I agree with the concept “walk first, run later”. The only problem here is that it’s possible to set up the whole config for local radio directly on /interface/wifi/ device … while for CAPsMAN it’s almost inevitable to properly use profiles/templates. So I guess it would be very good to teach less experienced users to use configuration profiles even when configuring single AP.
If user “learns to walk” backwards, he’ll have a bit of a problem “learning to run forwards”.
But it is a step forward ! 
On AP device, you can directly apply all settings on local radio.
With capsman, there is no local radio. So then you move at least one tab to the right, using configuration (or down for those using Winbox4).
Personally, I always use channel, security, datapath and steering tabs. Then configuration to tie everything together.
Capsman or standalone AP, I usually do it that way.
Next apply configuration to local radio or in provisioning. Clear what happens where then for me.
(disregarding for a moment you can also run capsman controller on 1 AP itself, in which case you need to configure local radio in stead of provisioning but it remains the exact same configuration profile)
But that’s my choice to do it this way.
Agree that it’s a good way. And it seems that it’s the correct way (considering that may people will likely end up using multiple APs and hence CAPsMAN).
Apologies for the delay. This week has been hectic. I won’t address everything line by line but here’s the response to the various questions I see that I missed.
Why am I doing it this way? Because I haven’t found any good documentation or tutorials to lead me down a better path. It’s astonishing how many (even ones written ~6 months ago) don’t work because they use commands that don’t exist in the latest firmware or assume things that aren’t always true (aka the entire reason for this post is that the video assumed something that didn’t exist on my MikroTik switch!) Hence the four different guides I tried this weekend.
Why do I keep trying things left and right? Because I don’t have a clear guide. I’m trying to piece together bits from multiple sources which are all only partially working guides.
Why did I use Quickset? I apologize I wasn’t more clear. I used it only as a test to verify the hardware actually was working and to try to understand things a bit better. It was a learning experience, but that is NOT the path I want to take. It was just a test.
Why am I trying to learn MikroTik? Because my home lab is comprised of a bunch of vendors, they’re all old, and I’m tired of thinking “damn it, that was the command for the /other/ switch - what the heck is it for this one?” I was really hoping that I could migrate everything to one vendor and I’ve heard really good things about MikroTik.
Why am I trying to setup CAPaMAN? Because they built my house weird. That’s the short of it. Things that aren’t obvious when buying it. Like a random concrete wall that blocks off chunk of the house. And they ran most of the conduit and venting and metal up through the center walls of the house. So wifi signals plummet when you walk from one side of the wall to the other. So I have FOUR really old AP’s right now (and coverage is still terrible in one corner of the house which happens to be where the wife put her new couch). Now, I am really hoping that APs that aren’t nearly 8 years old will do better and I won’t have as many… but I am so tired of managing all them individually. And I am so tired of getting roaming to work for the wife and then she moves to another room and everything drops because one of the AP’s decided to be weird that day. I’m really trying to simplify how much time I have to spend kicking the AP’s. The thought of one configuration and they all work the same is a very happy one for me right now.
So yeah, I’ve got plenty of reasons for why I’m trying to learn. What I’m desperately short on is good information that clearly explains how to set this up. Even though I’ve got a bunch of this stuff - when it comes to networking, I don’t claim to be anything more then a newb. 
It seems to me that every vendor does things differently just to annoy me.
Let’s assume we move forward with capsman setup:
Retrace your steps.
Reset to caps mode on CAP AX.
Add vlan4 as interface port.
Change DHCP client to VLAN4Stop and then report back.
The AP is back on CAPS mode - CAPsMAN doesn’t see it and there are no wifi ssid’s broadcast. But the AP has an IP that is reachable on an interface where vlan4 is untagged with DHCP.
The configuration I posted in #17 is still the exact same. I’ve not changed anything there.
Thank you for your patience and help. It is appreciated.
After any change, share config. This is the only way to provide proper help.
