I have configured VLAN-100 for the guest Wi-Fi and wanted to know if this is OK before I enable VLAN filtering.
RB5009 router as Capsman Controller
1x cAPax: Ether1 on port Ether7 from RB5009 (the guest Wi-Fi is broadcast from there, one additional Device on Ether2).
1x cAPax: Ether1 on port Ether8 from RB5009 (no guest Wi-Fi is broadcast from there).
I haven’t enabled VLAN filtering yet; everything else is configured. I just wanted to check whether it’s all correct before I enable it. The off-bridge port is configured.
If the documentation can be believed, the VLAN settings on the cAP ax (controlled via CAPsMAN) should be omitted and only a bridge with the Ethernet interfaces should be created
Not sure I understood right. The wifi datapath, like configured on capsman, will create dynamic bridge vlan and add wifi interface to bridge with configured vlan id.
Right, but will admin access be allowed across that VLAN ... IE, I'm unclear if "datapath" is soley a part of the wifi-qcom world, or system wide. Or, for that matter, if you still need to do "normal" VLAN config and datapath is just a means to point to the correct one for a given config.
(I don't use it, so really have no idea . . . . and don't have enough "spare parts" at the moment to build a test environment.)
It can be believed. If you use the datapath feature, specifying both the bridge and the vlan id, only the bridge (and its non-wifi ports) need to be configured manually, and the wifi system takes care of the rest. And yes, the created dynamic ports and vlan memberships are real in every way.
Another possible way is to forego the use of datapath, and configure the bridge, ports and vlans (including the wifi interfaces) manually.
For a simple case it doesn't really matter.
The source of the confusion is that the "-ac" driver doesn't support vlan id assignment though data path, so the first version is not supported.
I simply brought mine up in CapsMan mode, set the NTP time server and a few notification scripts (email and logging), let it get a static IP via DHCP, and let CapsMan push the WifiConfig (no datapath - default was fine)) and was up and running. Never needed to touch the bridge or any other local AP networking. (I do have AP specific provisioning rules by radio MAC to manage frequency use and to avoid overlap, but that was not critical. Heck, even without setting any of my scripting, out of the box, reinit in CapsMan mode to up and usable is literally mid single digit minutes.
I do any VLAN assignment on the switch side . . . keeps all the AP's identical (save for name) . . . K.I.S.S.
I haven’t quite got the hang of it yet.
I’m configuring the datapath with VLAN 100 on the RB5009 Capsman Controller, where the bridge is called, for example, ‘bridge-home’… does the bridge on the cAP need to have the same name, or does it not matter?
And if I leave out datapath, will my ‘manual’ configuration from above be correct?
you would also need to add the wifi interface as bridge port manually. And thats where the PITA of wifi-qcom-ac (where you must do it manually) lies within. Interface names managed by capsman can change, to work around you have to use static wifi interfaces so names not change after reboot/provision. Dont do that. It is better to use vlan-id on datapath and let capsman do all the configuration. Don't configure manually on cap, it will bite you for sure.
