Some clients cannot roam between CapAX APs on 5GHz

mmee · August 3, 2026, 11:08am

Hi,

I have a home setup with 2 CAP Ax APs managed by Capsman running on an RB4011. Everything works excellent, except 2 Lenovo laptops cannot roam between APs on Wifi 5GHz, both of them have the same Intel AX211 wifi card.

If I move between APs, I see the transmission rate falls down to lower than 85, but the laptop still sticks to the previous AP, doesn't reconnect to the other, closer one. If I disconnect it manually, it cannot reconnect for 2-3 minutes, it just simply says "Cannot connect to the network". After 3 min, it can connect to the correct AP, but the issue is the same if I move phisicly back to the inital AP.

Other devices, like smartphones and Macbooks can roam perfectly. I already set the "Roaming Aggressiveness" to the Highest in the Wificard config.

SSID IOT used for 2.4GHz where this laptop can roam correctly, but MyWifi is 5GHz where roaming fails. These SSIDs have separate vlan too.

Almost the latest ROS is installed everywhere (7.23.2) and wifi-qcom is used on the APs.

Do you think this can be a config issue? My alternative plan is to create separate Access rule for those clients to move them to the vlan of MyWifi and connects to the slower IOT..

# 2026-08-03 13:29:33 by RouterOS 7.23.2
# software id = PT47-7AMD
#
# model = RB4011iGS+5HacQ2HnD
# serial number = MySerial
/interface bridge
add name=bridge vlan-filtering=yes
/interface ethernet
set [ find default-name=ether1 ] comment=ISP
/interface wireguard
add listen-port=9980 mtu=1420 name=wireguard1
/interface vlan
add interface=bridge name=vlan10 vlan-id=10
add interface=bridge name=vlan100 vlan-id=100
add interface=bridge name=vlan200 vlan-id=200
add interface=bridge name=vlan300 vlan-id=300
/interface list
add name=LAN
/interface wifi datapath
add bridge=bridge client-isolation=no disabled=no name=dp-client vlan-id=100
add bridge=bridge client-isolation=no disabled=no name=dp-iot vlan-id=300
/interface wifi security
add authentication-types=wpa2-psk disabled=no ft=yes ft-over-ds=yes \
    group-encryption=ccmp management-protection=allowed name=sec_client
add authentication-types=wpa2-psk disabled=no ft=yes ft-over-ds=yes \
    group-encryption=ccmp management-protection=disabled name=sec_iot wps=\
    disable
/interface wifi configuration
add channel.band=2ghz-n .frequency=2437 .width=20mhz country=MyCountry \
    datapath=dp-iot disabled=no installation=indoor mode=ap name=cfg-ax-2G \
    security=sec_iot ssid=IoT tx-power=10
add channel.band=2ghz-n .frequency=2412 .width=20mhz country=MyCountry \
    datapath=dp-iot disabled=no installation=indoor mode=ap name=cfg-ax2-2G \
    security=sec_iot ssid=IoT tx-power=10
/interface wifi
# operated by CAP XX:XX:XX:XX:XX:XX%bridge, traffic processing on CAP
add configuration=cfg-ax-2G disabled=no name=cap-wifi3 radio-mac=\
    XX:XX:XX:XX:XX:XX
# operated by CAP XX:XX:XX:XX:XX:XX%bridge, traffic processing on CAP
add configuration=cfg-ax2-2G disabled=no name=cap-wifi5 radio-mac=\
    XX:XX:XX:XX:XX:XX
/interface wifi steering
add disabled=no name=steering_client rrm=yes wnm=no
/interface wifi configuration
add channel.band=5ghz-ax .frequency=5180 .width=20/40/80mhz country=MyCountry \
    datapath=dp-client disabled=no installation=indoor mode=ap name=cfg-ax-5G \
    security=sec_client ssid=MyWifi steering=steering_client tx-power=15
add channel.band=5ghz-ax .frequency=5260 .width=20/40/80mhz country=MyCountry \
    datapath=dp-client disabled=no installation=indoor mode=ap name=\
    cfg-ax2-5G security=sec_client ssid=MyWifi steering=steering_client \
    tx-power=12
/interface wifi
# operated by CAP XX:XX:XX:XX:XX:XX%bridge, traffic processing on CAP
add configuration=cfg-ax-5G disabled=no name=cap-wifi4 radio-mac=\
    XX:XX:XX:XX:XX:XX
# operated by CAP XX:XX:XX:XX:XX:XX%bridge, traffic processing on CAP
add configuration=cfg-ax2-5G disabled=no name=cap-wifi6 radio-mac=\
    XX:XX:XX:XX:XX:XX
/ip pool
add name=dhcp_pool0 ranges=192.168.95.30-192.168.95.254
add name=dhcp_pool1 ranges=192.168.10.2-192.168.10.254
add name=dhcp_pool2 ranges=192.168.200.2-192.168.200.254
add name=pool_iot ranges=192.168.30.2-192.168.30.254
/ip dhcp-server
add address-pool=dhcp_pool0 interface=vlan100 name=dhcp1
add address-pool=dhcp_pool1 interface=vlan10 name=dhcp_vlan10
add address-pool=dhcp_pool2 interface=vlan200 name=dhcp_vlan200
add address-pool=pool_iot interface=vlan300 name=dhcp_iot
/system logging action
set 3 remote=192.168.95.16 src-address=192.168.95.1
add name=synology remote=192.168.95.16 target=remote
/interface wifi
add configuration=*A disabled=no name=cap-wifi1 radio-mac=XX:XX:XX:XX:XX:XX
add configuration=*B disabled=no name=cap-wifi2 radio-mac=XX:XX:XX:XX:XX:XX
add configuration=*1 configuration.mode=ap datapath=dp-client radio-mac=\
    XX:XX:XX:XX:XX:XX
add configuration=cfg-ax2-5G configuration.mode=station mac-address=\
    XX:XX:XX:XX:XX:XX master-interface=wifi1 name=wlan-wan security=*3
/interface bridge port
add bridge=bridge interface=ether2 pvid=100
add bridge=bridge interface=ether5 pvid=100
add bridge=bridge interface=ether4 pvid=300
add bridge=bridge interface=ether8 pvid=10
add bridge=bridge interface=ether9 pvid=200
add bridge=bridge interface=ether7 pvid=100
add bridge=bridge interface=ether6
add bridge=bridge interface=ether3
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge untagged=ether8 vlan-ids=10
add bridge=bridge tagged=bridge,ether6,ether3 untagged=ether2,ether5,ether7 \
    vlan-ids=100
add bridge=bridge tagged=bridge untagged=ether9 vlan-ids=200
add bridge=bridge tagged=bridge,ether3,ether6,ether2 untagged=ether4 \
    vlan-ids=300
/interface list member
add interface=bridge list=LAN
add interface=ether8 list=LAN
add interface=vlan10 list=LAN
add interface=vlan100 list=LAN
add interface=vlan200 list=LAN
/interface ovpn-server server
add mac-address=XX:XX:XX:XX:XX:XX name=ovpn-server1
/interface wifi access-list
add action=accept comment="Raspberry Pi Pico - Move to VLAN 100" disabled=no \
    mac-address=XX:XX:XX:XX:XX:XX vlan-id=100
add action=accept comment="Raspberry Pi 3 - Move to VLAN 100" disabled=no \
    mac-address=XX:XX:XX:XX:XX:XX vlan-id=100
add action=accept comment="Raspberry Pi Zero - Move to VLAN 100" disabled=no \
    mac-address=XX:XX:XX:XX:XX:XX vlan-id=100
add action=accept comment=Wifircard mac-address=XX:XX:XX:XX:XX:XX vlan-id=100
add action=reject allow-signal-out-of-range=10s comment="Force Roaming" \
    signal-range=-120..-72
add action=accept comment="Default accept" disabled=no
/interface wifi capsman
set enabled=yes interfaces=bridge,vlan100 package-path="" \
    require-peer-certificate=no upgrade-policy=none
/interface wifi provisioning
add action=create-enabled disabled=no master-configuration=cfg-ax-5G \
    radio-mac=XX:XX:XX:XX:XX:XX
add action=create-enabled disabled=no master-configuration=cfg-ax-2G \
    radio-mac=XX:XX:XX:XX:XX:XX
add action=create-enabled disabled=no master-configuration=cfg-ax2-5G \
    radio-mac=XX:XX:XX:XX:XX:XX
add action=create-enabled disabled=no master-configuration=cfg-ax2-2G \
    radio-mac=XX:XX:XX:XX:XX:XX
/ip address
add address=192.168.95.1/24 interface=vlan100 network=192.168.95.0
add address=192.168.200.1/24 interface=vlan200 network=192.168.200.0
add address=192.168.10.1/24 interface=vlan10 network=192.168.10.0
add address=192.168.90.1/24 interface=wireguard1 network=192.168.90.0
add address=192.168.30.1/24 interface=vlan300 network=192.168.30.0
/ip dhcp-client
add interface=ether1 name=client1
/ip dhcp-server lease
add address=192.168.200.248 client-id=1:XX:XX:XX:XX:XX:XX mac-address=\
    XX:XX:XX:XX:XX:XX server=dhcp_vlan200
add address=192.168.95.3 mac-address=XX:XX:XX:XX:XX:XX server=dhcp1
add address=192.168.95.10 mac-address=XX:XX:XX:XX:XX:XX server=dhcp1
add address=192.168.95.11 mac-address=XX:XX:XX:XX:XX:XX server=dhcp1
add address=192.168.95.9 mac-address=XX:XX:XX:XX:XX:XX server=dhcp1
add address=192.168.95.64 client-id=1:b4:a:d8:2e:27:ca mac-address=\
    XX:XX:XX:XX:XX:XX server=dhcp1
add address=192.168.95.72 client-id=1:XX:XX:XX:XX:XX:XX comment="PS Portal" \
    mac-address=XX:XX:XX:XX:XX:XX server=dhcp1
add address=192.168.95.12 mac-address=XX:XX:XX:XX:XX:XX
add address=192.168.95.34 client-id=1:c6:6f:34:54:52:9 mac-address=\
    XX:XX:XX:XX:XX:XX server=dhcp1
add address=192.168.95.44 mac-address=XX:XX:XX:XX:XX:XX server=dhcp1
add address=192.168.95.5 mac-address=XX:XX:XX:XX:XX:XX
add address=192.168.95.7 mac-address=XX:XX:XX:XX:XX:XX
add address=192.168.95.54 client-id=1:4:b9:e3:33:6:a2 mac-address=\
    XX:XX:XX:XX:XX:XX server=dhcp1
add address=192.168.95.38 client-id=1:XX:XX:XX:XX:XX:XX mac-address=\
    XX:XX:XX:XX:XX:XX server=dhcp1
add address=192.168.95.31 client-id=1:XX:XX:XX:XX:XX:XX mac-address=\
    XX:XX:XX:XX:XX:XX server=dhcp1
add address=192.168.30.15 mac-address=XX:XX:XX:XX:XX:XX server=dhcp_iot
add address=192.168.95.91 client-id=1:XX:XX:XX:XX:XX:XX mac-address=\
    XX:XX:XX:XX:XX:XX server=dhcp1
add address=192.168.95.6 mac-address=XX:XX:XX:XX:XX:XX
add address=192.168.95.8 mac-address=XX:XX:XX:XX:XX:XX
add address=192.168.95.73 client-id=1:XX:XX:XX:XX:XX:XX mac-address=\
    XX:XX:XX:XX:XX:XX server=dhcp1
/ip dhcp-server network
add address=192.168.10.0/24 dns-server=8.8.8.8,1.1.1.1 gateway=192.168.10.1
add address=192.168.30.0/24 dns-server=1.1.1.1,8.8.8.8 gateway=192.168.30.1
add address=192.168.95.0/24 dns-server=192.168.95.3,192.168.95.4 gateway=\
    192.168.95.1
add address=192.168.200.0/24 dns-server=1.1.1.1,8.8.8.8 gateway=192.168.200.1
/ip dns
set allow-remote-requests=yes
/ip firewall address-list
add address=192.168.95.0/24 list=admin_list
add address=192.168.10.0/24 list=admin_list
add address=0.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=172.16.0.0/12 comment=RFC6890 list=not_in_internet
add address=192.168.0.0/16 comment=RFC6890 list=not_in_internet
add address=10.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=169.254.0.0/16 comment=RFC6890 list=not_in_internet
add address=127.0.0.0/8 comment=RFC6890 list=not_in_internet
add address=224.0.0.0/4 comment=Multicast list=not_in_internet
add address=198.18.0.0/15 comment=RFC6890 list=not_in_internet
add address=192.0.0.0/24 comment=RFC6890 list=not_in_internet
add address=192.0.2.0/24 comment=RFC6890 list=not_in_internet
add address=198.51.100.0/24 comment=RFC6890 list=not_in_internet
add address=203.0.113.0/24 comment=RFC6890 list=not_in_internet
add address=100.64.0.0/10 comment=RFC6890 list=not_in_internet
add address=240.0.0.0/4 comment=RFC6890 list=not_in_internet
add address=192.88.99.0/24 comment="6to4 relay Anycast [RFC 3068]" list=\
    not_in_internet
add address=192.168.95.0/24 list=LAN_network
add address=192.168.10.0/24 list=LAN_network
add address=192.168.95.3 list=Pihole
add address=192.168.95.33 list=Pihole
add address=192.168.90.0/24 list=Wireguard_clients
add address=192.168.95.16 list=Synology_NAS
add address=192.168.200.248 list=Security_Cameras
/ip firewall filter
add action=accept chain=input comment=\
    "FIRST RULE Accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="Drop invalid" connection-state=invalid
add action=accept chain=input comment="Accept ICMP" protocol=icmp
add action=accept chain=input comment="Allow Wireguard" dst-port=9980 \
    protocol=udp
add action=accept chain=forward comment="Allow LAN to LAN communication" \
    dst-address-list=admin_list src-address-list=admin_list
add action=accept chain=input comment="Allow Admin Access" dst-port=\
    8291,80,2200 protocol=tcp src-address-list=admin_list
add action=accept chain=input comment="Allow CAPsMAN from LAN" dst-port=\
    5246,5247,5678 protocol=udp src-address-list=LAN_network
add action=accept chain=input comment="Allow CAPsMAN Discovery" disabled=yes \
    dst-port=5246,5247 protocol=udp
add action=accept chain=input dst-port=53 in-interface=vlan300 protocol=udp
add action=drop chain=input comment="Drop all other input"
add action=drop chain=forward comment="IoT: No Inter-VLAN traffic" \
    dst-address-list=LAN_network in-interface=vlan300
add action=accept chain=forward comment="Inter vlan300 traffic" in-interface=\
    vlan300 out-interface=vlan300
add action=accept chain=forward comment="Accept Internet from iot vlan" \
    in-interface=vlan300 out-interface=ether1
add action=fasttrack-connection chain=forward comment=FastTrack \
    connection-state=established,related
add action=accept chain=forward comment=\
    "Accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="Drop invalid" connection-state=invalid
add action=accept chain=forward comment="Wireguard to LAN" dst-address-list=\
    LAN_network src-address-list=Wireguard_clients
add action=accept chain=forward comment="LAN to Internet" in-interface-list=\
    LAN out-interface=ether1
add action=accept chain=forward comment="LAN to VLAN200" in-interface-list=\
    LAN out-interface=vlan200
add action=accept chain=forward comment="VLAN200 to Internet Only" \
    in-interface=vlan200 out-interface=ether1
add action=accept chain=forward comment="Allow Camera to NAS Surveillance" \
    dst-address-list=Synology_NAS dst-port=9006,554 protocol=tcp \
    src-address-list=Security_Cameras
add action=accept chain=forward comment="Allow Camera to NAS (UDP/RTSP)" \
    dst-address-list=Synology_NAS dst-port=554 protocol=udp src-address-list=\
    Security_Cameras
add action=accept chain=forward comment="Wireguard to Internet" \
    out-interface=ether1 src-address-list=Wireguard_clients
add action=drop chain=forward comment="Drop everything else"
/ip firewall nat
add action=masquerade chain=srcnat log-prefix=NAT: out-interface=ether1
add action=masquerade chain=srcnat src-address=192.168.90.0/24
add action=masquerade chain=srcnat disabled=yes src-address=192.168.10.0/24
add action=masquerade chain=srcnat disabled=yes src-address=192.168.200.0/24
/ip service
set ftp disabled=yes
set telnet disabled=yes
set ssh port=2200
set winbox address=192.168.95.0/24,192.168.10.0/24
set api disabled=yes
/ipv6 nd
set [ find default=yes ] advertise-dns=yes
/system clock
set time-zone-autodetect=no time-zone-name=Europe/MyCity
/system identity
set name=MikroTik_4011
/system logging
set 0 topics=info,!fetch
add action=synology topics=info,!script,!fetch
add action=synology topics=warning
add action=synology topics=critical
add action=synology topics=interface
add action=synology topics=account
add action=synology topics=system
add action=synology topics=caps
/system ntp client servers
add address=time.google.com
add address=time.windows.com
/tool graphing
set page-refresh=60
/tool graphing interface
add allow-address=192.168.95.0/24 interface=ether1
add interface=bridge
/tool graphing resource
add
/tool mac-server
set allowed-interface-list=LAN

infabo · August 3, 2026, 7:27pm

My condolences. Intel AX2xx cards are a surpise bag. I have the AX200 running under Linux. It is a stationary used notebook. A few days ago it kept roaming between 2.4/5ghz in a 60secs interval. Completely disturbing my active Teams meeting. Sometimes it just disconnects out of a sudden, nobody knows why, journal only has useless information. Google Pixel lying nearby on the desk - stable connection. But Intel card decided to disconnect from network. Then I have to manually connect again using iwctl or initiate a "iwctl wlan0 scan", otherwise I would have to wait for several minutes for IWD to connect "automatically". But then there are several days in a row where it just works. This is pretty crazy and it is only Intel card + Intel IWD which act up in this way. wpa_supplicant was stable, but is a PITA in other areas. Especially when configured standalone without networkmanager.