAIN ROUTER, DHCP, …)
AP and main router run on 7.20.4, RB2011 on 7.19.4. Suggestions to improve the config overall are welcomed.
When I connect to one of the three SSIDs on the access point, I get proper IP address from DHCP from correct range. However, when I try connecting to main router, I am associated to a particular WLAN without getting an IP address. I suspect main router not respecting the individual VLANs configured for individual SSIDs in DataPaths on the CAPSMAN. The virtual interfaces representing individual SSIDs on the main router have PVID=1 and I can't edit that, it's hard-coded. Only and only when I disable main router being CAPSMAN client and configure WLAN interface on the main router with proper VLAN, I am able to get an IP address when connecting to the main router.
Why does not the main router respect the VLAN that is being defined in individual datapaths? Please have mercy as I am in the process of learning Mikrotik.
Configurations of AP, RB2011 (acting as a switch here) and main router follow:
Access point's (wAPG-5HaxD2HaxD) config
/interface bridge
add name=BridgeLAN vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] advertise=100M-baseT-full,1G-baseT-full,1G-baseX
set [ find default-name=ether2 ] advertise=100M-baseT-full,1G-baseT-full,1G-baseX
/interface vlan
add interface=BridgeLAN name=vlan238-management vlan-id=238
/interface bonding
add mode=802.3ad name=UPLINK-AH-office-rb2011 slaves=ether1,ether2 transmit-hash-policy=layer-3-and-4
/interface list
add name=WLANDSVCInternal
add name=WLANDSVCMobile
add name=WLANDSVCGuest
/interface wifi channel
add band=5ghz-ax comment="channels safe for indoor, non-military use" disabled=no frequency=5180,5200,5220,5240 name="non-DFS channels 5GHZ" skip-dfs-channels=all width=20/40/80mhz
add band=2ghz-ax disabled=no frequency=2412 name="2GHz CH1" width=20mhz
add band=2ghz-ax disabled=no frequency=2462,2437 name="2GHZ CH11,CH6" width=20mhz
add band=2ghz-ax disabled=no frequency=2412,2437,2462 name=2GHZ::AUTO width=20mhz
add band=5ghz-ax disabled=no frequency=5180,5200,5220,5240 name=5GHZ::UNII-1 width=20mhz
add band=5ghz-ax disabled=no frequency=5745,5765,5785,5805,5825 name=5GHZ::UNII-3 width=20mhz
add band=5ghz-ax disabled=no frequency=5180,5200,5220,5240,5745,5765,5785,5805,5825 name=5GHZ::NON-DFS width=20mhz
add band=2ghz-ax disabled=no frequency=2437 name="2GHz CH6" width=20mhz
/interface wifi datapath
add bridge=BridgeLAN disabled=no name=datapath-wlan-office-internal-vl237 vlan-id=237
add bridge=BridgeLAN disabled=no name=datapath-wlan-mobile-vl236 vlan-id=236
add bridge=BridgeLAN client-isolation=no disabled=no name=datapath-wlan-guest-vl241 vlan-id=241
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disabled=no encryption=ccmp,gcmp,ccmp-256,gcmp-256 ft=yes ft-mobility-domain=0x5596 name=sec-dsvc
/interface wifi configuration
add channel="2GHz CH1" country=Czech datapath=datapath-wlan-office-internal-vl237 datapath.vlan-id=237 disabled=no hide-ssid=no installation=indoor mode=ap name="2GHz DSVC CH1" security=sec-dsvc ssid=DSVC
add channel=5GHZ::UNII-1 country=Czech datapath=datapath-wlan-office-internal-vl237 datapath.vlan-id=237 disabled=no hide-ssid=no installation=indoor mode=ap name="5ghz DSVC" security=sec-dsvc security.ft=no ssid=DSVC
