Problems in my Mikrotik wifi since I started upscaling of access points

RouterOS Wireless Networking
1

Hi there!

I work at a school with different buildings and so far have we used Fortigate access points , but startet migrating til Mikrotik. We startet first with one building and around 15 cap ax, which worked great, but now with hundreds AP’s and thousands of clients we get some trouble.

The router and capsman run on a CCR2116-12G-4S+, 7.16.2 stable (I know it’s old firmware, it’s in my pipleline to upgrade “soon”).

The cap ax are on the same firmware version. The buildings are connected via single mode fiber 10GB, as switches use we Aruba 2930F and similar. I started with a better segmentation for a different complex and use there a Mikrotik CCR2004-16G-S2+. It should be soon a own capsman for that building.

Here is the config of one of the access points and router:

AP config

/interface bridge
add frame-types=admit-only-vlan-tagged name=bridge1 vlan-filtering=yes
/interface wifi

managed by CAPsMAN

set [ find default-name=wifi1 ] configuration.manager=capsman datapath.bridge=bridge1

managed by CAPsMAN

set [ find default-name=wifi2 ] configuration.manager=capsman datapath.bridge=bridge1
/interface vlan
add interface=bridge1 name=vlan1000 vlan-id=1000
/interface list
add name=management
/interface bridge port
add bridge=bridge1 interface=ether1 pvid=1000
add bridge=bridge1 interface=ether2 pvid=1000
/ip neighbor discovery-settings
set discover-interface-list=management protocol=lldp,mndp
/ip settings
set allow-fast-path=no ip-forward=no rp-filter=strict
/ipv6 settings
set forward=no
/interface bridge vlan
add bridge=bridge1 tagged=bridge1,ether1,ether2 vlan-ids=100
add bridge=bridge1 tagged=bridge1,ether1,ether2 vlan-ids=110
add bridge=bridge1 tagged=bridge1,ether1,ether2 vlan-ids=120
add bridge=bridge1 tagged=bridge1 vlan-ids=1000
/interface list member
add interface=vlan1000 list=management
/interface wifi cap
set caps-man-addresses=10.10.10.1 discovery-interfaces="" enabled=yes
/ip cloud
set update-time=no
/system clock
set time-zone-autodetect=no time-zone-name=UTC
/system identity
set name=ap1xx
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=ntp.mydomain.com
/tool mac-server
set allowed-interface-list=none
/tool mac-server mac-winbox
set allowed-interface-list=none
/tool mac-server ping
set enabled=no
/ip dhcp-client
add interface=vlan1000

Here is the part of my router config:

Router config

/interface wifi channel
add disabled=no frequency=5170-5250,5250-5330,5490-5730 name=5GHZ width=20mhz
add disabled=no frequency=2402-2482 name=2GHZ width=20mhz

/interface wifi datapath
add disabled=no name=employee vlan-id=100
add disabled=no name=teacher vlan-id=110
add disabled=no name=student vlan-id=120
add disabled=no name=guest vlan-id=130

/interface wifi security
add authentication-types=wpa2-eap disabled=no eap-certificate-mode=verify-certificate ft=yes ft-over-ds=yes management-protection=allowed name=radius wps=disable
add authentication-types=wpa2-psk disabled=no ft=yes ft-over-ds=yes management-protection=allowed name=guest wps=disable
add authentication-types=wpa2-psk disabled=no ft=yes ft-over-ds=yes management-protection=allowed name=teacher wps=disable
add authentication-types=wpa2-psk disabled=no ft=yes ft-over-ds=yes management-protection=allowed name=student wps=disable
add authentication-types=wpa-psk comment=temporary disabled=no management-protection=allowed name=old-ipads wps=disable

/interface wifi configuration
add country=Denmark datapath=employee disabled=no name=employee security=radius security.ft=yes .ft-over-ds=yes ssid="Employee Notebooks"
add country=Denmark datapath=guest disabled=no name=guest security=guest security.ft=yes .ft-over-ds=yes ssid="Guest Wifi"
add comment="temporary ipad fix" country=Denmark datapath=guest disabled=no mode=ap name=old-ipads security=old-ipads ssid=old-ipads
add country=Denmark datapath=student disabled=no name=student security=student security.ft=yes .ft-over-ds=yes ssid="Student Wifi"
add country=Denmark datapath=teacher disabled=no name=teacher security=teacher security.ft=yes .ft-over-ds=yes ssid="Teacher Wifi"

/interface wifi access-list
add action=accept disabled=no interface=any signal-range=-76..0
add action=reject disabled=no interface=any signal-range=-120..-77

/interface wifi capsman
set enabled=yes package-path=/firmware require-peer-certificate=no upgrade-policy=none

