hAp ax S keeps disconnecting clients

RouterOS Wireless Networking
1

Hi,

I have recently upgraded my home network to 1x hAp Ax3 (ROS7.22 stable, router, Capsman controller) and 2x hAp Ax S (ROS7.23rc4)as caps. Network is generally working, including roaming etc. However, the clients connected to the hAp Ax S keep disconnecting. Upon disconnecting, they will be unable to connect for a few mins and then it works again. Intel AX201 works the worst of all clients, while Pixel 8 works almost perfectly.

Oddly, when I change anything in the Capsman config and provision, all disconnected devices immediately reconnect and work well for a few minutes, until disconnecting again.

Have tried disabling WPA3, disabling FT, disabling FT over DS, avoid DFS channels and upgrading Caps to ROS7.23rc4 from 7.22 stable but nothing helps. Any ideas?

Capsman config:

# 2026-05-24 22:57:36 by RouterOS 7.22
# software id = R7LG-EWRF
#
# model = C53UiG+5HPaxD2HPaxD
# serial number = xxx
/interface bridge
add admin-mac=xxx auto-mac=no comment=defconf name=bridge
/interface wireguard
add listen-port=13231 mtu=1420 name=wg1
/interface ethernet switch
set 0 cpu-flow-control=yes
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wifi configuration
add disabled=no name=cfg-home security.authentication-types=wpa2-psk,wpa3-psk \
    .ft=yes .ft-mobility-domain=0x1 .ft-over-ds=yes ssid=MikroTik
/interface wifi
set [ find default-name=wifi1 ] configuration=cfg-home configuration.mode=ap \
    disabled=no
set [ find default-name=wifi2 ] configuration=cfg-home configuration.mode=ap \
    disabled=no
/interface wifi datapath
add bridge=bridge disabled=no name=dp-home
/ip pool
add name=default-dhcp ranges=192.168.88.10-192.168.88.254
/ip dhcp-server
add address-pool=default-dhcp interface=bridge name=defconf
/system script
add comment=defconf dont-require-permissions=no name=dark-mode owner=*sys \
    policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    source="\r\
    \n   :if ([system leds settings get all-leds-off] = \"never\") do={\r\
    \n     /system leds settings set all-leds-off=immediate \r\
    \n   } else={\r\
    \n     /system leds settings set all-leds-off=never \r\
    \n   }\r\
    \n "
add comment=defconf dont-require-permissions=no name=wps-accept owner=*sys \
    policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
    source="\r\
    \n   :foreach iface in=[/interface/wifi find where (configuration.mode=\"a\
    p\" && disabled=no)] do={\r\
    \n     /interface/wifi wps-push-button \$iface;}\r\
    \n "
/disk settings
set auto-media-interface=bridge auto-media-sharing=yes auto-smb-sharing=yes
/interface bridge port
add bridge=bridge comment=defconf interface=ether2
add bridge=bridge comment=defconf interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether1
add bridge=bridge comment=defconf interface=wifi1
add bridge=bridge comment=defconf interface=wifi2
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether5 list=WAN
add interface=wg1 list=LAN
/interface wifi cap
set caps-man-addresses=127.0.0.1 discovery-interfaces=lo enabled=yes
/interface wifi capsman
set enabled=yes interfaces=bridge
/interface wifi provisioning
add action=create-dynamic-enabled disabled=no master-configuration=cfg-home
/interface wireguard peers
add allowed-address=192.168.89.3/32 client-address=192.168.89.3/32 \
    client-dns=192.168.88.1 client-endpoint=xxx \
    endpoint-port=13231 interface=wg1 name=Thinkpad public-key=\ xxx
add allowed-address=192.168.89.4/32 client-address=192.168.88.4/32 \
    client-dns=192.168.88.1 client-endpoint=xxx \
    interface=wg1 name=Pixel public-key=\xx
add allowed-address=192.168.89.5/32 client-address=192.168.89.5/32 \
    client-dns=192.168.88.1 client-endpoint=xxx \
    endpoint-port=13231 interface=wg1 name="Laptop" public-key=\xxx
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=\
    192.168.88.0
add address=192.168.89.1/24 interface=wg1 network=192.168.89.0
/ip cloud
set ddns-enabled=yes
/ip dhcp-client
add comment=defconf default-route-tables=main interface=ether5 name=ether1
/ip dhcp-server network
add address=192.168.88.0/24 comment=defconf dns-server=192.168.88.1 gateway=\
    192.168.88.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.88.1 comment=defconf name=router.lan type=A
add address=192.168.88.1 name=router.eymatt type=A
/ip firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input comment="Allow WireGuard" dst-port=13231 \
    in-interface=ether5 protocol=udp
add action=accept chain=forward comment="Allow WG to Internet" in-interface=\
    wg1 out-interface=ether5
add action=accept chain=forward comment="Allow WG to Internet" in-interface=\
    wg1 out-interface=bridge
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN
add action=masquerade chain=srcnat comment="WG clients NAT" out-interface=\
    ether5 src-address=192.168.89.0/24
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" \
    dst-port=33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=fasttrack-connection chain=forward comment="defconf: fasttrack6" \
    connection-state=established,related
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-name=Europe/Zurich
/system identity
set name=xxx
/system routerboard mode-button
set enabled=yes on-event=dark-mode
/system routerboard wps-button
set enabled=yes on-event=wps-accept
/tool bandwidth-server
set enabled=no
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