add channel="2GHZ CH11,CH6" country=Czech datapath=datapath-wlan-office-internal-vl237 datapath.vlan-id=237 disabled=no hide-ssid=no installation=indoor mode=ap name="2GHz DSVC CH6,11" security=sec-dsvc security.ft=no ssid=DSVC
add channel="2GHZ CH11,CH6" country=Czech datapath=datapath-wlan-office-internal-vl237 disabled=yes mode=ap name=2GHz::AUTO security=sec-dsvc ssid=DSVC
add country=Czech datapath=datapath-wlan-mobile-vl236 disabled=no installation=indoor mode=ap name=DSVCMobile security=sec-dsvc ssid=DSVCMobile
add country=Czech datapath=datapath-wlan-guest-vl241 datapath.vlan-id=241 disabled=no installation=indoor mode=ap name=DSCVCGuest security=sec-dsvc ssid=DSVCGuest
/interface bridge port
add bridge=BridgeLAN interface=UPLINK-AH-office-rb2011
add bridge=BridgeLAN disabled=yes interface=WLANDSVCInternal pvid=237
add bridge=BridgeLAN disabled=yes interface=WLANDSVCGuest pvid=241
add bridge=BridgeLAN disabled=yes interface=WLANDSVCMobile pvid=236
/interface bridge vlan
add bridge=BridgeLAN tagged=UPLINK-AH-office-rb2011 vlan-ids=236
add bridge=BridgeLAN tagged=UPLINK-AH-office-rb2011 vlan-ids=240
add bridge=BridgeLAN tagged=UPLINK-AH-office-rb2011 vlan-ids=237
add bridge=BridgeLAN tagged=UPLINK-AH-office-rb2011 vlan-ids=238
add bridge=BridgeLAN tagged=UPLINK-AH-office-rb2011 vlan-ids=241
/interface wifi access-list
add action=reject disabled=no signal-range=-120..-64
add action=accept disabled=no signal-range=-64..120
/interface wifi cap
set caps-man-addresses=192.168.238.2 certificate=request discovery-interfaces=vlan238-management enabled=yes
/interface wifi capsman
set ca-certificate=auto certificate=auto enabled=yes interfaces=vlan238-management package-path="" require-peer-certificate=no upgrade-policy=none
/interface wifi provisioning
add action=create-dynamic-enabled disabled=no master-configuration="2GHz DSVC CH1" radio-mac=04:F4:1C:64:B6:D2 slave-configurations=DSVCMobile,DSCVCGuest supported-bands=2ghz-ax
add action=create-dynamic-enabled disabled=no master-configuration="5ghz DSVC" radio-mac=04:F4:1C:64:B6:D3 slave-configurations=DSVCMobile,DSCVCGuest supported-bands=5ghz-ax
add action=create-dynamic-enabled disabled=no master-configuration="2GHz DSVC CH6,11" radio-mac=04:F4:1C:11:84:AE slave-configurations=DSCVCGuest,DSVCMobile supported-bands=2ghz-ax
/ip address
add address=192.168.238.2/24 interface=vlan238-management network=192.168.238.0
/ip firewall filter
add action=accept chain=input
add action=accept chain=forward
add action=accept chain=output
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=192.168.238.1 routing-table=main suppress-hw-offload=no
/system identity
set name=AP-AH-Office
/system ntp client
set enabled=yes
/system ntp client servers
add address=0.pool.ntp.org
RB 2011's config
/interface bridge
add name=BridgeLAN vlan-filtering=yes
/interface wireless
set [ find default-name=wlan1 ] ssid=MikroTik
/interface ethernet
set [ find default-name=ether1 ] advertise=100M-baseT-full,100M-baseFX-full,1G-baseT-full rx-flow-control=auto tx-flow-control=auto
set [ find default-name=ether2 ] advertise=100M-baseT-full,1G-baseT-full,1G-baseX
set [ find default-name=ether3 ] advertise=100M-baseT-full,1G-baseT-full
set [ find default-name=ether6 ] advertise=100M-baseT-full,100M-baseFX-full,1G-baseT-full,1G-baseX