Furthermore, there is pretty good documentation including examples:
https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-CAPsMAN-CAPVLANconfigurationexample:
Documentation on VLAN is there as well, but I prefer to use this topic as guide:
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
I chose to use trunk ports on the accesspoints as well. And have a dedicated mgt vlan where the CAPsMAN and CAPS’s are communicating over.
OK, using this as my guide I tried to match it as closely as I can: https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-CAPsMAN%3A
The CAP AX is on ether 7. I too would prefer the trunk port on the AP, but if I do that right now the CAP becomes unreachable.
The differences are:
- I use VLAN 4 & 6; the guide uses 10 & 20
- DHCP is already offered on the VLAN4 by another service so I didn’t add that.
- I didn’t do master/slave configurations. I left guest on 2.4Ghz and main on 5Ghz.
- Finally, because the CAP AX (as I understand it) uses the wifi-qcom package - I tried following this as well (but I didn’t do all of it because I’m not using it on all of those interfaces): https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-CAPusing"wifi-qcom"package%3A
Here is the current export from the switch:
/interface bridge
add admin-mac={snip} auto-mac=no comment=defconf name=bridge vlan-filtering=yes
add name=bridgeLocal vlan-filtering=yes
/interface ethernet
set [ find default-name=ether3 ] name=OffBridge3
/interface vlan
add interface=bridge name=GUEST vlan-id=6
add interface=bridge name=MAIN vlan-id=4
/interface list
add name=LAN
add name=TRUSTED
/interface wifi datapath
add bridge=bridge disabled=no name=MAIN vlan-id=4
add bridge=bridge disabled=no name=GUEST vlan-id=6
add bridge=bridge name=DP_AC
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disabled=no ft=yes ft-over-ds=yes name=Security_MAIN
add authentication-types=wpa2-psk,wpa3-psk disabled=no ft=yes ft-over-ds=yes name=Security_GUEST
/interface wifi configuration
add disabled=no name=MAIN security=Security_MAIN ssid=MAIN_Network
add disabled=no name=GUEST security=Security_GUEST ssid=GUEST_Network
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=dhcp_pool0 ranges=192.168.6.100-192.168.6.254
/ip dhcp-server
add address-pool=dhcp_pool0 interface=GUEST name=dhcp1
/interface bridge port
add bridge=bridge comment=eth1 frame-types=admit-only-untagged-and-priority-tagged interface=ether1 pvid=4
add bridge=bridge comment=eth2 frame-types=admit-only-untagged-and-priority-tagged interface=ether2 pvid=4
add bridge=bridge comment=eth4 frame-types=admit-only-untagged-and-priority-tagged interface=ether4 pvid=5
add bridge=bridge comment="Hybrid Port" interface=ether5 pvid=4
add bridge=bridge comment=eth6 frame-types=admit-only-untagged-and-priority-tagged interface=ether6 pvid=6
add bridge=bridge comment="trunk to capax" frame-types=admit-only-untagged-and-priority-tagged interface=ether7 pvid=4
add bridge=bridge comment=Trunk_Uplink frame-types=admit-only-vlan-tagged interface=ether8 pvid=4
add bridge=bridge comment=defconf interface=sfp-sfpplus1
add bridge=bridge comment=defconf interface=sfp-sfpplus2
/ip neighbor discovery-settings
set discover-interface-list=TRUSTED
/interface bridge vlan
add bridge=bridge comment=Orange tagged=ether5,ether7,ether8 untagged=ether4 vlan-ids=5
add bridge=bridge comment=Blue tagged=ether5,ether7 untagged=ether6 vlan-ids=6
add bridge=bridge comment=Green tagged=bridge,ether8 untagged=ether1,ether2,ether5,ether7 vlan-ids=4
/interface list member
add interface=OffBridge3 list=LAN
add interface=ether1 list=LAN
add interface=ether2 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=ether6 list=LAN
add interface=ether7 list=LAN
add interface=ether8 list=LAN
add interface=MAIN list=TRUSTED
