CAPsMAN, vlans and "SSID not set"

RouterOS Wireless Networking
1

I had an idea use my 3 Mikrotik devices to cover al rooms with wifi, client transition to stronger wifi and connect wired devices like PC to ap.

All devices has same routeros version 7.23.2:
hap ax3 - main router
hap ac2 - ap+switch
hap be lite - ap+switch

3x Wifi pretty standard: Home, IOT, Guest.

Every subnet in different vlan and all ethernet ports on all devices are basically at home network.

Home - vlan 12 - 10.12.12.0/24
IOT - vlan 13 - 10.13.13.0/24
Guest - vlan 16 - 192.168.16.0/24

After configuration according to documentation and checks with different examples I still cannot figure out configuration that works for all 3 devices together.

From ethernet perspective all works as expected with trunk(tagged) and access(untagged) ports.
All devices with ethernet connection are correctly in vlan12 and have addresses with dhcp and internet connectivity.

Wifi

Home - 2GHz+5Ghz
IOT - 2GHz only
Guest - 5Ghz only

main router have local config right now since I still do not understand how config from 3 devices with smooth transition must work:

local config on router + capsman handles APs
or
capsman handles all 3 devices(CAP+CAPsMAN working on ax3 together)

I read WiFi - RouterOS - MikroTik Documentation and it is basically result of this documentation reading with additional vlan configuration on ethernet ports.

Right now wifi works on main device and CAPsMAN trying configure APs. They see each other and I have message wifi interfaces are managed by CAPsMAN but SSID not set.

image
image714×329 52.1 KB

Can someone check what is wrong with my config and how to fix it for my scenario?