set [ find default-name=ether9 ] advertise=100M-baseT-full,1G-baseT-full,1G-baseX
set [ find default-name=ether10 ] advertise=100M-baseT-full,1G-baseT-full,1G-baseX disabled=yes
/interface vlan
add interface=BridgeLAN name=vlan238-management vlan-id=238
/interface bonding
add mode=802.3ad name=LinkAPAHOffice slaves=ether3,ether4 transmit-hash-policy=layer-3-and-4
add mode=802.3ad name=UplinkMainRouter slaves=ether2,ether1 transmit-hash-policy=layer-3-and-4
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/port
set 0 name=serial0
/interface bridge port
add bridge=BridgeLAN interface=LinkAPAHOffice
add bridge=BridgeLAN interface=UplinkMainRouter
add bridge=BridgeLAN interface=ether6
add bridge=BridgeLAN interface=ether5
add bridge=BridgeLAN interface=ether7
add bridge=BridgeLAN interface=ether8
add bridge=BridgeLAN interface=ether9
add bridge=BridgeLAN interface=ether10
/interface bridge vlan
add bridge=BridgeLAN tagged=LinkAPAHOffice,UplinkMainRouter vlan-ids=240
add bridge=BridgeLAN tagged=LinkAPAHOffice,UplinkMainRouter vlan-ids=236
add bridge=BridgeLAN tagged=LinkAPAHOffice,UplinkMainRouter vlan-ids=237
add bridge=BridgeLAN tagged=LinkAPAHOffice,UplinkMainRouter untagged=ether10 vlan-ids=238
add bridge=BridgeLAN tagged=LinkAPAHOffice,UplinkMainRouter vlan-ids=241
/ip address
add address=192.168.238.3/24 interface=vlan238-management network=192.168.238.0
/ip dns
set servers=192.168.240.110,8.8.8.8
/ip firewall filter
add action=accept chain=forward
add action=accept chain=input
add action=accept chain=output
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=192.168.238.1 routing-table=main suppress-hw-offload=no
/lcd interface pages
set 0 interfaces=sfp1,ether1,ether2,ether3,ether4,ether5,ether6,ether7,ether8,ether9,ether10
/system clock
set time-zone-name=Europe/Prague
Main router's config:
/interface bridge
add arp=proxy-arp name=BridgeLAN vlan-filtering=yes
/interface ethernet
set [ find default-name=ether3 ] advertise=\
100M-baseT-full,100M-baseFX-full,1G-baseT-full,1G-baseX
set [ find default-name=ether4 ] advertise=\
100M-baseT-full,100M-baseFX-full,1G-baseT-full,1G-baseX
/interface vlan
add interface=BridgeLAN name=vlan236-vlan-mobile vlan-id=236
add interface=BridgeLAN name=vlan237-wlan-office vlan-id=237
add interface=BridgeLAN name=vlan238-management vlan-id=238
add interface=BridgeLAN name=vlan239-servers vlan-id=239
add arp=proxy-arp interface=BridgeLAN name=vlan240-clients vlan-id=240
add interface=BridgeLAN name=vlan241-vlan-guest vlan-id=241
/interface bonding
add mode=802.3ad name="LACP AH office infra corner" slaves=ether3,ether4 \
transmit-hash-policy=layer-3-and-4
add mode=802.3ad name="LACP SW Zyxel" slaves=ether1,ether2 \
transmit-hash-policy=layer-3-and-4
/interface list
add name=LAN
add name=WAN
add name=VPN
add name=WLANDSVCInternal
add name=WLANDSVCMobile
add name=WLANDSVCGuest
/interface wifi channel
add band=2ghz-ax disabled=no frequency=2412,2437 name=CH1 width=20mhz
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disabled=no encryption=\
ccmp,gcmp,ccmp-256,gcmp-256 ft=yes ft-mobility-domain=0x5596 name=dsvc_sec
/interface wifi configuration
add channel=CH1 channel.band=2ghz-ax country=Czech datapath.bridge=BridgeLAN \