add interface=OffBridge3 list=TRUSTED
/interface wifi cap
set discovery-interfaces=*F enabled=yes slaves-datapath=*3
/interface wifi capsman
set enabled=yes interfaces=bridge package-path="" require-peer-certificate=no upgrade-policy=require-same-version
/interface wifi provisioning
add action=create-dynamic-enabled disabled=no master-configuration=GUEST slave-configurations="" supported-bands=2ghz-ax
add action=create-dynamic-enabled disabled=no master-configuration=MAIN supported-bands=5ghz-ax
add action=create-dynamic-enabled master-configuration=*5 supported-bands=5ghz-ac
add action=create-dynamic-enabled master-configuration=*6 supported-bands=2ghz-n
/ip address
add address=192.168.55.1/16 interface=OffBridge3 network=192.168.0.0
add address=192.168.4.8/24 comment=Management interface=MAIN network=192.168.4.0
add address=192.168.6.1/24 comment=Blue interface=GUEST network=192.168.6.0
/ip dhcp-server network
add address=192.168.6.0/24 dns-server=192.168.6.1 gateway=192.168.6.1
/ip dns
set servers={snip{
/system identity
set name=MikroTik-CRS310-8G+2S+
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address={snip}
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=TRUSTED
With the above config - If I put the CAP AX into CAPs mode - it becomes completely unreachable! I see traffic on the port, but i can’t get to it, there is no wifi, and it does nothing. It does not matter if I do it via pushing and holding buttons or by using the web GUI to reboot into CAPS mode - it’s broken. Thus, right now it is in a factory reset where the ONLY thing I’ve done is change the password (it gets DHCP IP).
/interface bridge
add admin-mac={snip} auto-mac=no comment=defconf name=bridgeLocal
/interface wifi datapath
add bridge=bridgeLocal comment=defconf disabled=no name=capdp
/interface wifi
# no connection to CAPsMAN
set [ find default-name=wifi1 ] configuration.manager=capsman datapath=capdp
# no connection to CAPsMAN
set [ find default-name=wifi2 ] configuration.manager=capsman datapath=capdp
/interface bridge port
add bridge=bridgeLocal comment=defconf interface=ether1
add bridge=bridgeLocal comment=defconf interface=ether2
/interface wifi cap
set discovery-interfaces=bridgeLocal enabled=yes slaves-datapath=capdp
/ip dhcp-client
add comment=defconf interface=bridgeLocal
/system note
set show-at-login=no
I will stop monkeying around with it until you tell me what to do next.
Thanks!
Your main problem is currently L2 setup - VLANs.
/interface wifi capsman
set enabled=yes interfaces=bridge package-path=“” require-peer-certificate=no upgrade-policy=require-same-version
You set capsman to listen for connections from CAPs on bridge … but in your setup bridge interface doesn’t exist, you’re using all VLANs.
And if you go the way of setting CAPsMAN on VLAN, then you’ll have to do similar setup on CAP device as well … unless you set the port, which connects CAP with CAPsMAN a hybrid port with PVID set to VLAN ID where CAPsMAN is listening for connections.
Greetings,
Thanks for the response. I think part of the issue was that I was under the assumption that this worked in a similar way to Ubiquiti where all their devices auto-discover each other and provision all the VLAN stuff auto-magically via the Neighbour discovery. So IF I understand right, if I want a proper trunk all the VLANs then I need to configure the CAP to exist and work on the management VLAN /first/ then via the software setting I then reset the CAP into CAPsMAN mode. And that won’t wipe the VLAN configuration, right? It will just configure the wifi settings, right?
I found this post by you when researching this in attempt to answer my questions. Is this the recommended way or is the hybrid port the better option?
http://forum.mikrotik.com/t/capsman-on-layer2-vlans/149840/1
Thanks!
Nope.