=====hap ax3 - wifi-qcom
/interface bridge
add admin-mac=48:A9:8A:E5:8F:7D auto-mac=no comment=defconf frame-types=admit-only-vlan-tagged name=bridge pvid=12 vlan-filtering=yes
/interface wifi
# operated by CAP CC:2D:E0:92:00:A3%vlan_home, traffic processing on CAP
# SSID not set
add disabled=no name=cap-wifi3 radio-mac=CC:2D:E0:92:00:A8
# operated by CAP CC:2D:E0:92:00:A3%vlan_home, traffic processing on CAP
# SSID not set
add disabled=no name=cap-wifi4 radio-mac=CC:2D:E0:92:00:A7
# operated by CAP D0:EA:11:CA:57:81%vlan_home, traffic processing on CAP
add disabled=no mac-address=D2:EA:11:CA:57:84 mld-name=mld-d0ea11ca5784 name=mld-cap-wifi1
/interface vlan
add comment=Guests interface=bridge name=vlan_guest vlan-id=16
add comment=Home interface=bridge name=vlan_home vlan-id=12
add comment=IoT interface=bridge name=vlan_iot vlan-id=13
/interface wifi
# operated by CAP D0:EA:11:CA:57:81%vlan_home, traffic processing on CAP
# SSID not set
add disabled=no mld-interface=mld-cap-wifi1 name=cap-wifi1 radio-mac=D0:EA:11:CA:57:84
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wifi channel
add band=5ghz-ax frequency=5180 name=5GHZ::CH36 width=20mhz
add band=5ghz-ax frequency=5200 name=5GHZ::CH40 width=20mhz
add band=5ghz-ax frequency=5220 name=5GHZ::CH44 width=20mhz
add band=5ghz-ax frequency=5240 name=5GHZ::CH48 width=20mhz
add band=5ghz-ax disabled=no frequency=5180,5200,5220,5240 name=5GHZ::UNII-1 width=20mhz
add band=2ghz-ax frequency=2412 name=2GHZ::CH1 width=20mhz
add band=2ghz-ax frequency=2437 name=2GHZ::CH6 width=20mhz
add band=2ghz-ax frequency=2462 name=2GHZ::CH11 width=20mhz
add band=2ghz-ax disabled=no frequency=2412,2437,2462 name=2GHZ::AUTO width=20mhz
/interface wifi datapath
add bridge=bridge client-isolation=yes disabled=no name=datapath_guest vlan-id=16
add bridge=bridge disabled=no name=datapath-home vlan-id=12
add bridge=bridge client-isolation=yes disabled=no name=datapath-iot vlan-id=13
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disabled=no ft=yes ft-over-ds=yes name=secwifi_iot
add authentication-types=wpa2-psk,wpa3-psk disabled=no ft=yes ft-over-ds=yes name=secwifi_home
add authentication-types=wpa2-psk,wpa3-psk disabled=no ft=yes ft-over-ds=yes name=secwifi_guest
/interface wifi configuration
add channel=5GHZ::UNII-1 country=Czech datapath=datapath_guest disabled=no mode=ap name=cfg-guest security=secwifi_guest ssid=Guest
add channel=2GHZ::AUTO country=Czech datapath=datapath-iot disabled=no mode=ap name=cfg-iot security=secwifi_iot ssid=IOT
add country=Czech datapath=datapath-home disabled=no mode=ap name=cfg-home security=secwifi_home ssid=Home
/interface wifi
set [ find default-name=wifi1 ] channel.skip-dfs-channels=10min-cac configuration=cfg-guest configuration.mode=ap disabled=no name=wifi-guest security.ft=yes .ft-over-ds=yes
add configuration=cfg-home configuration.mode=ap disabled=no mac-address=4A:A9:8A:E5:8F:81 master-interface=wifi-guest name=wifi-home::5Ghz
set [ find default-name=wifi2 ] channel=2GHZ::AUTO channel.band=2ghz-ax .skip-dfs-channels=10min-cac configuration=cfg-iot configuration.mode=ap disabled=no name=wifi_iot security.ft=yes .ft-over-ds=\
    yes
add configuration=cfg-home configuration.mode=ap disabled=no mac-address=4A:A9:8A:E5:8F:82 master-interface=wifi_iot name=wifi-home::2GHz
/ip pool
add comment=Home name=pool_home ranges=10.12.12.10-10.12.12.250
add comment=IOT name=pool_iot ranges=10.13.13.10-10.13.13.250
add comment=Guest name=pool_guest ranges=192.168.16.10-192.168.16.250
/ip dhcp-server
add address-pool=pool_home interface=vlan_home name=dhcp_home
add address-pool=pool_guest interface=vlan_guest name=dhcp_guest
add address-pool=pool_iot interface=vlan_iot name=dhcp_iot
/interface wifi
# operated by CAP D0:EA:11:CA:57:81%vlan_home, traffic processing on CAP
# SSID not set
add configuration=*9 disabled=no mld-interface=mld-cap-wifi1 name=cap-wifi2 radio-mac=D0:EA:11:CA:57:85
/interface bridge port
add bridge=bridge interface=ether2 pvid=12
add bridge=bridge interface=ether3 pvid=12
add bridge=bridge frame-types=admit-only-vlan-tagged interface=ether4
add bridge=bridge frame-types=admit-only-vlan-tagged interface=ether5
add bridge=bridge interface=wifi-guest pvid=16
add bridge=bridge interface=wifi_iot pvid=13
add bridge=bridge interface=wifi-home::2GHz pvid=12
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge tagged=bridge,ether4,ether5,wifi-guest vlan-ids=16
add bridge=bridge tagged=bridge,ether4,ether5,wifi-home::2GHz,wifi-home::5Ghz untagged=ether2,ether3 vlan-ids=12
add bridge=bridge tagged=bridge,ether4,ether5,wifi_iot vlan-ids=13
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
/interface wifi cap
set certificate=request discovery-interfaces=lo,vlan_home
/interface wifi capsman
set enabled=yes interfaces=vlan_home
/interface wifi provisioning
add action=create-dynamic-enabled disabled=no master-configuration=cfg-iot slave-configurations=cfg-home supported-bands=2ghz-ax
add action=create-dynamic-enabled disabled=no master-configuration=cfg-guest slave-configurations=cfg-home supported-bands=5ghz-ax
/ip address
add address=10.12.12.1/24 comment=Home interface=vlan_home network=10.12.12.0
add address=10.13.13.1/24 comment=IoT interface=vlan_iot network=10.13.13.0
add address=192.168.16.1/24 comment=Guest interface=vlan_guest network=192.168.16.0
add address=127.0.0.1/8 interface=lo network=127.0.0.0
/ip dhcp-client
add comment=defconf interface=ether1 name=client1
/ip dhcp-server network
add address=10.12.12.0/24 comment=net_home dns-server=10.12.12.1 gateway=10.12.12.1
add address=10.13.13.0/24 comment=net_iot dns-server=10.13.13.1 gateway=10.13.13.1
add address=192.168.16.0/24 comment=net_guest dns-server=192.168.16.1 gateway=192.168.16.1
/ip dns
set allow-remote-requests=yes servers=94.140.14.14,94.140.15.15 use-doh-server=https://dns.adguard-dns.com/dns-query verify-doh-cert=yes