Cap config:

2026-05-24 23:06:10 by RouterOS 7.23rc4

software id = E9C8-QU6N



model = E62iUGS-2axD5axT

serial number = xxx

/interface bridge
add admin-mac=xxx auto-mac=no comment=defconf name=bridgeLocal
/interface wifi datapath
add bridge=bridgeLocal comment=defconf disabled=no name=capdp
/interface wifi

managed by CAPsMAN xxx%bridgeLocal, traffic processing on CAP

mode: AP, SSID: xxx, channel: 2472/ax/eC

set [ find default-name=wifi1 ] configuration.manager=capsman .mode=ap 
datapath=capdp disabled=no name=xxx

managed by CAPsMAN xxx%bridgeLocal, traffic processing on CAP

mode: AP, SSID: xxx, channel: 5320/ax/eeeeeeeC/DI

set [ find default-name=wifi2 ] configuration.manager=capsman .mode=ap 
datapath=capdp disabled=no name=xxx
/interface bridge port
add bridge=bridgeLocal comment=defconf interface=ether1
add bridge=bridgeLocal comment=defconf interface=ether2
add bridge=bridgeLocal comment=defconf interface=ether3
add bridge=bridgeLocal comment=defconf interface=ether4
add bridge=bridgeLocal comment=defconf interface=ether5
add bridge=bridgeLocal comment=defconf interface=sfp1
/interface wifi cap
set discovery-interfaces=bridgeLocal enabled=yes slaves-datapath=capdp
/ip dhcp-client
add comment=defconf interface=bridgeLocal name=client1
/system clock
set time-zone-name=Europe/Zurich
/system identity
set name=xxx
2

hAP ax S as device is in its infancy ... and so is wifi driver (wifi-mediatek). Unfortunately this means instability (we've seen the same when ax devices and ax drivers came through) ... and hopefully thigs will get better in upcoming ROS releases. So your only hope is to run development ROS (beta/RC) and see if things become better ... and by all means do provide feedback (in release-specific threads, such as V7.23rc [testing] is released!) which would give MT developers much needed information on what needs to be improved.

3

Well, you're running 7.22 on capsman. Regarding the Intel clients issue:

What's new in 7.22.2 (2026-Apr-22 11:03):

*) wifi-mediatek - fixed communication issues on 802.11ax access points with Intel clients;
*) wifi-mediatek - fixed HE capabilities IE

You should also Upgrade capsman to latest. We don't know whether these fixes are on driver level or on wifi module level.

4

Have upgraded capsam to 7.23rc4. Issues remains unchanged. Any ideas?

5

Am a bit stumped that MT will release a device that is basically unusable with 50% of my devices. Anyway - what specific info does need to be posted for devs to address the problem? Logs only show that a devices has disconnected..

6

Stumped or not, track record is such as I described in my previous post. Nobody (even most enthusiastic MT supporters) is happy about it.

Regarding reports: you can describe the problem you're seeing in a forum post ... probably it's best to keep a separate thread (i.e. the current one) but post a link to it in the release thread in announcements, it might increase probability for MT staff to notice it.

Another possibility is to create a support ticket with MT(see https://mikrotik.com/support) ... and create a supout.rif file at the moment when the problem is acute (e.g. while device is trying to connect and another one just after device disconnected). It might show MT where the problem is (in case they can't replicate it themselves).

7

This. Usually this is what support requests from you in their first reply. So be one step ahead and provide supout.rif "when issue occurs" right away.

8

For Intel Wi-Fi install modded drivers from techpowerup. Also you need set frequency in range of country manually. And try set HotSpot 2.0 to not marked button. Starting from some version of ROS, a bug appeared that activates it, but visually it seems to be turned off by default, which makes the network light up like Passpoint. Also 2472 is weakest frequency and poor handling by most devices.

9

I submitted that a month+ ago.

They reached out this morning. I explained that I am working on a problem with Cambium and that I can't disconnect it as the problem I am looking for seems to be culminative.

I agreed to generate them some more support files with the wAP AX and hEX AX S once cambium has what they need.

@Flo2 Mikrotik has a long documented history of client serving wifi issues.

It took 6 years for them to switch to chip set drivers rather than their hand written one, that was riddled with bugs.

You want a hobby... Mikrotik wireless will keep you busy.

You want a wifi solution that "WORKS" look elsewhere.

10

Cambium for example? :grimacing:

11

@infabo
I could point to the over 1000 Ruckus ACv2 units that have been deployed since 2020 that I have never had a single ticket on. A considerable number of those went in back when Mikrotik wouldn't let go of their hand rolled drivers. (A good amount of them I had to put in at personal expense when Mikrotik couldn't fix their interference problems and radios going into "stuck beacon".)

But the Cambium APs are closer to the price of Mikrotiks. And once we found the problem in the 6.x firmware on the WiFI6 APs... In 2022... hundreds of APs that "don't generate tickets" have been doing their thing.

The Problem I am chasing with Cambium is with there 7.x firmware. Which coincides with their wifi 7 APs.