Reset is reset
Also vlan config.
Reset to caps mode.
Apply vlan settings for mgmt vlan.
That’s the order
Any resetting of ROS device into “some other” mode will wipe most configuration. If your needs are outside some (simple) predefined use cases, then you’re completely on your own. You can start off from a profile whuch is close to what you need and change it where it needs to be changed. AFAIK none of quickset profiles support VLANs though.
Regarding the post in link: it’s about the (now) legacy capsman, but VLAN considerations are the same. Additionally: if you’re considering multiple VLANs and you’ll have a separate VLAN for device management … you can direct CAPsMAN discovery to that VLAN as well, it can be completely separate from any “user” VLAN.
Adding:
The only thing which you can opt to retain when doing reset are user accounts.
All the rest is gone.
You have 3 reset options by selecting/unselecting some of the options (unless I missed something):
- no config → clean sheet, nothing in it, not even a bridge
- default config → =factory reset, depends on device (router, AP, switch, …), excellent starting point for most setups
- caps mode → pure caps mode, all interfaces to bridge and listening for capsman controller on bridge
OK. I think I’m grasping this now. When I adjusted my localbridge:
- I lost the hardware offloading on the switch
- I can no longer ping nor access the CAP - I suspect I know the “why” but what I don’t know is how to fix it.
- However, when I hardware reset the CAP into CAPsMAN mode, I did get the two wifi signals for MAIN and GUEST! So there is some progress. But when I try to connect to MAIN it says it connects then immediately disconnects and I can’t even scan for it - the SSID simply disappears. And when I try to connect to GUEST I get an error saying the AP is at capacity - but it doesn’t go away… shrug I don’t know.
I tinkered with this and read the above documentation again trying to align my test setup to their example but still in the same place. I would appreciate very clear instructions on what I need to change to get this to work. Thanks.
/interface bridge
add admin-mac={snip} auto-mac=no comment=defconf name=bridge vlan-filtering=yes
add name=bridgeLocal
/interface ethernet
set [ find default-name=ether3 ] name=OffBridge3
/interface vlan
add interface=bridge name=GUEST vlan-id=6
add interface=bridge name=MAIN vlan-id=4
/interface list
add name=LAN
add name=TRUSTED
/interface wifi datapath
add bridge=bridge disabled=no name=MAIN vlan-id=4
add bridge=bridge disabled=no name=GUEST vlan-id=6
add bridge=bridge name=DP_AC
add bridge=bridgeLocal comment=defconf disabled=no name=capdp
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disabled=no ft=yes ft-over-ds=yes name=Security_MAIN
add authentication-types=wpa2-psk,wpa3-psk disabled=no ft=yes ft-over-ds=yes name=Security_GUEST
/interface wifi configuration
add disabled=no name=MAIN security=Security_MAIN ssid=MAIN_Network
add disabled=no name=GUEST security=Security_GUEST ssid=GUEST_Network
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=dhcp_pool0 ranges=192.168.6.100-192.168.6.254
/ip dhcp-server
add address-pool=dhcp_pool0 interface=GUEST name=dhcp1
/interface bridge port
add bridge=bridge comment=eth1 frame-types=admit-only-untagged-and-priority-tagged interface=ether1 pvid=4
add bridge=bridge comment=eth2 frame-types=admit-only-untagged-and-priority-tagged interface=ether2 pvid=4
add bridge=bridge comment=eth4 frame-types=admit-only-untagged-and-priority-tagged interface=ether4 pvid=5
add bridge=bridge comment="Hybrid Port" interface=ether5 pvid=4
