hap ac3 as capsman and cap ax3 as cap

RouterOS Wireless Networking
1

Hello.

For some time Ive been struggeling to configure CAPsMAN and CAP with mentioned devices. Finaly, I was able to upgrade hap ac3 to use wifiwave2, which made it possible to cap ax3 to comunicate with capsman. Athough the CAP says its manageg by CAPsMAN, it didnt took any configuration, ssid etc. and wifi is disabled. If I enable cap-wifi’s manually, set configs etc., I cannot connect to wifi network. Also, when CAPsMAN server is enabled I need to manualy enable/disable wifi on CAPsMAN device. Is that correct? Also I want wifi work on both 2.4 and 5 GHz under same SSID and client to client forward on different CAPS to be working. Below is config from CAPsMAN and CAP.

CAPsMAN:

# 2023-10-23 12:56:04 by RouterOS 7.11.2
# software id = C6K5-433Y
#
# model = RBD53iG-5HacD2HnD
# serial number = 
/interface bridge
add admin-mac=DC:2C:6E:11:1A:CF arp=proxy-arp auto-mac=no comment=defconf \
    name=BridgeLAN
/interface ethernet
set [ find default-name=ether1 ] name=ISP
/interface wifiwave2
add name=cap-wifi1
add name=cap-wifi2
add name=cap-wifi3
add name=cap-wifi4
/interface vlan
add interface=ISP name=vlan1 vlan-id=35
/interface pppoe-client
add add-default-route=yes disabled=no interface=vlan1 name=pppoe-out1 \
    use-peer-dns=yes user=8yawzo36@webnet24.pl
/interface list
add name=LAN
add name=WAN
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wifiwave2 security
add authentication-types=wpa2-psk disabled=no encryption="" name=sec1
/interface wifiwave2 configuration
add disabled=no mode=ap name=cfg1 security=sec1 ssid=Mikrotik
/interface wifiwave2
set [ find default-name=wifi1 ] configuration=cfg1 configuration.mode=ap \
    disabled=no security.authentication-types=wpa2-psk
set [ find default-name=wifi2 ] configuration=cfg1 configuration.mode=ap \
    disabled=no security.authentication-types=wpa2-psk .encryption=""
/ip pool
add name=dhcp ranges=192.168.30.20-192.168.30.59
/ip dhcp-server
add address-pool=dhcp interface=BridgeLAN lease-time=10m name=defconf
/routing bgp template
set default disabled=no output.network=bgp-networks
/routing ospf instance
add disabled=no name=default-v2
/routing ospf area
add disabled=yes instance=default-v2 name=backbone-v2
/interface bridge port
add bridge=BridgeLAN comment=defconf ingress-filtering=no interface=ether2
add bridge=BridgeLAN comment=defconf ingress-filtering=no interface=ether3
add bridge=BridgeLAN comment=defconf ingress-filtering=no interface=ether4
add bridge=BridgeLAN comment=defconf ingress-filtering=no interface=ether5
add bridge=BridgeLAN comment=defconf ingress-filtering=no interface=wifi1
add bridge=BridgeLAN comment=defconf ingress-filtering=no interface=wifi2
/ip neighbor discovery-settings
set discover-interface-list=WAN
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface list member
add interface=BridgeLAN list=LAN
add interface=ISP list=WAN
/interface ovpn-server server
set auth=sha1,md5
/interface wifiwave2 cap
set caps-man-addresses=192.168.30.1 discovery-interfaces=BridgeLAN
/interface wifiwave2 capsman
set ca-certificate=auto enabled=yes interfaces=BridgeLAN package-path="" \
    require-peer-certificate=no upgrade-policy=none
/interface wifiwave2 provisioning
add action=create-dynamic-enabled disabled=no master-configuration=cfg1 \
    slave-configurations="" supported-bands=""
/ip address
add address=192.168.30.1/24 comment=defconf interface=BridgeLAN network=\
    192.168.30.0
/ip dhcp-client
add comment=defconf disabled=yes interface=ISP
/ip dhcp-server lease
add address=192.168.30.2 client-id=1:48:a9:8a:e5:be:f8 mac-address=\
    48:A9:8A:E5:BE:F8 server=defconf
add address=192.168.30.3 client-id=1:48:a9:8a:cc:3f:10 mac-address=\
    48:A9:8A:CC:3F:10 server=defconf
/ip dhcp-server network
add address=192.168.30.0/24 comment=defconf gateway=192.168.30.1 netmask=24
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.30.1 comment=defconf name=router.lan
/ip firewall address-list
add address=192.168.30.2-192.168.30.254 list=allowed_to_router
add address=192.168.2.2-192.168.2.100 comment=l2tp list=allowed_to_router
add address=192.168.30.10/31 list=allowed_to_modem
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=\
    192.168.30.1
add action=accept chain=input comment=CAPsMAN port=5246,5247 protocol=udp
add action=accept chain=input comment="l2tp VPN IPSEC" protocol=ipsec-esp
add action=accept chain=input comment="l2tp VPN" dst-port=500,1701,4500 \
    protocol=udp
add action=accept chain=input src-address-list=allowed_to_router
add action=accept chain=input comment="DNS queries-TCP" dst-port=53 \
    in-interface-list=LAN protocol=tcp
add action=accept chain=input comment="DNS for VPN users" dst-port=53 \
    protocol=udp src-address=192.168.2.0/24
add action=accept chain=input comment="DNS for VPN users" dst-port=53 \
    protocol=tcp src-address=192.168.2.0/24
add action=drop chain=input comment="drop all else"
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=accept chain=forward comment="allow internet traffic" \
    in-interface-list=LAN out-interface-list=WAN
add action=accept chain=forward comment="allow remote vpn users to lan" \
    out-interface-list=LAN src-address=192.168.2.0/24
add action=accept chain=forward comment="port forwarding" \
    connection-nat-state=dstnat
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN src-address=\
    192.168.30.0/24
add action=masquerade chain=srcnat dst-address=!192.168.30.1 src-address=\
    192.168.30.0/24 to-addresses=192.168.30.100
add action=dst-nat chain=dstnat dst-address=!192.168.30.1 dst-port=8000 \
    protocol=tcp to-addresses=192.168.30.100 to-ports=8000
add action=masquerade chain=srcnat out-interface-list=WAN src-address=\
    192.168.2.0/24
/routing bfd configuration
add disabled=no interfaces=all min-rx=200ms min-tx=200ms multiplier=5
/system clock
set time-zone-name=Europe/Warsaw
/system identity
set name="MikroTik Filip"
/system leds
set 0 interface=*1 leds=led1,led2,led3,led4,led5 type=\
    wireless-signal-strength
set 1 leds=poe-led type=poe-out
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=WAN
/tool mac-server mac-winbox
set allowed-interface-list=WAN