=====hap ac2 - wifi-qcom-ac
/interface bridge
add admin-mac=CC:2D:E0:92:00:A3 auto-mac=no comment=defconf frame-types=admit-only-vlan-tagged igmp-snooping=yes name=bridge pvid=12 vlan-filtering=yes
/interface wifi
# managed by CAPsMAN 48:A9:8A:E5:8F:7D%vlan_home, traffic processing on CAP
set [ find default-name=wifi1 ] configuration.manager=capsman .mode=ap disabled=no
# managed by CAPsMAN 48:A9:8A:E5:8F:7D%vlan_home, traffic processing on CAP
set [ find default-name=wifi2 ] configuration.manager=capsman .mode=ap disabled=no
/interface ethernet
set [ find default-name=ether1 ] l2mtu=1598
set [ find default-name=ether2 ] l2mtu=1598
set [ find default-name=ether3 ] l2mtu=1598
set [ find default-name=ether4 ] l2mtu=1598
set [ find default-name=ether5 ] l2mtu=1598
/interface vlan
add interface=bridge name=vlan_guest vlan-id=16
add interface=bridge name=vlan_home vlan-id=12
add interface=bridge name=vlan_iot vlan-id=13
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface bridge port
add bridge=bridge interface=ether2 pvid=12
add bridge=bridge interface=ether3 pvid=12
add bridge=bridge interface=ether4 pvid=12
add bridge=bridge interface=ether5 pvid=12
add bridge=bridge frame-types=admit-only-vlan-tagged interface=ether1
add bridge=bridge interface=wifi2 pvid=16
add bridge=bridge interface=wifi1 pvid=13
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge tagged=bridge,ether1 untagged=wifi1 vlan-ids=13
add bridge=bridge tagged=ether1,bridge untagged=ether2,ether3,ether4,ether5 vlan-ids=12
add bridge=bridge tagged=bridge,ether1 untagged=wifi2 vlan-ids=16
/interface list member
add interface=bridge list=LAN
add interface=ether1 list=WAN
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
add interface=ether5 list=LAN
/interface wifi cap
set certificate=request discovery-interfaces=vlan_home,bridge enabled=yes slaves-static=yes
/ip address
add address=10.12.12.3/24 interface=vlan_home network=10.12.12.0
/ip dns
set allow-remote-requests=yes servers=10.12.12.1
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=10.12.12.1 routing-table=main

=====hap be lite - wifi-mediatek
 /interface bridge
add admin-mac=D0:EA:11:CA:57:81 auto-mac=no comment=defconf frame-types=admit-only-vlan-tagged igmp-snooping=yes name=bridge vlan-filtering=yes
/interface wifi
add configuration.mode=ap disabled=no mac-address=00:00:00:00:00:00 mld-name=mld1 name=mld1
/interface vlan
add interface=bridge name=vlan_guest vlan-id=16
add interface=bridge name=vlan_home vlan-id=12
add interface=bridge name=vlan_iot vlan-id=13
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wifi datapath
add bridge=bridge disabled=no name=cap-datapath
/interface wifi
# managed by CAPsMAN 48:A9:8A:E5:8F:7D%vlan_home, traffic processing on CAP
set [ find default-name=wifi1 ] channel.band=2ghz-be .skip-dfs-channels=10min-cac .width=20/40mhz configuration.manager=capsman .mode=ap datapath=cap-datapath \
    disabled=no mld-interface=mld2 security.authentication-types=wpa2-psk,wpa3-psk .ft=no .ft-over-ds=no
# managed by CAPsMAN 48:A9:8A:E5:8F:7D%vlan_home, traffic processing on CAP
set [ find default-name=wifi2 ] channel.band=5ghz-be .skip-dfs-channels=10min-cac .width=20/40/80mhz configuration.manager=capsman .mode=ap datapath=cap-datapath \
    disabled=no mld-interface=mld2 security.authentication-types=wpa2-psk,wpa3-psk .ft=no .ft-over-ds=no
/interface bridge port
add bridge=bridge interface=ether2 pvid=12
add bridge=bridge interface=ether3 pvid=12
add bridge=bridge interface=ether4 pvid=12
add bridge=bridge frame-types=admit-only-vlan-tagged interface=ether1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge tagged=bridge,ether1 vlan-ids=13
add bridge=bridge tagged=bridge,ether1 untagged=ether2,ether3,ether4 vlan-ids=12
add bridge=bridge tagged=bridge,ether1 vlan-ids=16
/interface list member
add interface=bridge list=LAN
add interface=ether1 list=WAN
add interface=ether2 list=LAN
add interface=ether3 list=LAN
add interface=ether4 list=LAN
/interface wifi cap
set certificate=request discovery-interfaces=vlan_home enabled=yes slaves-datapath=cap-datapath
/ip address
add address=10.12.12.2/24 interface=vlan_home network=10.12.12.0
/ip dns
set servers=10.12.12.1
/ip route
add disabled=no dst-address=0.0.0.0/0 gateway=10.12.12.1 routing-table=main

P.S. Do I need specific firewall rules to make this happen or remove something?
Right now all block/drop rules I disabled to avoid possible blocking or router. APs do not have any firewall rules.