add bridge=bridge comment=eth6 frame-types=admit-only-untagged-and-priority-tagged interface=ether6 pvid=6
add bridge=bridgeLocal comment="trunk to capax" frame-types=admit-only-untagged-and-priority-tagged interface=ether7 pvid=4
add bridge=bridge comment=Trunk_Uplink frame-types=admit-only-vlan-tagged interface=ether8 pvid=4
add bridge=bridge comment=defconf interface=sfp-sfpplus1
add bridge=bridge comment=defconf interface=sfp-sfpplus2
/ip neighbor discovery-settings
set discover-interface-list=TRUSTED
/interface bridge vlan
add bridge=bridge comment=Orange tagged=ether5,ether7,ether8 untagged=ether4 vlan-ids=5
add bridge=bridge comment=Blue tagged=ether5,ether7 untagged=ether6 vlan-ids=6
add bridge=bridge comment=Green tagged=bridge,ether8 untagged=ether1,ether2,ether5,ether7 vlan-ids=4
/interface list member
add interface=OffBridge3 list=LAN
add interface=ether1 list=LAN
add interface=ether2 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=ether6 list=LAN
add interface=ether7 list=LAN
add interface=ether8 list=LAN
add interface=MAIN list=TRUSTED
add interface=OffBridge3 list=TRUSTED
/interface wifi cap
set discovery-interfaces=bridgeLocal enabled=yes slaves-datapath=capdp
/interface wifi capsman
set enabled=yes interfaces=bridgeLocal package-path="" require-peer-certificate=no upgrade-policy=require-same-version
/interface wifi provisioning
add action=create-dynamic-enabled disabled=no master-configuration=GUEST slave-configurations="" supported-bands=2ghz-ax
add action=create-dynamic-enabled disabled=no master-configuration=MAIN supported-bands=5ghz-ax
add action=create-dynamic-enabled master-configuration=*5 supported-bands=5ghz-ac
add action=create-dynamic-enabled master-configuration=*6 supported-bands=2ghz-n
/ip address
add address=192.168.55.1/16 interface=OffBridge3 network=192.168.0.0
add address=192.168.4.8/24 comment=Management interface=MAIN network=192.168.4.0
add address=192.168.6.1/24 comment=Blue interface=GUEST network=192.168.6.0
/ip dhcp-server network
add address=192.168.6.0/24 dns-server=192.168.6.1 gateway=192.168.6.1
/ip dns
set servers={snip}
/system identity
set name=MikroTik-CRS310-8G+2S+
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address={snip}
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=TRUSTED
Which device’s config is the one you posted in preceding post? You’re mixing CAPsMAN and CAP config.
Why do you add bridgeLocal? I don’t think it’s needed on either device.
I posted the config from the switch that is running CAPsMAN. And when I tried to set CAPsMAN to listen on VLAN 4, nothing happened when I put the CAP into CAPsMAN mode. So I instead am trying to match this documentation which the posts above recommended I follow: https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-CAPusing"wifi-qcom"package%3A
But I’m happy to not make any change except the ones recommended in this thread from now on.
So let’s try to do some cleaning … first on CAPsMAN device. We’re still not focusing on correct radio provisioning, we’re just focusing on getting CAP communicating with CAPsMAN. The red text with strikethrough are parts to be removed, green parts are to be added (or property value changed).
For starters the connection between CAPsMAN and CAP (ether7) will be untagged … which is expected by CAP device if reset to capsman mode (and without any manual config).
So hopefully you’ll see CAP connect to CAPsMAN … but provisioning might not be correct.
After that, come back with (then) actual config of both CAPsMAN and CAP devices.
Thank you so very very much. A few notes:
I couldn’t get it to remove these fields so I blanked them or set them to defaults. Is that ok?