disabled=no hide-ssid=no installation=indoor mode=ap name=\
"DSVC Main Router" security=dsvc_sec security.ft=no ssid=DSVC
/interface wifi
set [ find default-name=wifi1 ] configuration="DSVC Main Router" \
configuration.country=Czech .manager=local .mode=ap datapath.bridge=\
BridgeLAN disabled=no
/ip pool
add comment="DHCP Pool LAN clients" name=dhcp_pool_LAN ranges=\
192.168.240.20-192.168.240.95
add comment="Pool 4 VPN" name=VPN ranges=192.168.240.215-192.168.240.245
add comment="VLAN cell phones" name="VLAN WLAN Mobile" ranges=\
192.168.236.10-192.168.236.100
add comment="VLAN WLAN Office (notebooks, ...)" name="VLAN WLAN Office" ranges=\
192.168.237.10-192.168.237.100
add name="VLAN WLAN Guest" ranges=192.168.241.10-192.168.241.100
add name="VLAN 238 MANAGEMENT" ranges=192.168.238.10-192.168.238.20
/ip dhcp-server
add address-pool=dhcp_pool_LAN comment=dhcp-LAN interface=vlan240-clients \
lease-time=4h name="DHCP LAN"
add address-pool="VLAN WLAN Office" comment=::dhcp-WLAN-Office interface=\
vlan237-wlan-office lease-time=4h name=dhcp-WLAN-Office
add address-pool="VLAN WLAN Mobile" comment=dhcp-WLAN-mobile interface=\
vlan236-vlan-mobile lease-time=4h name=DHCP-WLAN-Mobile
add address-pool="VLAN 238 MANAGEMENT" interface=vlan238-management name=\
DHCP-VLAN238
add address-pool="VLAN WLAN Guest" interface=vlan241-vlan-guest lease-time=2h \
name=dhcp-WLAN-Guest
/port
set 0 name=serial0
/ppp profile
add bridge=BridgeLAN bridge-learning=yes bridge-port-vid=240 dns-server=\
192.168.240.110,1.1.1.1 interface-list=VPN local-address=192.168.240.1 \
name=l2tp-profile-1 on-down=s remote-address=VPN use-ipv6=no
/system logging action
set 0 memory-lines=10000
/interface bridge port
add bridge=BridgeLAN interface=ether5 pvid=238
add bridge=BridgeLAN interface=ether6 pvid=240
add bridge=BridgeLAN interface=ether7
add bridge=BridgeLAN interface="LACP SW Zyxel"
add bridge=BridgeLAN interface=wifi1 pvid=237
add bridge=BridgeLAN interface="LACP AH office infra corner"
add bridge=BridgeLAN interface=dynamic
add bridge=BridgeLAN interface=VPN pvid=240
/ip firewall connection tracking
set enabled=yes udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=all
/interface bridge vlan
add bridge=BridgeLAN tagged="LACP AH office infra corner" vlan-ids=236
add bridge=BridgeLAN tagged="LACP AH office infra corner" untagged=wifi1 \
vlan-ids=237
add bridge=BridgeLAN tagged="LACP AH office infra corner,LACP SW Zyxel" \
untagged=ether5 vlan-ids=238
add bridge=BridgeLAN tagged="LACP AH office infra corner" vlan-ids=239
add bridge=BridgeLAN tagged="LACP AH office infra corner,LACP SW Zyxel" \
untagged=ether6,VPN vlan-ids=240
add bridge=BridgeLAN tagged="LACP AH office infra corner" vlan-ids=241
/interface detect-internet
set detect-interface-list=all
/interface l2tp-server server
set authentication=mschap1,mschap2 default-profile=l2tp-profile-1 enabled=yes \
use-ipsec=yes
/interface list member
add interface=ether2 list=LAN
add interface=ether5 list=LAN
add interface=ether6 list=LAN
add interface=ether7 list=LAN
add interface=lo list=LAN
add interface=wifi1 list=LAN
add interface="LACP SW Zyxel" list=LAN
add interface=ether1 list=LAN
add interface="LACP AH office infra corner" list=LAN
/interface wifi access-list
add action=reject disabled=no signal-range=-120..-55
