[Partially SOLVED] Completely lost on Mikrotik wireless configuration logic

RouterOS Wireless Networking
1

I need some guidance on how to create/manage SSIDs on my new hap be3 media.

I read through the new documentation on manual.mikrotik.com, but I feel it's missing some crucial details (or maybe it's just me failing to connect the dots). I also did not find any relevent & up-to-date blogs/videos/tutorials online. For context - I work on network management (DNS, DHCP, VLAN, firewall, virtualization, storage, proxies, etc.) in an SMB, partially using Mikrotik hardware, so I configured the wired side of things (with VLANS, firewall, etc.), it's just the wireless that defeated me completely.

I want to create multiple SSIDs: some wifi 7 utilizing all three radios with MLO, some wifi 6 for older clients, some semi-legacy on 2.4 GHz for IoT, etc. So far I only managed to have one SSID running at a time.

The config setup components I understand so far as:

  • radios = physical interfaces
  • mld interfaces - logical devices combining individual radios (to e.g. allow MLO)
  • networks - configurations of individual SSIDs
  • labels - 'tags' for radios used to match netoworks to them? I'm not sure, I haven't found a way to neither assign them to radios nor specify them in networks
  • provisioning - mysterious concept that I found no detailed explanation for. I noticed that when using "provision" command on a radio, it started to broadcast my (so far single) network, but on what logic or how were they matched? I have no clue...

I noticed that one can specify a single SSID directly on radio interface = not what I what since I need multiple SSIDs.

It's possible to create a mld interface and then select it on radios, so that given mld combines them to allow MLO = nice. But it's impossible to have multiple mld's active at the same time (to e.g. have one combining all three radios, one for 2.4+5GHz and one for 5+6GHz)?

I noticed that one can specify a single SSID on mld interface = not what I what since I need multiple SSIDs. Is there a way to 'attach' multiple SSIDs to given mld?

I tried to utilize profiles (by creating named configs for security, datapaths, etc.), but I noticed that when I selected them for my mld (which had SSID & Passphrase specified), at least the Ciphers and Encryption settings from my selected security profile were ignored, so I was serving open network for some time...

It seems that "network" is the way to go, but how am I supposed to match it with desired mld/radio? How does "provision" work?

My apologies for maybe too chaotic set of questions, I tried like a hundred combinations so far and neither does what I want. It would be nice to have some "clear path" for my desired setup, which to me doesn't seem that complicated, so I'm a bit astonished it's so unclear (but maybe it's just a me problem and other do not have such issues).

2

Just as an update (not yet a true solution that would satisfy me) - I managed to host more than one SSID, while keeping full control over frequency/band of each wifi. For that I've:

  • created an mld interface (by setting its MLD Name) specyfing all 'logical' (SSID, security, mlo, etc.) aspects of my first wifi
  • created a set of three wifi 'master' interfaces (one for each radio) by giving them the same MAC Address as the physical radios, and I've set the mld from point above as their MLD Interface, which made my first SSID appear - this time with proper security
  • created another set of wifi interfaces (it is tedious...) and attached them to the three 'master' interfaces from point above (by setting the masters as Masters of the new ones)
  • created another mld interface (setting MLD Name) attached to the set of wifi interfaces from the point above by setting it as their MLD Interface - that made another SSID pop up

Rise & repeat - each SSID that should be broadcasted on more than one freq. requires a set of wifi interfaces (for bands and channels you need) and an mld on top of them. If given SSID is to be served, e.g. only on 5GHz, then it can be specified directly on a matching wifi interface.

Annoying aspect is that there can/needs to be exactly one set of 'master' wifi interfaces and this master set needs to actively serve some SSID, otherwise the 'follower' wifi interfaces (referring to masters via Master field) also won't do anything. I was at some point hoping it would be equivalent to bridges: a set of physical 'carriers' of data (with no real configuration to them) and logical/abstract definitions (e.g. VLANs) placed on top. Here we have 'masters' doing dirty job - so if I want to get rid of or reconfigure the mld attached to them, I will also need to reconfigure the 'masters' (because I had to set them to specific bands, channel widths, etc.) - that's messy.

3

The easiest way of getting started is the new wifi/network tab.
Frequencies you can configure on the "radio" tab via either GUI or CLI.

CLI is the only place where the labels work "correctly".

You can for example create common configs for all interfaces in network and then under network/radio you can set "label as MAC of wifi1" to only allow frequency XX.

You can also apply multiple configuration and they will override each other in order.
Theres also some labels that are more "handy" and include multiple "radios" like 2ghz, 5ghz, 6ghz

image

4

For wifi 7 devices like the hAP be models, yes, networks is the easiest. All you need is basically:

/interface wifi network add network ssid=main
/interface wifi network add network ssid=iot

of course can also specify password or specific encryption types, but those are optional. passphrase is enough

/int/wifi/network/add ssid=MyHome security.authentication-types=wpa2-psk,wpa3-psk .passphrase=verysecurepass datapath.bridge=bridge