/interface wifi cap
set discovery-interfaces=""
/interface wifi capsman
set enabled=yes interfaces=MAIN package-path="" require-peer-certificate=no upgrade-policy=none
When I removed the GUEST wifi configuration this became like the other two you asked me to remove, so I removed it as well:
add action=create-dynamic-enabled disabled=no master-configuration=GUEST slave-configurations="" supported-bands=2ghz-ax
I believe I did everything else as you asked. Here’s the output:
/interface bridge
add admin-mac={snip} auto-mac=no comment=defconf name=bridge vlan-filtering=yes
/interface ethernet
set [ find default-name=ether3 ] name=OffBridge3
/interface vlan
add interface=bridge name=GUEST vlan-id=6
add interface=bridge name=MAIN vlan-id=4
/interface list
add name=LAN
add name=TRUSTED
/interface wifi datapath
add bridge=bridge disabled=no name=MAIN vlan-id=4
add bridge=bridge disabled=no name=GUEST vlan-id=6
add bridge=bridge name=DP_AC
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disabled=no ft=yes ft-over-ds=yes name=Security_MAIN
add authentication-types=wpa2-psk,wpa3-psk disabled=no ft=yes ft-over-ds=yes name=Security_GUEST
/interface wifi configuration
add datapath=DP_AC disabled=no name=MAIN security=Security_MAIN ssid=MAIN_Network
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=dhcp_pool0 ranges=192.168.6.100-192.168.6.254
/ip dhcp-server
add address-pool=dhcp_pool0 interface=GUEST name=dhcp1
/interface bridge port
add bridge=bridge comment=eth1 frame-types=admit-only-untagged-and-priority-tagged interface=ether1 pvid=4
add bridge=bridge comment=eth2 frame-types=admit-only-untagged-and-priority-tagged interface=ether2 pvid=4
add bridge=bridge comment=eth4 frame-types=admit-only-untagged-and-priority-tagged interface=ether4 pvid=5
add bridge=bridge comment="Hybrid Port" interface=ether5 pvid=4
add bridge=bridge comment=eth6 frame-types=admit-only-untagged-and-priority-tagged interface=ether6 pvid=6
add bridge=bridge comment="access to capax" frame-types=admit-only-untagged-and-priority-tagged interface=ether7 pvid=4
add bridge=bridge comment=Trunk_Uplink frame-types=admit-only-vlan-tagged interface=ether8 pvid=4
add bridge=bridge comment=defconf interface=sfp-sfpplus1
add bridge=bridge comment=defconf interface=sfp-sfpplus2
/ip neighbor discovery-settings
set discover-interface-list=TRUSTED
/interface bridge vlan
add bridge=bridge comment=Orange tagged=ether5,ether7,ether8 untagged=ether4 vlan-ids=5
add bridge=bridge comment=Blue tagged=ether5,ether7 untagged=ether6 vlan-ids=6
add bridge=bridge comment=Green tagged=bridge,ether8 untagged=ether1,ether2,ether5,ether7 vlan-ids=4
/interface list member
add interface=OffBridge3 list=LAN
add interface=ether1 list=LAN
add interface=ether2 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=ether6 list=LAN
add interface=ether7 list=LAN
add interface=ether8 list=LAN
add interface=MAIN list=TRUSTED
add interface=OffBridge3 list=TRUSTED
/interface wifi cap
set discovery-interfaces=""
/interface wifi capsman
set enabled=yes interfaces=MAIN package-path="" require-peer-certificate=no upgrade-policy=none
/interface wifi datapath
add bridge=*10 comment=defconf disabled=no name=capdp
/interface wifi provisioning
add action=create-dynamic-enabled disabled=no master-configuration=MAIN supported-bands=5ghz-ax
/ip address
add address=192.168.55.1/16 interface=OffBridge3 network=192.168.0.0
add address=192.168.4.8/24 comment=Management interface=MAIN network=192.168.4.0
add address=192.168.6.1/24 comment=Blue interface=GUEST network=192.168.6.0
/ip dhcp-server network
add address=192.168.6.0/24 dns-server=192.168.6.1 gateway=192.168.6.1
/ip dns
set servers={snip}
/system identity
set name=MikroTik-CRS310-8G+2S+
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address={snip}
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=TRUSTED
Also, Huzzah! I reset the AP into CAPsMAN mode and it came right up with MAIN_Network. A quick test shows that it seems to be working as expected.