/interface wifi provisioning
add action=create-dynamic-enabled comment=library disabled=no identity-regexp="ap1(0[1-9]|2[0-7])" master-configuration=student name-format=%I-5g-wifi slave-configurations=guest,employee,teacher supported-bands=5ghz-ax
add action=create-dynamic-enabled comment=library disabled=no identity-regexp="ap1(0[1-9]|2[0-7])" master-configuration=employee name-format=%I-2g-wifi slave-configurations=guest,old-ipads supported-bands=2ghz-ax
add action=create-dynamic-enabled comment=building1 disabled=no identity-regexp="ap1(2[8-9]|3[0-9]|4[0-5])" master-configuration=student name-format=%I-5g-wifi slave-configurations=teacher,guest,employee supported-bands=5ghz-ax
add action=create-dynamic-enabled comment=building1 disabled=no identity-regexp="ap1(2[8-9]|3[0-9]|4[0-5])" master-configuration=old-ipads name-format=%I-2g-wifi slave-configurations=teacher,guest supported-bands=2ghz-ax
add action=create-dynamic-enabled comment=building2 disabled=no identity-regexp="ap1(4[6-9]|5[0-4])" master-configuration=employee name-format=%I-5g-wifi slave-configurations=guest supported-bands=5ghz-ax
add action=create-dynamic-enabled comment=building2 disabled=no identity-regexp="ap1(4[6-9]|5[0-4])" master-configuration=employee name-format=%I-2g-wifi slave-configurations=guest,old-ipads supported-bands=2ghz-ax
add action=create-dynamic-enabled comment=building3 disabled=no identity-regexp="ap1(5[5-9]|6[0-9]|7[0-9]|8[0-8])" master-configuration=employee name-format=%I-5g-wifi slave-configurations=guest,teacher,student supported-bands=5ghz-ax
add action=create-dynamic-enabled comment=building3 disabled=no identity-regexp="ap1(5[5-9]|6[0-9]|7[0-9]|8[0-8])" master-configuration=old-ipads name-format=%I-2g-wifi slave-configurations="" supported-bands=2ghz-ax

The problem is the following:

  • The student ipads are connected to an AP, but sometimes they jump around to other AP’s. That happens frequently.
  • Teacher notebooks have the same problem, but more rare.
  • On my test with 2GHz and 5GHz of the same SSID, is it on the 2GHz that the wifi performance is incredibly bad (1-5MBit/s) on 5GHz it' jumps to 100+Mbit/s. So I startet moving the SSID from 2GHz to 5GHz only. Maybe it’s the firmware?
  • Is the CCR my problem as capsman?
  • Is segmentation the key?

My router config is shortend, there are many more buildings and access points, more vlans and SSIDs, but for simplification I used this snippet.

Thanks for the help!

DataDragon

PS: If someone has a good guide for a high availability setup with two CCR router gladly give it to me.

2

First thing I would absolutely change is frequency assignment. Only use fixed, otherwise you have absolutely no clue.

Edit:
Why do you use wpa2-psk for such a large environment? Though I notice you did some testing with wap2-eap, it is not implemented. Radius is pretty much standard in these enviroments.

Last remark (for now), I do have terrible experience with using access-lists for blocking devices when their signal strength is too low. I would reconsider it (but I don't have any personal experience with MikroTik in a larger environment).

3

I'm pretty sure that upgrading CAP devices to "oldstable (7.19.6 at the moment) would help (at least to certain extent). Upgrading CAPsMAN to same version might help as well.

4

First thing try to disable this, it caused nothing but problems for me since ever on mikrotik and similar problems with clients jumping around.

If you want better roaming, and even better if you have all newer clients who support roaming protocol, you can actually reduce power in order to force them to closer APS.

And make sure to run 2ghz at lower power then 5ghz, something like 5-7dB lower.

Also by running lower power you will have less interference and you can use wider channels for 5ghz, 40 or even 80mhz, With higher channel width you also benefit from more available OFMDA channels per device which will increases performance and lower latency.

And most importantly, if you want to use auto channel selection, keep in mind that CAPSMAN doesnt do any smart channel selection process and APS next to each other will often select same channel as they startup/boot.

So use fixed channel selection, or relay on setting re-select intervals, or create a script which reprovisions APS one by one with a bit delay so they properly wait each other and select more clear channels.

Something like this, but its not perfect as some may wait longer for DFS, you may increases delay but its gonna last long if you have allot of APS.

:local radios [/interface wifi radio find]
:foreach cap in=$radios do={
:delay 15
/interface wifi radio provision $cap
}

5

Thanks for your input!
I changed now the frequency assignment from automatic to manual. Additionally I removed from 2 GHz everything that is not necessary and run 5 GHz most SSIDs.

It is planed to switch from wpa2 to radius authentication, but it's a big project and first needs the wifi stability/reliability. The main focus is at the moment the migration from Fortinet to Mikrotik.

Let's see if something has improved by tomorrow.

6

I'm used to Fortigate, so maybe it's a dumb question.
Is it on Mikrotik not the same, that controller (capsman) and access points should/need to be on the same version?
Or is it like, that when the APs are on 7.19.x they have their fixes applied and are downwards compatible to an old capsman. And when I update capsman at some point (soon), the new features (if there are some) get active with the new capsman version?

7

It is adviced (by MikroTik) that both CAPS and CAPsMAN run the same version. But there is no need to run CAPsMAN on the router, you could (even) run it an a cAP AX. Then there is no dependency of the version.

8

Thank you!
I will disable the access list. Since I moved nearly everything from 2 GHz to 5 GHz I wait how the changes will impact the lessons tomorrow. But I keep it in mind.
The script is a smart idea! I try the fixed channels for now, but it could be a nice improvement in the future.
On FortiAPs I gave every access point a fixed channel. It was much micro management, but I had no real issues with interference or high channel utilization. But tons of other disadvantages. So I'm excited to see if the new environment will do great :slight_smile: