Hi
I am trying to configure a secondary SSID for guests network and I am following this guide: https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-CAPsMAN-CAPVLANconfigurationexample:
I have CCR2004 as the capsman manager and 14 capAX as the AP-s. Running latest 7.19
The config for the AP-s is the following:
/interface bridge
add admin-mac=REDACTED auto-mac=no comment=trunk name=bridge port-cost-mode=short protocol-mode=mstp region-name=example region-revision=1 vlan-filtering=yes
/interface bridge msti
add bridge=bridge comment=external identifier=1 vlan-mapping=2
add bridge=bridge comment=management identifier=2 vlan-mapping=3
add bridge=bridge comment=services identifier=3 vlan-mapping=6-7
/interface bridge port
add bridge=bridge comment=trunk interface=ether1 internal-path-cost=10 path-cost=10
/interface bridge vlan
add bridge=bridge untagged=bridge vlan-ids=1
add bridge=bridge tagged=bridge,ether1 vlan-ids=2
add bridge=bridge tagged=bridge,ether1 vlan-ids=6
add bridge=bridge tagged=bridge,ether1 vlan-ids=7
/interface vlan
add comment="VLAN 2" interface=bridge name=vlan2 vlan-id=2
/interface wifi
set [ find default-name=wifi1 ] configuration.manager=capsman .mode=ap datapath=capdp disabled=no
set [ find default-name=wifi2 ] configuration.manager=capsman .mode=ap datapath=capdp disabled=no
/interface wifi cap
set caps-man-addresses=192.168.XX.XX discovery-interfaces=bridge enabled=yes slaves-datapath=capdp
/interface wifi datapath
add bridge=bridge comment="Datapath for WiFi clients to pass data through" disabled=no name=capdp
The config on the CCR is the following
/interface wifi channel
add band=2ghz-ax disabled=no name=ch-2ghz reselect-time=01:00:00 skip-dfs-channels=all width=20/40mhz
add band=5ghz-ax disabled=no name=ch-5ghz reselect-time=01:00:00 skip-dfs-channels=all width=20/40mhz
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disable-pmkid=no disabled=no ft=yes ft-over-ds=yes ft-preserve-vlanid=yes name=security
add authentication-types=wpa2-psk,wpa3-psk disable-pmkid=no disabled=no ft=yes ft-over-ds=yes ft-preserve-vlanid=yes name=security-guests
/interface wifi cap
set discovery-interfaces=all
/interface wifi capsman
set ca-certificate=auto enabled=yes interfaces=vlan2 package-path=/ require-peer-certificate=no upgrade-policy=suggest-same-version
/interface wifi configuration
add channel=ch-5ghz country=Example datapath=vlan6 disabled=no name=main-5GHz security=security ssid=main tx-power=9
add channel=ch-2ghz country=Example datapath=vlan6 disabled=no name=main security=security ssid=main tx-power=3
add channel=ch-5ghz country=Example datapath=vlan7 disabled=no name=guest-5GHz security=security-guests ssid=guest tx-power=9
add channel=ch-2ghz country=Example datapath=vlan7 disabled=no name=guest security=security-guests ssid=guest tx-power=3
/interface wifi datapath
add bridge=bridge comment="Datapath for WiFi clients to pass data through" disabled=no name=vlan6 vlan-id=6
add bridge=bridge comment="Datapath for WiFi guest clients to pass data through" disabled=no name=vlan7 vlan-id=7
/interface wifi provisioning
add action=create-dynamic-enabled comment="Match Radio bands for 5GHz wifi." disabled=no master-configuration=main-5GHz name-format=%I_5Ghz- slave-configurations=guest-5GHz supported-bands=5ghz-ax,5ghz-ac,5ghz-n,5ghz-a
add action=create-dynamic-enabled comment="Match Radio bands for 2.4GHz radio." disabled=no master-configuration=main name-format=%I_2GHz- slave-configurations=guest supported-bands=2ghz-ax,2ghz-n,2ghz-g