I do have access to the AP again as well! Here is its config:
/interface bridge
add admin-mac={snip} auto-mac=no comment=defconf name=bridgeLocal
/interface wifi datapath
add bridge=bridgeLocal comment=defconf disabled=no name=capdp
/interface wifi
# managed by CAPsMAN D4:01:C3:69:05:EE%bridgeLocal, traffic processing on CAP
# mode: AP, SSID: MAIN_Network, channel: 5500/ax/Ceee/D
set [ find default-name=wifi1 ] configuration.manager=capsman datapath=capdp disabled=no
# managed by CAPsMAN D4:01:C3:69:05:EE%bridgeLocal
set [ find default-name=wifi2 ] configuration.manager=capsman datapath=capdp
/interface bridge port
add bridge=bridgeLocal comment=defconf interface=ether1
add bridge=bridgeLocal comment=defconf interface=ether2
/interface wifi cap
set discovery-interfaces=bridgeLocal enabled=yes slaves-datapath=capdp
/ip dhcp-client
add comment=defconf interface=bridgeLocal
/system clock
set time-zone-name=America/Chicago
/system note
set show-at-login=no
OK, now you have basics working. If you want to add guest wifi network, then you’ll have to add VLANs into the game. And that will involve: CAPsMAN device, all switches, main router and optionally CAP device. It seems that you have one switch which is CAPsMAN as well (so that brings down number of devices to reconfigure, the complexity remains the same though), and CAP device is listed as optional, depends on how you want to use its wired ports (if you’ll only use one port to connect it to switch, then you don’t have to configure VLANs on it, you have to make connecting port on switch a hybrid port - allowing both tagged snd untagged frames - untagged for VLAN where CAPsMAN discovery works, VID 4 in your case). If you want to use other port zo connect any end equipment, you’ll have to configure VLANs on CAP device as well (but you could configure VLANs on CAP regardless).
If you’re not fully comfortable with configuring VLANs, you may want to study this tutorial: http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
Thank you for your help. I agree, that is a good resource for vlan.
I do have two questions:
-
I’m trying to follow the documentation example to set up the GUEST network with VLAN so I understand how it works. But I don’t ever seem to get that wireless network. Any idea what I might be doing wrong? I never see the cap-wifi1 “Operated by CAP”, nor the wifi signal.
-
When I make changes to CAPsMAN, it doesn’t seem to propagate. I have to manually change the CAP to reboot into CAPsMAN mode and reset it for changes to show up. Is that correct? Or am I doing something else wrong?
/interface bridge
add admin-mac={snip} auto-mac=no comment=defconf name=bridge vlan-filtering=yes
/interface ethernet
set [ find default-name=ether3 ] name=OffBridge3
/interface wifi
# operated by CAP D4:01:C3:BF:64:49%MAIN
add name=cap-wifi2 radio-mac=D4:01:C3:BF:64:4C
/interface vlan
add interface=bridge name=GUEST vlan-id=6
add interface=bridge name=MAIN vlan-id=4
/interface list
add name=LAN
add name=TRUSTED
/interface wifi datapath
add bridge=bridge disabled=no name=MAIN vlan-id=4
add bridge=bridge disabled=no name=GUEST vlan-id=6
add bridge=bridge name=DP_AC
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disabled=no ft=yes ft-over-ds=yes name=Security_MAIN
add authentication-types=wpa2-psk,wpa3-psk disabled=no ft=yes ft-over-ds=yes name=Security_GUEST
/interface wifi configuration
add datapath=DP_AC disabled=no name=MAIN security=Security_MAIN ssid=MAIN_Network
add datapath=GUEST disabled=no name=GUEST security=Security_GUEST ssid=GUEST_Network
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/ip pool
add name=dhcp_pool0 ranges=192.168.6.100-192.168.6.254
/ip dhcp-server
