Does capsman support vlans?

RouterOS Wireless Networking
1

Are vlans support for capsman on routeros 7 with the qcom and qcom-ac drivers?

I have a router and two cap ac access points.

The router has radius and connecting the access points to it worked well but roaming did not work and I had to manually connect to the stronger wifi with the same ssid and radius credentials.

I then switched to capsman and my router can see the access points, but the access points can't get the ssid from the server.

What steps do I need to follow to set this up in a network with multiple vlans?

2

Have you checked manual pages ?

The answer is yes.

3

Yes for qcom, partially for qcom-ac. But this is all described in more detail in the manual.

4

Thanks for the link from the manual …. there is a good guest-wifi example where the cap is connected to ether5.

But why does the VLAN setting on the bridge look like this?

/interface/bridge/vlan

add bridge=br tagged=br,ether5,ether4,ether3,ether2 vlan-ids=20

add bridge=br tagged=br,ether5,ether4,ether3,ether2 vlan-ids=10

Doesn't that turn all ports into trunk ports?

br Richard

5

The first issue was not delegating control to capsman in the wifi settings:

/interface wifi
set [ find default-name=wifi1 ] configuration.manager=capsman disabled=no
set [ find default-name=wifi2 ] configuration.manager=capsman disabled=no

Source: WiFi - RouterOS - MikroTik Documentation

Connection still failing but I can at least see the SSIDs, so its probably a RADIUS issue now.

6

I can see the cap acs connected on the router but they can't get SSIDs.

Do you see a mistake with how my cap ac is configured? https://drive.google.com/file/d/1_8-PUI_mwe7-scvYCuRs-T4m8OdWUrNQ/view?usp=sharing

7

Take Radius out of the picture on the CAPs altogether and see whether the problem remains. Divide and Rule?

8

Good point, its not Radius. Something is misconfigured on the router or access point still.

9

I had vlans defined on my datapath on the router but my access points were using the qcom-ac driver.

After removing the vlans from the router datapath the connections work. Problem solved.

10

When using qcom-ac drivers, can I use one ssid with multiple vlans? From what I read I must configure the vlan on the wifi interface on the access point (limitation of qcom-ac driver) but can I actually add multiple pvids to one ssid?

11

I cannot see a use case where this makes sense. The SSID is a gateway to a specific set of permissions, for which 1 vLAN should be enough

12

I don't use MikroTik WiFi offers so I can not talk about RouterOS specific configuration, but having multiple VLANs per SSID is very useful. For phones/laptops/tablets you can setup WPA (2/3) Enterprise and with a single SSID put each clients in their custom VLAN based on their individual credentials or certificates. No need to worry about random MAC addresses. Especially for kids' devices because you can gives individual scheduled restrictions per kid, without fearing them sharing password with each other. Put kid A in VLAN 501, kid B in VLAN 502, and you can easily give them separate bandwidth and online time restrictions.

Even for dumber devices that don't know about WPA Enterprise, you can enable features like PPSK and with a single SSID put IoT devices, TVs, and guests in multiple different VLANs, based on the passphrase used (only WPA2 supported though).

In the end your home might only need two SSID while using many more VLANs than that. And the clents' credentials can be removed / changed one by one without affecting most of the other client devices.

The AP with the single SSID acts as a managed switch with each clent having their own port with own PVID.

13

You seem to understand, but just to clarify: what you refer to as "multiple pvids on one ssid" actually means that the tagging is done inside the wifi driver. This is not supported by the "-ac" version of the driver.

This means that tagging externally (assigning the interface for the given ssid to a given bridge as an untagged port with a given pvid) works fine, but any feature that relies on per-client tagging on the same interface (ssid) either via ppsk or radius doesn't work for "-ac".

This also causes problems with roaming when mixing non-"-ac" and "-ac" devices.

On a more philosophical note, this is a significant limitation, the cause of which I can only guess at: probably it didn't fit on the 16MB flash...

14

Yes, learned that after setting up two access points but I have a few cap ac devices at home so setting up my network to use these.

I wanted to create a guest ssid that would let both iot and guest devices in, each in their own vlan with neighbor blocking so no device can see any others.

But with qcom-ac that is not possible, so the workaround is to have a third 2.4ghz ssid for iot devices. This also preserves the channels for 5ghz as each additional ssid eats up a portion of time you are not able to transmit.

The main reason I went with capsman instead of just radius (which should also do vlan tagging per profile) is to enable roaming.

Thou not getting good results with roaming so far, as when I move around my phone does not drop a weaker connection to connect to the access point that is right next to it.

Tried reducing the transmit power so I get kicked out sooner but the drawback there is that the coverage is lower as well.

But overall the capabilities of routeros 7 and the qcom-ac driver are interesting. Just need to test how well I can set up an ad blocker on the router compared to the one I had on pfsense and opnsense.