/interface bridge
add admin-mac=REDACTED auto-mac=no fast-forward=no igmp-snooping=yes name=bridge port-cost-mode=short protocol-mode=mstp region-name=example region-revision=2 vlan-filtering=yes
/interface bridge msti
add bridge=bridge comment=external identifier=1 vlan-mapping=2
add bridge=bridge comment=management identifier=2 vlan-mapping=3
add bridge=bridge comment=services identifier=3 vlan-mapping=6-7
/interface bridge port
add bridge=bridge comment=trunk frame-types=admit-only-vlan-tagged interface=ether1 internal-path-cost=10 path-cost=10
add bridge=bridge comment=trunk frame-types=admit-only-vlan-tagged interface=ether2 internal-path-cost=10 path-cost=10
add bridge=bridge comment=trunk frame-types=admit-only-vlan-tagged interface=ether3 internal-path-cost=10 path-cost=10
add bridge=bridge comment=trunk frame-types=admit-only-vlan-tagged interface=ether4 internal-path-cost=10 path-cost=10
add bridge=bridge comment=trunk frame-types=admit-only-vlan-tagged interface=ether5 internal-path-cost=10 path-cost=10
add bridge=bridge comment=trunk frame-types=admit-only-vlan-tagged interface=ether6 internal-path-cost=10 path-cost=10
add bridge=bridge comment=trunk frame-types=admit-only-vlan-tagged interface=ether7 internal-path-cost=10 path-cost=10
add bridge=bridge comment=trunk frame-types=admit-only-vlan-tagged interface=ether8 internal-path-cost=10 path-cost=10
add bridge=bridge comment=trunk frame-types=admit-only-vlan-tagged interface=ether9 internal-path-cost=10 path-cost=10
add bridge=bridge comment=trunk frame-types=admit-only-vlan-tagged interface=ether10 internal-path-cost=10 path-cost=10
add bridge=bridge comment=trunk frame-types=admit-only-vlan-tagged interface=ether11 internal-path-cost=10 path-cost=10
add bridge=bridge comment=trunk frame-types=admit-only-vlan-tagged interface=ether12 internal-path-cost=10 path-cost=10
add bridge=bridge comment=trunk frame-types=admit-only-vlan-tagged interface=ether13 internal-path-cost=10 path-cost=10
add bridge=bridge comment=trunk frame-types=admit-only-vlan-tagged interface=ether14 internal-path-cost=10 path-cost=10
add bridge=bridge comment=trunk frame-types=admit-only-vlan-tagged interface=ether16 internal-path-cost=10 path-cost=10
add bridge=bridge comment=trunk frame-types=admit-only-vlan-tagged interface=sfp-sfpplus1 internal-path-cost=10 path-cost=10
add bpdu-guard=yes bridge=bridge comment="Dedicated Management Port" frame-types=admit-only-untagged-and-priority-tagged interface=ether15 internal-path-cost=10 path-cost=10 pvid=2
add bridge=bridge comment=trunk frame-types=admit-only-vlan-tagged interface=sfp-sfpplus2 internal-path-cost=10 path-cost=10
/interface bridge vlan
add bridge=bridge untagged=bridge vlan-ids=1
add bridge=bridge tagged=ether1,ether2,ether3,ether4,ether5,ether6,ether7,ether8,ether9,ether10,ether11,ether12,ether13,ether14,ether16,sfp-sfpplus1,sfp-sfpplus2,bridge untagged=ether15 vlan-ids=2
add bridge=bridge tagged=bridge,ether1,ether2,ether3,ether4,ether5,ether6,ether7,ether8,ether9,ether10,ether11,ether12,ether13,ether14,ether16,sfp-sfpplus1,sfp-sfpplus2 vlan-ids=6
add bridge=bridge tagged=bridge,ether1,ether2,ether3,ether4,ether5,ether6,ether7,ether8,ether9,ether10,ether11,ether12,ether13,ether14,ether16,sfp-sfpplus1,sfp-sfpplus2 vlan-ids=7
The CAP needs to have the IP on another VLAN that is not VLAN1. Currently the VLAN6 works and I can access the main wifi network, but trying to add the new vlan7 for guests does not work.