add address-pool=dhcp_pool0 interface=GUEST name=dhcp1
/interface bridge port
add bridge=bridge comment=eth1 frame-types=admit-only-untagged-and-priority-tagged interface=ether1 pvid=4
add bridge=bridge comment=eth2 frame-types=admit-only-untagged-and-priority-tagged interface=ether2 pvid=4
add bridge=bridge comment=eth4 frame-types=admit-only-untagged-and-priority-tagged interface=ether4 pvid=5
add bridge=bridge comment="Hybrid Port" interface=ether5 pvid=4
add bridge=bridge comment=eth6 frame-types=admit-only-untagged-and-priority-tagged interface=ether6 pvid=6
add bridge=bridge comment="access to capax" frame-types=admit-only-untagged-and-priority-tagged interface=ether7 pvid=4
add bridge=bridge comment=Trunk_Uplink frame-types=admit-only-vlan-tagged interface=ether8 pvid=4
add bridge=bridge comment=defconf interface=sfp-sfpplus1
add bridge=bridge comment=defconf interface=sfp-sfpplus2
/ip neighbor discovery-settings
set discover-interface-list=TRUSTED
/interface bridge vlan
add bridge=bridge comment=Orange tagged=ether5,ether7,ether8 untagged=ether4 vlan-ids=5
add bridge=bridge comment=Blue tagged=ether5,ether7 untagged=ether6 vlan-ids=6
add bridge=bridge comment=Green tagged=bridge,ether8 untagged=ether1,ether2,ether5,ether7 vlan-ids=4
/interface list member
add interface=OffBridge3 list=LAN
add interface=ether1 list=LAN
add interface=ether2 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
add interface=ether6 list=LAN
add interface=ether7 list=LAN
add interface=ether8 list=LAN
add interface=MAIN list=TRUSTED
add interface=OffBridge3 list=TRUSTED
/interface wifi cap
set discovery-interfaces=""
/interface wifi capsman
set enabled=yes interfaces=MAIN package-path="" require-peer-certificate=no upgrade-policy=none
/interface wifi datapath
add bridge=*10 comment=defconf disabled=no name=capdp
/interface wifi provisioning
add action=create-dynamic-enabled disabled=no master-configuration=MAIN supported-bands=5ghz-ax
add action=create-dynamic-enabled disabled=no master-configuration=GUEST slave-configurations="" supported-bands=2ghz-ax
/ip address
add address=192.168.55.1/16 interface=OffBridge3 network=192.168.0.0
add address=192.168.4.8/24 comment=Management interface=MAIN network=192.168.4.0
add address=192.168.6.1/24 comment=Blue interface=GUEST network=192.168.6.0
/ip dhcp-server network
add address=192.168.6.0/24 dns-server=192.168.6.1 gateway=192.168.6.1
/ip dns
set servers={snip}
/system identity
set name=MikroTik-CRS310-8G+2S+
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address={snip}
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=TRUSTED
-
To add guest SSID, you have to set slave-configurations to appropriate items in wifi/provisioning …
And you’ll have to make ether7 (interconnect between CAPsMAN and CAP) a hybrid port to allow it to pass tagged frames from guest wifi. Datapath for main also mentions tagging frames, ypu’ll have to adjust ether7 port/vlan settings accordingly (possibly on CAP as well if you’re going to use same VLAN for both main wifi traffic and CAPsMAN discovery). -
It’s my experience as well that some changes in configuration on CAPsMAN don’t get applied to CAP. My way forward is to remove the dynamic entry for that particular remote radio in wifi/ … CAP gets reprovisioned with new settings imediately afterwards. According to what MT says it should not happen, so I guess it’s a bug.
@mkx, I applaud your patience here …
Same here.
FToms mentioned not too long ago reprovisioning should happen automatically.
My experience is I need to do this manually.
Removing dynamic entry is not needed. Just reprovision. Same result but the way of handling it is different (re-apply versus destroying, I prefer the positive approach 
)