Hey guys,
I’m reading the documentation and watching all the videos, but I’m still unsecure how to proceed.
I have an existing Mikrotik router (RB3011UiAS) with multiple wap AC’s (RBwAPG-5HacT2HnD), configured over CAPsMAN.
I’ve bought a new wap AX set to CAP’s mode (routeros and wifi-qcom v7.16.2 installed).
Based on the compatibility list, my old wap AC’s are not compatible with wifi-qcom since they are not ARM based. Correct?
Is this going to work together? If yes, what would be the proper steps to make both working together?
For wifi-qcom-ac you need an ARM based chip (like the wap ac rev 2).
You could run both capsman v2 (aka old capsman. your current one) and wifi capsman (the one for the new wifi-qcom) simultaneously.
Does this mean I will have 2 CAPsMAN configurations on the router?
I see both menus on the router (without running wifi-qcom-ac package on the router). Should I just setup another config under Wifi?
Could I use the same SSID’s for both configurations and switching between them will work? Or does this refer to “Steering” you mentioned?
Correct
One under Wifi (new AX devices) and one under Wireless (for old AC devices)?
Isn’t there a CAPsMAN menu item? For the old CAPsMAN.
I see both menus on the router (without running wifi-qcom-ac package on the router). Should I just setup another config under Wifi?
Correct
Could I use the same SSID’s for both configurations and switching between them will work? Or does this refer to “Steering” you mentioned?
Correct, this is actually called roaming. And that is up to the client. But it works. Steering is a way to manage connections from the CAPs.
i’ve choose and other way… replace all AC by AX and sell the AC.
One question in regards to the new wifi configuration - i’m trying to replicate my settings.
I have two SSIDs (2 configurations with different datapats and security profiles).
In the old wireless settings there was no need to declare the configurations to the radios.
Now it appears you need to do so under “wifi”. But you can only select one configuration per single wifi (screenshot attached).
neki
January 5, 2025, 12:14pm
8
Can you please post your configuration?
In terminal use:
export file=AnyNameYouWish
(.rsc file extension will be added automatically)
Post your config inside code brackets. Remove serial number of your device and any other sensitive information you don’t want to share.
Here is the export config
# 2025-01-08 14:01:27 by RouterOS 7.16.2
# software id = PGLT-I7Z4
#
# model = RB3011UiAS
/caps-man channel
add band=2ghz-b/g/n control-channel-width=20mhz frequency=2412 name=channel1
add band=2ghz-b/g/n control-channel-width=20mhz frequency=2437 name=channel6
add band=2ghz-b/g/n control-channel-width=20mhz frequency=2462 name=channel11
add band=2ghz-b/g/n control-channel-width=20mhz frequency=2472 name=channel13
add band=5ghz-a/n/ac control-channel-width=20mhz frequency=5180 name=\
channel36
add band=5ghz-a/n/ac control-channel-width=20mhz frequency=5260 name=\
channel52
add band=5ghz-a/n/ac control-channel-width=20mhz frequency=5540 name=\
channel108
add band=5ghz-a/n/ac control-channel-width=20mhz frequency=5640 name=\
channel128
add band=5ghz-a/n/ac control-channel-width=20mhz frequency=5700 name=\
channel140
add band=5ghz-a/n/ac control-channel-width=20mhz frequency=5825 name=\
channe165
/interface bridge
add admin-mac=XXXXXXXXXXXX auto-mac=no comment=defconf name=\
"bridge 1 (home)" port-cost-mode=short
add name="bridge 2 (public)" port-cost-mode=short
/interface ethernet
set [ find default-name=ether1 ] name="eth1 (WAN)"
set [ find default-name=ether2 ] name="eth2 (LAN)"
set [ find default-name=ether6 ] name=ether6-master
/caps-man datapath