add action=accept disabled=no signal-range=-54..120
/interface wifi cap
set caps-man-addresses=192.168.238.2 certificate=request discovery-interfaces=\
vlan238-management
/interface wifi capsman
set package-path="" require-peer-certificate=no upgrade-policy=none
/ip address
add address=<redacted>/24 interface=ether8 network=<redacted>
add address=192.168.240.1/24 interface=vlan240-clients network=192.168.240.0
add address=192.168.236.1/24 interface=vlan236-vlan-mobile network=\
192.168.236.0
add address=192.168.241.1/24 interface=vlan241-vlan-guest network=192.168.241.0
add address=192.168.237.1/24 interface=vlan237-wlan-office network=\
192.168.237.0
add address=192.168.238.1/24 interface=vlan238-management network=192.168.238.0
add address=192.168.239.1/24 interface=vlan239-servers network=192.168.239.0
/ip dhcp-client
add disabled=yes interface=ether1
add default-route-tables=main disabled=yes interface=ether8
add add-default-route=no default-route-tables=main interface=\
vlan237-wlan-office
/ip dhcp-server lease
add address=192.168.240.110 comment="DNS server" mac-address=B8:AE:ED:D8:8C:AC
/ip dhcp-server network
add address=192.168.236.0/24 dns-server=\
192.168.240.110,1.1.1.1,9.9.9.9,8.8.8.8,8.8.4.4 gateway=192.168.236.1 \
netmask=24 ntp-server=176.118.170.235,195.113.144.201
add address=192.168.237.0/24 dns-server=\
192.168.240.110,9.9.9.9,1.1.1.1,8.8.8.8,8.8.4.4 gateway=192.168.237.1 \
netmask=24 ntp-server=176.118.170.235,188.124.59.142,195.113.144.201
add address=192.168.238.0/24 dns-server=\
192.168.240.110,1.1.1.1,9.9.9.9,8.8.8.8,8.8.4.4 gateway=192.168.238.1 \
netmask=24 ntp-server=195.113.144.201,176.118.170.235
add address=192.168.239.0/24 dns-server=\
192.168.240.110,1.1.1.1,8.8.8.8,9.9.9.9,8.8.4.4 gateway=192.168.239.1 \
netmask=24 ntp-server=176.118.170.235,195.113.144.201
add address=192.168.240.0/24 dns-server=\
192.168.240.110,192.168.139.2,208.67.222.222,1.1.1.1,8.8.4.4 gateway=\
192.168.240.1 ntp-server=195.113.144.201,176.118.170.235
add address=192.168.241.0/24 dns-server=192.168.240.110,1.1.1.1,8.8.8.8,8.8.4.4 \
gateway=192.168.241.1 netmask=24 ntp-server=176.118.170.235,195.113.144.201
/ip dns
set allow-remote-requests=yes cache-max-ttl=4h cache-size=16384KiB \
max-concurrent-queries=150 max-concurrent-tcp-sessions=30 servers=\
192.168.240.110,8.8.4.4,8.8.8.8
/ip firewall address-list
add address=192.168.236.0/22 list=LAN_192.168.236.0/22+192.168.240.0/23
add address=192.168.240.0/23 list=LAN_192.168.236.0/22+192.168.240.0/23
/ip firewall filter
add action=accept chain=output disabled=yes
add action=accept chain=forward disabled=yes
add action=accept chain=input disabled=yes dst-address=192.168.240.1 dst-port=\
5246,5247,5678 protocol=udp
add action=accept chain=input comment=DHCP dst-address=255.255.255.255 \
dst-port=67,68 protocol=udp
add action=accept chain=input dst-address=192.168.240.1 protocol=icmp
add action=accept chain=input dst-address=192.168.240.1 dst-port=5246,5247,5678 \
protocol=udp src-address=192.168.240.0/24
add action=accept chain=forward dst-address-list=\
LAN_192.168.236.0/22+192.168.240.0/23 src-address-list=\
LAN_192.168.236.0/22+192.168.240.0/23
add action=drop chain=forward dst-port=5246,5247 out-interface=ether8 protocol=\
udp
add action=accept chain=input comment="Winbox Management IN" dst-address=\