2

@mexna You are mixing 2 types of configurations: qcom/mediatek and qcom-ac.

It causes problems and headaches, especially if you wish to have 3 SSIDs (VLANs). The most problematic part of provisioning is qcom-ac for 3 SSIDs, and the provisioning combination with qcom/mediatek.

The best idea would be to forget provisioning the AP to the qcom-ac device, set this deviece as a router without provisioning any SSIDs, and only have the AP on ax3 and be-lite.

So the device set is:

  • hap ac2 - main router + switch
  • hap ax3 - ap+switch
  • hap be-lite - ap+switch

Then it would be much easier to help you. If you still wish to have all 3 devices working as APs, I'm also suggesting setting device roles as I do. Next, please don't forget that, if you're on AP and it's not under your control, you lose roaming and all related benefits.

Also, setting the SSID constants

It's interesting, but you are also losing some benefits.

3

I didn't cross chip types, but do have a working varying SSIS config with multiple AP models. It was a bit more complex, but I created a provisioning rule per radio/MAC, which let me drop each AP/radio on a desired frequency and SSID(s). With differing hardware, this would also allow device specific settings, as opposed to stumbling over incompatible settings between devices. Judicious use of the various tables allows reuse of configs, etc. - the combos provisioned become unique.

4

Though you are referring to the correct link, you also did read the remarks about wifi-qcom-ac:

And also the adjustments required on the CAPsMAN, directly underneath?
In the wifi-qcom-ac world, you would have an additional datapath (and corresponding extra settings:

/interface wifi datapath
add bridge=br name=DP_AC
/interface wifi configuration
add datapath=DP_AC name=MAIN_AC security=Security_MAIN ssid=MAIN_Network
add datapath=DP_AC name=GUEST_AC security=Security_GUEST ssid=GUEST_Network
/interface wifi provisioning
add action=create-dynamic-enabled master-configuration=MAIN_AC slave-configurations=GUEST_AC supported-bands=5ghz-ac
add action=create-dynamic-enabled master-configuration=MAIN_AC slave-configurations=GUEST_AC supported-bands=2ghz-n
5

Lets skip AC part for now.
Step 1 - VLAN+CAPSMAN in configuration AX3+BE

I have feeling example vlan + wifi-qcom is misleading.

From documentation
=== CAPSMAN
In this example, we will assign VLAN10 to our main SSID, and will add VLAN20 for the guest network, ether5 from CAPsMAN is connected to CAP.
/interface bridge
add name=br vlan-filtering=yes
/interface bridge vlan
add bridge=br tagged=br,ether5,ether4,ether3,ether2 vlan-ids=20
add bridge=br tagged=br,ether5,ether4,ether3,ether2 vlan-ids=10

so ether5 is trunk. Ok.
I do not see "admit-all" with vlan-filtering enabled, assuming admit-all is by default.
My expectation then you working with vlans is frame-types=admit-only-vlan-tagged. Traffic from trunk port must be always tagged without native vlan and I do not see it in config.

=== CAP using "wifi-qcom" package
CAP using "wifi-qcom" package configuration has zero reference to vlans.
How ether2 add to vlan 10 and ether3 to vlan 20 on CAP in that example and do not destroy wifi configuration?

I simply do not understand how it can work in that configuration connecting to trunk port.

=== CAP using "wifi-qcom-ac" package
I see vlans, trunk. Even I failed with wifi right now it still make more sense as example.

6

I would start with simple "flat" WiFi CAPSMAN based configuration. No VLANs or any "advanced" settings. The next step should be "VLANing" to avoid tweaking WiFi to "repair" VLAN or vice-versa.

7

CAPsMAN sending SSID and provision be lite. I see them, but clients are not able to connect.
It does not look like auth error and definitely not on dhcp stage.
Message from ipad/iphone are just "unable to connect" which most probably 4way handshake failing.
I reconfigure several times with different options of datapath/security/roaming, to eliminate different options.

Now I have suspicion on firmware itself.

P.S as cherry on the top ac2 collapses with wifi-qcom-ac because of low disk space.

8

Are your clients be? I had an issue rolling out ax sincenthe full freq list on the Mikrotik used frequencies that my ac clients could not use. I set up a channel table, and that resolved it.

Looked exactly the same . . .