CAP:

# 2023-10-23 12:58:07 by RouterOS 7.11.2
# software id = LW3R-KRBY
#
# model = cAPGi-5HaxD2HaxD
# serial number = 
/interface bridge
add admin-mac=48:A9:8A:E5:BE:F8 auto-mac=no comment=defconf name=bridgeLocal
/interface wifiwave2 datapath
add bridge=bridgeLocal comment=defconf disabled=no name=capdp
/interface wifiwave2
# managed by CAPsMAN
set [ find default-name=wifi1 ] configuration.manager=capsman datapath=capdp
# managed by CAPsMAN
set [ find default-name=wifi2 ] configuration.manager=capsman datapath=capdp
/interface bridge port
add bridge=bridgeLocal comment=defconf interface=ether1
add bridge=bridgeLocal comment=defconf interface=ether2
/interface wifiwave2 cap
set discovery-interfaces=bridgeLocal enabled=yes slaves-datapath=capdp
/ip dhcp-client
add comment=defconf interface=bridgeLocal
/system clock
set time-zone-name=Europe/Warsaw
/system note
set show-at-login=no
2

Have a look at the help pages for the basic config of capsman.
You’re missing some parts (like e.g. country).

https://help.mikrotik.com/docs/display/ROS/WifiWave2#WifiWave2-CAPsMAN-CAPsimpleconfigurationexample:

CAPS device should normally simply be reset to caps mode and then it should work.