192.168.240.0/24 dst-port=8291 log-prefix="Winbox MGMT" protocol=tcp \
src-address=192.168.240.0/24
add action=accept chain=input comment="Allow DNS Mikrotik Queries (na co se ptal\
\_Mikrotik jako DNS server - odpovedi); Zde jsme striktnejsi a povolime pouz\
e UDP (z internetu do mikrotiku)" connection-state=!invalid,new,untracked \
protocol=udp src-port=53
add action=accept chain=input comment="DHCP broadcast , mikrotik discovery" \
dst-address=255.255.255.255 dst-port=67,5678,5246,5247 in-interface=\
BridgeLAN protocol=udp src-address=0.0.0.0
add action=accept chain=input comment="DNS - IN - UDP" dst-port=53 protocol=udp \
src-address=192.168.240.0/24
add action=accept chain=input comment="DNS - IN - TCP" dst-port=53 protocol=tcp \
src-address=192.168.240.0/24
add action=accept chain=input comment="Pro SZA - pripojit se k MKT pres VPN" \
dst-address=192.168.240.1 in-interface=all-ppp src-address=192.168.240.0/24
add action=accept chain=forward comment="internet - odchozi" src-address-list=\
LAN_192.168.236.0/22+192.168.240.0/23
add action=accept chain=forward comment="internet - prichozi" connection-state=\
!invalid,new,untracked dst-address-list=\
LAN_192.168.236.0/22+192.168.240.0/23 in-interface=ether8
add action=accept chain=input comment="VPN: allow IKE" dst-port=500 \
in-interface=ether8 log-prefix=VPN protocol=udp
add action=accept chain=input comment="VPN: allow L2TP" dst-port=1701 \
in-interface=ether8 log-prefix=VPN protocol=udp
add action=accept chain=input comment="VPN: allow IPsec NAT-T" dst-port=4500 \
in-interface=ether8 log-prefix=VPN protocol=udp
add action=accept chain=input in-interface=ether8 log-prefix=VPN protocol=\
ipsec-esp
add action=accept chain=input in-interface=ether8 log-prefix=VPN protocol=\
ipsec-ah
add action=accept chain=input dst-address-list=\
LAN_192.168.236.0/22+192.168.240.0/23 src-address-list=\
LAN_192.168.236.0/22+192.168.240.0/23
add action=accept chain=output comment="NTP out" dst-port=123 protocol=udp
add action=accept chain=input connection-state=established,related protocol=udp \
src-port=123
add action=drop chain=forward log=yes log-prefix="ultimate drop"
add action=drop chain=input log-prefix="input - last rule"
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether8 src-address-list=\
LAN_192.168.236.0/22+192.168.240.0/23
/ip route
add disabled=no distance=5 dst-address=0.0.0.0/0 gateway=77.236.222.1 \
routing-table=main scope=30 suppress-hw-offload=no target-scope=10
/ip service
set ftp disabled=yes
set telnet disabled=yes
set www disabled=yes
/ppp secret
add name=user1 profile=l2tp-profile-1 service=l2tp
add name=user2 profile=l2tp-profile-1 routes="192.168.236.0/24 192.168.240.1 2\
,192.168.237.0/24 192.168.240.1 2,192.168.238.0/24 192.168.240.1 2,192.168.2\
39.0/24 192.168.240.1 2,192.168.240.0/24 192.168.240.1 2,192.168.241.0/24 19\
2.168.240.1 2" service=l2tp
set name="Main Router DSVC"
/system logging
add topics=wireless,!debug
add topics=wireless,debug
add topics=wireless,debug
add topics=wireless
add topics=interface
/system ntp client
set enabled=yes
/system ntp client servers
add address=de.pool.ntp.org
add address=3.de.pool.ntp.org
add address=tik.cesnet.cz
/system routerboard settings
set enter-setup-on=delete-key