add bridge="bridge 1 (home)" client-to-client-forwarding=yes name=\
"datapath1 (home private)"
add bridge="bridge 2 (public)" client-to-client-forwarding=no name=datapath2
/caps-man security
add authentication-types=wpa2-psk comment="Private WLAN AP" encryption=\
aes-ccm group-encryption=aes-ccm name="security1 (Private)"
add authentication-types=wpa2-psk encryption=aes-ccm group-encryption=aes-ccm \
name="security2"
/caps-man configuration
add comment="Privatno WLAN omrezje" country=slovenia datapath=\
"datapath1 (home private)" mode=ap name="cfg1 (private)" security=\
"security1 (Private)" ssid="MX House"
add comment="Public WLAN za goste" country=slovenia datapath=datapath2 name=\
"cfg2 (public)" security="security2" ssid="MX House Guest"
/interface list
add exclude=dynamic name=discover
add name=mactel
add name=mac-winbox
/interface lte apn
set [ find default=yes ] ip-type=ipv4 use-network-apn=no
/interface wifi datapath
add bridge="bridge 1 (home)" disabled=no name="datapath1 (home private)"
add bridge="bridge 2 (public)" disabled=no name=datapath2
/interface wifi security
add authentication-types=wpa2-psk comment="Private WLAN AP" disabled=no name=\
"security1 (Private)"
add authentication-types=wpa2-psk disabled=no name="security2"
/interface wifi configuration
add comment="Privatno WLAN omrezje" datapath="datapath1 (home private)" \
disabled=no name=cfg1 security="security1 (Private)" ssid="MX House"
add comment="Public WLAN za goste" country=Slovenia datapath=datapath2 \
disabled=no name="cfg2 (public)" security="security2 (gostoljubje)" ssid=\
"MX House Guest"
/interface wifi
add configuration=cfg1 configuration.mode=ap disabled=no name=cap-wifi1 \
radio-mac=XXXXXXXXXX
add configuration=cfg1 configuration.mode=ap disabled=no name=cap-wifi2 \
radio-mac=XXXXXXXXXX
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name="private dhcp pool" ranges=10.0.2.101-10.0.2.254
add name="public dhcp pool" ranges=10.0.5.101-10.0.5.254
/ip dhcp-server
add address-pool="private dhcp pool" interface="bridge 1 (home)" lease-time=\
12h name="DHCP 1 private server"
add address-pool="public dhcp pool" interface="bridge 2 (public)" lease-time=\
12h name="DHCP 2 public server"
/ip smb users
set [ find default=yes ] disabled=yes
/port
set 0 name=serial0
/routing bgp template
set default disabled=no output.network=bgp-networks
/routing ospf instance
add disabled=no name=default-v2
/routing ospf area
add disabled=yes instance=default-v2 name=backbone-v2
/caps-man manager
set ca-certificate=auto certificate=auto enabled=yes upgrade-policy=\
suggest-same-version
/caps-man provisioning
add action=create-dynamic-enabled master-configuration="cfg1 (private)" \
slave-configurations="cfg2 (public)"
/interface bridge port
add bridge="bridge 1 (home)" comment=defconf ingress-filtering=no interface=\
"eth2 (LAN)" internal-path-cost=10 path-cost=10
add bridge="bridge 1 (home)" comment=defconf ingress-filtering=no interface=\
ether6-master internal-path-cost=10 path-cost=10
add bridge="bridge 1 (home)" comment=defconf hw=no ingress-filtering=no \
interface=sfp1 internal-path-cost=10 path-cost=10
add bridge="bridge 2 (public)" hw=no ingress-filtering=no interface=ether9 \
internal-path-cost=10 path-cost=10
add bridge="bridge 1 (home)" hw=no ingress-filtering=no interface=ether3 \
internal-path-cost=10 path-cost=10
add bridge="bridge 1 (home)" ingress-filtering=no interface=ether4 \
internal-path-cost=10 path-cost=10
add bridge="bridge 1 (home)" ingress-filtering=no interface=ether5 \
internal-path-cost=10 path-cost=10
add bridge="bridge 1 (home)" ingress-filtering=no interface=ether7 \
internal-path-cost=10 path-cost=10
add bridge="bridge 1 (home)" ingress-filtering=no interface=ether8 \
internal-path-cost=10 path-cost=10
add bridge="bridge 1 (home)" ingress-filtering=no interface=ether10 \
internal-path-cost=10 path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=discover
/ip settings
set max-neighbor-entries=8192
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface list member
add interface="eth2 (LAN)" list=discover
add interface=ether3 list=discover
add interface=ether4 list=discover
add interface=ether5 list=discover
add interface=sfp1 list=discover
add interface=ether6-master list=discover
add interface=ether7 list=discover
add interface=ether8 list=discover
add interface=ether9 list=discover
add interface=ether10 list=discover
add interface="bridge 1 (home)" list=discover
add interface="bridge 2 (public)" list=discover
add interface="bridge 1 (home)" list=mactel
add interface="bridge 1 (home)" list=mac-winbox
/interface ovpn-server server
set auth=sha1,md5
/interface wifi capsman
set enabled=yes package-path="" require-peer-certificate=no upgrade-policy=\
none
/interface wifi provisioning
add action=create-dynamic-enabled disabled=no master-configuration=cfg1 \
slave-configurations="cfg2 (public)"
/ip address
add address=10.0.2.100/24 interface="bridge 1 (home)" network=10.0.2.0
add address=X.X.X.X/16 interface="eth1 (WAN)" network=X.X.0.0
add address=10.0.5.1/24 comment="Public Network 5.X IPs" interface=\
"bridge 2 (public)" network=10.0.5.0
/ip dhcp-client
add comment=defconf interface="eth1 (WAN)"
/ip dhcp-server network
add address=10.0.2.0/24 dns-server=8.8.8.8 gateway=10.0.2.100 netmask=16
add address=10.0.5.0/24 dns-server=8.8.8.8 gateway=10.0.5.1 netmask=24
/ip dns
set allow-remote-requests=yes servers=8.8.8.8
/ip dns static
add address=10.0.1.88 name=router type=A
/ip firewall filter
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept established,related" \
connection-state=established,related
add action=drop chain=input comment="defconf: drop all from WAN" \
in-interface="eth1 (WAN)"
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related" \
connection-state=established,related
add action=drop chain=forward comment="defconf: drop invalid" \
connection-state=invalid
add action=drop chain=forward comment=\
"defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
connection-state=new in-interface="eth1 (WAN)"
/ip firewall nat
add action=accept chain=input dst-address=10.0.2.5 dst-port=37008 protocol=\
udp src-address=10.0.2.100
add action=masquerade chain=srcnat comment="defconf: masquerade" \
out-interface="eth1 (WAN)"
add action=dst-nat chain=dstnat dst-port=36000 in-interface="eth1 (WAN)" \
protocol=tcp to-addresses=10.0.2.5 to-ports=3389
add action=dst-nat chain=dstnat dst-port=36000 in-interface="eth1 (WAN)" \
protocol=udp to-addresses=10.0.2.5 to-ports=3389
add action=dst-nat chain=dstnat dst-port=36001 in-interface="eth1 (WAN)" \
protocol=tcp to-addresses=10.0.2.5 to-ports=5900
add action=dst-nat chain=dstnat dst-port=36001 in-interface="eth1 (WAN)" \
protocol=udp to-addresses=10.0.2.5 to-ports=5900
add action=accept chain=srcnat
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip smb shares
set [ find default=yes ] directory=/pub
/ip ssh
set allow-none-crypto=yes forwarding-enabled=remote
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface="eth1 (WAN)" type=external
add interface="eth2 (LAN)" type=internal
/lcd
set time-interval=hour
/routing bfd configuration
add disabled=no
/system clock
set time-zone-name=Europe/Ljubljana
/system identity
set name="MikroTik Router"
/system note
set show-at-login=no
/tool mac-server
set allowed-interface-list=mactel
/tool mac-server mac-winbox
set allowed-interface-list=mac-winbox
To use wifi capsman for local radio see /interface/wifi/cap