3

Yup, I was missing country but just fixed that. Ive been missing 2.4 =GHz and 5GHz config, assuming it will make it automatically.

Caps were rebooted as caps and still didnt took any configuration from CAPsMAN besides comment "managed by CAPsMAN

4

Judging on your export of config, you’re still missing the provisioning rules.
Check that help page again.

Do the radios show up in Remote Cap (Winbox) ?

5

Here are provisioning rules:

/interface wifiwave2 provisioning
add action=create-dynamic-enabled disabled=no master-configuration=cfg1 \
    slave-configurations="" supported-bands=""

No slave configuration and no supported band, however tried with that and result was the same.

6

You need to specify the supported bands or it will not know what to provision.

Can you export latest version of config please ?

7

Here you are:

# 2023-10-23 15:15:21 by RouterOS 7.11.2
# software id = C6K5-433Y
#
# model = RBD53iG-5HacD2HnD
# serial number = <serial>
/interface wifiwave2
add name=cap-wifi2
add name=cap-wifi3
/interface wifiwave2 security
add authentication-types=wpa2-psk disabled=no encryption="" name=sec1
/interface wifiwave2 configuration
add country=Poland disabled=no mode=ap name=cfg1 security=sec1 ssid=Mikrotik
/interface wifiwave2
set [ find default-name=wifi1 ] configuration=cfg1 configuration.mode=ap disabled=no security.authentication-types=wpa2-psk
set [ find default-name=wifi2 ] configuration=cfg1 configuration.mode=ap disabled=no security.authentication-types=wpa2-psk .encryption=""
/interface wifiwave2 cap
set caps-man-addresses=192.168.30.1 discovery-interfaces=BridgeLAN
/interface wifiwave2 capsman
set ca-certificate=auto enabled=yes interfaces=BridgeLAN package-path="" require-peer-certificate=no upgrade-policy=none
/interface wifiwave2 provisioning
add action=create-dynamic-enabled disabled=no master-configuration=cfg1 slave-configurations="" supported-bands=5ghz-n

Adding suported band made 2 of 4 caps interfaces enable with config automatically. Now the question is about bands. I should support more than -n for 5GHz and for 2.4GHz? Also how to make one visible ssid for 2.4 and 5 GHz?

8

One thing at a time …

2 out of 4 caps:
For local AC3, you WILL have to make the config locally.
Capsman wifiwave2 can not handle local interfaces on the controller.
But it WILL be handled by the same ROS instance so roaming etc will work just fine.

Supported bands for cap AX are … 5Ghz AX and 2GHz AX :laughing:
On AC3 you will have set it locally anyhow, will be 5Ghz AC and 2GHz N or G/N (don’t use b/g/n, makes things too slow. Only use if you really have dinosaur-devices requiring it).

One visible SSID: just set the name and security parameters of the SSID the same for both 2.4 and 5GHz. Simple.
Client devices will themselves choose (for them) optimal network.

/interface wifiwave2
set [ find default-name=wifi1 ] configuration=cfg1 configuration.mode=ap disabled=no security.authentication-types=wpa2-psk
set [ find default-name=wifi2 ] configuration=cfg1 configuration.mode=ap disabled=no security.authentication-types=wpa2-psk > .encryption=“”

Remark on your current config: encryption unselected is not the same as encryption selected but leaving it empty.

9

Okay. I set the bands and provisioning setting and all wifi modules are enabled by itself. Also I see only 1 SSID through whole home which as I wanted. However, my devices cant connect wifi while trying to access CAPs. Will only connect to CAPsMAN. Below is the config of CAPsMAN and CAP.

CAPsMAN

/interface wifiwave2 security
add authentication-types=wpa2-psk disabled=no encryption="" name=sec1
/interface wifiwave2
set [ find default-name=wifi1 ] configuration.country=Poland .mode=ap .ssid=Mikrotik disabled=no security=sec1 security.authentication-types=wpa2-psk
set [ find default-name=wifi2 ] configuration.country=Poland .mode=ap .ssid=Mikrotik disabled=no security=sec1 security.authentication-types=wpa2-psk
/interface wifiwave2 configuration
add country=Poland disabled=no mode=ap name=cfg5ghz security=sec1 ssid=Mikrotik
add country=Poland disabled=no mode=ap name=cfg2ghz security=sec1 ssid=Mikrotik
/interface wifiwave2
add configuration=cfg2ghz disabled=no name=cap-wifi2
add configuration=cfg2ghz disabled=no name=cap-wifi3
/interface wifiwave2 cap
set caps-man-addresses=192.168.30.1 discovery-interfaces=BridgeLAN
/interface wifiwave2 capsman
set ca-certificate=auto enabled=yes interfaces=BridgeLAN package-path="" require-peer-certificate=no upgrade-policy=none
/interface wifiwave2 provisioning
add action=create-dynamic-enabled disabled=no master-configuration=cfg5ghz slave-configurations="" supported-bands=5ghz-ax
add action=create-enabled disabled=no master-configuration=cfg2ghz supported-bands=2ghz-ax



CAP

/interface bridge
add admin-mac=48:A9:8A:E5:BE:F8 auto-mac=no comment=defconf name=bridgeLocal
/interface wifiwave2 datapath
add bridge=bridgeLocal comment=defconf disabled=no name=capdp
/interface wifiwave2
# managed by CAPsMAN
# mode: AP, SSID: Mikrotik, channel: 5500/ax/Ceee
set [ find default-name=wifi1 ] configuration.manager=capsman datapath=capdp disabled=no
# managed by CAPsMAN
# mode: AP, SSID: Mikrotik, channel: 2437/ax/Ce
set [ find default-name=wifi2 ] configuration.manager=capsman datapath=capdp disabled=no
/interface bridge port
add bridge=bridgeLocal comment=defconf interface=ether1
add bridge=bridgeLocal comment=defconf interface=ether2
/interface wifiwave2 cap
set discovery-interfaces=bridgeLocal enabled=yes slaves-datapath=capdp
/ip dhcp-client
add comment=defconf interface=bridgeLocal
/system clock
set time-zone-name=Europe/Warsaw
/system note
set show-at-login=no

EDIT:
So today in the morning I was thinking that lack of connection was somehow problem with getting IP address. I’hve deleted all dhcp and bridge settings in CAP, added it again and voila. Also added wifi interfaces into bridge. CAP works just fine. Below is new CAP config.


/interface bridge
add admin-mac=48:A9:8A:E5:BE:F8 auto-mac=no comment=defconf name=bridgeLocal
/interface wifiwave2 datapath
add bridge=bridgeLocal comment=defconf disabled=no name=capdp
/interface wifiwave2
# managed by CAPsMAN
# mode: AP, SSID: Mikrotik, channel: 5500/ax/Ceee
set [ find default-name=wifi1 ] configuration.manager=capsman datapath=capdp \
    disabled=no
# managed by CAPsMAN
# mode: AP, SSID: Mikrotik, channel: 2437/ax/Ce
set [ find default-name=wifi2 ] configuration.manager=capsman datapath=capdp \
    disabled=no
/interface bridge port
add bridge=bridgeLocal comment=defconf interface=ether1
add bridge=bridgeLocal comment=defconf interface=ether2
/interface wifiwave2 cap
set discovery-interfaces=bridgeLocal enabled=yes slaves-datapath=capdp
/ip dhcp-client
add interface=bridgeLocal
/system clock
set time-zone-name=Europe/Warsaw
/system note
set show-at-login=no

Any idea what have happpend here? Also, I want to thank you, holvoetn, for your help and engagement.