I have a cap-ac I was curious to see if I could put it at a remote site as a test.
I remember being able to tell a cap to "connect to" a caps-man on another subnet.
So the cap-ac has the new Qualcom drivers. My RB5009 has the latest WiFi package.
At home I set the cap-ac to caps via the reset option. Came up and I had to make some adjustments because its AC and didn't like some of the AX parameters I have on the 5009. Once that was set I told it the IP address of the controller.
At the remote site there is a persistent wireguard VPN. Anything here can be accessed via IP address.
The cap didn't connect. Even when I told it to ping the 5009 it could. But caps mode... nothing.
Reset the unit and set it up as a standalone AP from zero. That works.
Go to the wireless screen and select cap. NOTHING HAPPENS. That warning screen that the interface is controlled by caps-man never comes up.
Took a cap-ax and tried that same setting. Sure enough... behaves like how I remember caps working back in 2019.
I have 3 cap ax's with 2.4ghz and 5ghz radios, on 2ghz ax it says "operated by cap, traffic processing on cap", on 5ghz ax it says no connection to capsman, managed locally, traffic processed on cap"
For me everything works, as in wifi works and everyone is using it as usual and i have no issues controlling them remotely through rb5009Upr as capsman controller. (Upgrades, configuration changes, provisions...)
It never bothered me and i never cared to "fix" the red text.
I remmember the text itself has something to do with the manager in the "Configuration" tab. i set it to Capsman or local.
So you say the cap was up and running at the rb5009 site a, capsman ip configured explicitly on cap. Took the cap to site b, which is connect to site a via wireguard, and it did not come up.
Correct?
Are there any firewall rules preventing communication? does capsman listen on all interfaces?
That would apply on both ends . . . . The AP side needs to have an appropriate interface defined as well under "CAP". "bridgeLocal" is what mine defaulted to, and if this is on ether1 and not local, seems like it might be the wrong choice . . . . Same as the CapsMan end . . . . if coming in ether1, the default of "bridge" will also likely make it deaf . . . .
@infabo The caps-man controller is on the RB5009 here at home. It is listening on the bridge.
The cap was deployed at a remote site that has a persistent wireguard connection. It was set to listen on its bridge.
The thing that really stand out is how when I select cap and enable it. The radios on the AC unit DO NOT CHANGE to reflect that the unit is supposed to be in caps-mode.
If I winbox to the cap from my office and select tools ping... it can ping the 5009 here no problem.
Do you see log messages on rb5009/capac? it should be "caps" topic. And caps-man-addresses must be set on cap to the IP of rb5009. the usual capsman layer2 discovery does not work over wireguard.
It might be necessary to add firewall rule on CAPsMAN to allow IP connections to capsman from your remote CAP. It seems that it's necessary to allow dst-port=5246,5247 protocol=udp with appropriately limited source address list or in-interface on chain=input. Unless the wireguard interface is made member of LAN interface list (which according to default firewall rules is allowed to access all router's services, including capsman over IP).
hAP AC2 remote router, is the client. cAP AC is attached to the LAN of the hAP AC2.
From the cAP AC I can open tool/telnet and connect to the RB5009.
But I am telling you... I think something else is also wrong. When I select cap mode... NOTHING happens. That warning you get that the radio is in caps-mode DOES NOT SHOW UP.
When I try that on the wAP AX I have here, I see the red warning right away.
Which action exactly do you perform? I guess that enabling CAP mode after wireguard is up&running using QuickSet is way beyond what QuickSet is capable of doing properly.
I was never careful enough (because making device a CAP always worked for me from the first try), but could it be that this message gets shown only after CAP can access CAPsMAN (which usually is over L2 by means of broadcasts)?
/interface wifi cap
set caps-man-addresses=172.16.14.1 certificate=request discovery-interfaces=
bridge enabled=yes
And it doesn't matter if a cap is detected. In old caps-man and with the AX units... as soon as you enable caps-mode the radios reflect that they are looking for a caps-manager.