Hi,
After pestering Gemini (and Claude) without any satisfactory result, I decided to return to the source.
I recently switched from ubiquiti based wifi setup to a mikrotik, and I am now trying to replicate the config that I had.
2 SSIDs
- sio, multi-psi based, serves vlans 204, 205, 209, 210, 211
- sio-pki, eap-tls based, serves vlans 209, 210, 211, where radius server defines vlan-id
While the multi-psk setup was straight forward, I am struggling to get the eap-tis working.
I am now at a state, where the radius server sends all correct information, including vlan-id, but the access point seems to ignore that information, and connecting clients ends in limbo.
The overall setup is CAPsMAN based, with a CRS-328-24P-4S+RM, and 2 wAP ax access points. The user traffic should leave the CAP directly without passing through the switch to improve performance (recommendation from Gemini)
The first and foremost questions is:
Is this setup, serving the same VLAN with multiple SSIDs, one with multi-psk and one with eap-tis and radius provided vlans supported?
If yes, how do I configure it?
Find below the currents state of the config, including some (gemini induced) tries, with added interfaces, enable bridge, and some disabled redundancy expansions.
/interface wifi datapath
add bridge=bridge disabled=no name=dp_dynamic
add disabled=no name=dp_radius
/interface wifi security
add authentication-types=wpa2-psk disabled=no multi-passphrase-group=ppsk_sio name=sec_sio
add authentication-types=wpa3-eap disabled=no eap-methods=tls encryption=ccmp,gcmp ft=yes ft-preserve-vlanid=yes name=sec_sio-pki
/interface wifi configuration
add channel=chan_2.4 country=Switzerland disabled=no name=cfg_sio_2.4 security=sec_sio ssid=sio
add aaa=aaa_nps datapath=dp_radius disabled=no name=cfg_sio-pki_5.0 security=sec_sio-pki security.authentication-types=wpa3-eap .encryption=ccmp,gcmp ssid=sio-pki
add aaa=aaa_nps datapath=dp_radius disabled=no name=cfg_sio-pki_2.4 security=sec_sio-pki security.authentication-types=wpa3-eap .encryption=ccmp,gcmp ssid=sio-pki
add channel=chan_5.0 country=Switzerland disabled=no name=cfg_sio_5.0 security=sec_sio ssid=sio
/interface wifi
# operated by CAP 10.95.13.28, traffic processing on CAP
add configuration=cfg_sio-pki_2.4 disabled=no name=cap-wifi1 radio-mac=D0:EA:11:63:08:7A
# operated by CAP 10.95.13.28, traffic processing on CAP
add configuration=cfg_sio_2.4 disabled=no mac-address=D2:EA:11:63:08:7A master-interface=cap-wifi1 name=cap-wifi1-virtual1
# operated by CAP 10.95.13.28, traffic processing on CAP
add configuration=cfg_sio-pki_5.0 disabled=no name=cap-wifi2 radio-mac=D0:EA:11:63:08:7B
# operated by CAP 10.95.13.28, traffic processing on CAP
add configuration=cfg_sio_5.0 disabled=no mac-address=D2:EA:11:63:08:7B master-interface=cap-wifi2 name=cap-wifi2-virtual1
# operated by CAP 10.95.13.29, traffic processing on CAP
add configuration=cfg_sio-pki_2.4 disabled=no name=cap-wifi3 radio-mac=D0:EA:11:64:E8:C6
# operated by CAP 10.95.13.29, traffic processing on CAP
add configuration=cfg_sio_2.4 disabled=no mac-address=D2:EA:11:64:E8:C6 master-interface=cap-wifi3 name=cap-wifi3-virtual1
# operated by CAP 10.95.13.29, traffic processing on CAP
add configuration=cfg_sio-pki_5.0 disabled=no name=cap-wifi4 radio-mac=D0:EA:11:64:E8:C7
# operated by CAP 10.95.13.29, traffic processing on CAP
add configuration=cfg_sio_5.0 disabled=no mac-address=D2:EA:11:64:E8:C7 master-interface=cap-wifi4 name=cap-wifi4-virtual1
/interface wifi access-list
add action=accept comment=swp disabled=yes mac-address=28:A4:4A:E3:5D:73
add action=accept comment=belkelel disabled=yes mac-address=5C:E9:1E:AE:C9:7B
/interface wifi capsman
set enabled=yes interfaces=bridge.213 upgrade-policy=suggest-same-version
/interface wifi provisioning
add action=create-enabled disabled=no master-configuration=cfg_sio-pki_5.0 slave-configurations=cfg_sio_5.0 supported-bands=5ghz-ax,5ghz-n
add action=create-enabled disabled=no master-configuration=cfg_sio-pki_2.4 slave-configurations=cfg_sio_2.4 supported-bands=2ghz-ax,2ghz-g,2ghz-n
/interface wifi security multi-passphrase
add comment=sio-lan disabled=no group=ppsk_sio vlan-id=210
add comment=sio-lan2 disabled=no group=ppsk_sio vlan-id=211
add comment=sio-lan3 disabled=no group=ppsk_sio vlan-id=209
add comment=sio-hab disabled=no group=ppsk_sio vlan-id=205
add comment=sio-iot disabled=no group=ppsk_sio vlan-id=204
/radius
add address=10.95.15.234 comment=ch01dc03 require-message-auth=no service=wireless timeout=3s300ms
add address=10.95.15.235 comment=ch01dc04 disabled=yes require-message-auth=no service=wireless timeout=3s300ms
add admin-mac=D0:EA:11:64:E8:C4 auto-mac=no comment=defconf name=bridgeLocal vlan-filtering=yes
/interface wifi datapath
add bridge=bridgeLocal comment=defconf disabled=no name=capdp
/interface wifi
# managed by CAPsMAN 10.95.13.10, traffic processing on CAP
# mode: AP, SSID: sio-pki, channel: 2467/ax/eC
set [ find default-name=wifi1 ] configuration.manager=capsman datapath=capdp disabled=no
# managed by CAPsMAN 10.95.13.10, traffic processing on CAP
# mode: AP, SSID: sio-pki, channel: 5600/ax/eeeeeCee/D
set [ find default-name=wifi2 ] configuration.manager=capsman datapath=capdp disabled=no
# managed by CAPsMAN 10.95.13.10, traffic processing on CAP
# mode: AP, SSID: sio
add datapath=capdp disabled=no mac-address=D2:EA:11:64:E8:C6 master-interface=wifi1 name=wifi15
# managed by CAPsMAN 10.95.13.10, traffic processing on CAP
# mode: AP, SSID: sio
add datapath=capdp disabled=no mac-address=D2:EA:11:64:E8:C7 master-interface=wifi2 name=wifi16
/interface bridge port
add bridge=bridgeLocal comment=defconf interface=ether1
add bridge=bridgeLocal comment=defconf interface=ether2
/interface bridge vlan
add bridge=bridgeLocal tagged=bridgeLocal untagged=ether1 vlan-ids=213
add bridge=bridgeLocal tagged=ether1,wifi2,wifi1,wifi15,wifi16 vlan-ids=210
add bridge=bridgeLocal tagged=ether1,wifi1,wifi2,wifi15,wifi16 vlan-ids=211
/interface wifi cap
set discovery-interfaces=ether1 enabled=yes slaves-datapath=capdp slaves-static=yes