Trying to setup a guest WiFi with 2 RBs

RouterOS Beginner Basics
1

My setup: RB2011 with internet connection, and “BridgeLan” 10.0.0.0/25, “BridgeGuests” 192.168.190.0/24
A hAP2 is connected on ether5 on RB2011 for having WiFi.
I tried to create a VLAN with id 100 on Interfaces->VLAN on both devices, it seems to work.
On RB2011: the vlan100 is assigned on BridgeGuests
On hAP2: the vlan100 is assigned on BridgeGuest, and wlan3 (guest ssid) also assigned on BridgeGuest.

The issue is that the Android phone I am testing is getting and IP and automatically disconnects after 3 secs. And again, in loop.
Maybe the issue is ARP but I dont have such troubleshooting knowledge.
Also, where do I have to enable ARP; On BridgeGuests RB2011? On BridgeGuests hAP2? On vlan100 RB2011? On vlan100 hAP2? Everywhere?
On main router (RB2011) I see two Dynamic entries on every bridge for the same MAC (my Android phone)

Thanks in advance

2

With multiple bridges likely one of the issues discussed here https://help.mikrotik.com/docs/display/ROS/Layer2+misconfiguration, recommended practice is a single VLAN-aware bridge, there is a good primer here http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1

As ever without seeing your existing setup it is impossible to say exactly what is incorrect, copy the result of /export hide-sensitive from a terminal window, paste in a code block (the icon in the forum post).

3

Is the hapac acting as a wifi+switch or router+wifi+switch

4

I agree with @tdw.. I don’t see the reason as to why use multiple Bridges along with VLANs…

I Would use Capsman with VLANs to setup both my local and Guest Wireless networks…
Both examples here https://wiki.mikrotik.com/wiki/Manual:CAPsMAN_with_VLANs can help you understand how it works…

OR

Go with Bridge VLAN Filtering…
You can start here http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1

5

Here’s the most important from RB2011
*Bridges dont use IP firewall

/interface bridge
add arp=disabled name=BridgeGuest
add name=BridgeLAN

/interface ethernet
set [ find default-name=sfp1 ] disabled=yes name=SFP1
set [ find default-name=ether1 ] advertise=\
    10M-half,10M-full,100M-half,100M-full,1000M-full
set [ find default-name=ether2 ] advertise=10M-half,1000M-full \
    speed=100Mbps
set [ find default-name=ether3 ] advertise=\
    10M-half,10M-full,100M-half,100M-full,1000M-full 
set [ find default-name=ether4 ] advertise=100M-full,1000M-full 
set [ find default-name=ether5 ] advertise=1000M-full  \
    speed=100Mbps
set [ find default-name=ether6 ] rx-flow-control=auto \
    tx-flow-control=auto
set [ find default-name=ether7 ] advertise=100M-full \
    rx-flow-control=auto tx-flow-control=auto
set [ find default-name=ether8 ] rx-flow-control=auto \
    tx-flow-control=auto
set [ find default-name=ether9 ] advertise=100M-full \
    rx-flow-control=auto tx-flow-control=auto
set [ find default-name=ether10 ] advertise=100M-full \
    rx-flow-control=auto tx-flow-control=auto
	
/interface pppoe-client
add add-default-route=yes disabled=no interface=ether4 keepalive-timeout=60 \
    max-mru=1492 max-mtu=1492 name=pppoe-internet use-peer-dns=yes user=

/interface vlan
add arp=disabled interface=ether5 name=vlan100 vlan-id=100


/ip pool
add name=poolBridgeLAN ranges=10.0.0.100-10.0.0.125
add name=poolGuest ranges=192.168.190.2-192.168.190.20

/ip dhcp-server
add address-pool=poolBridgeLAN bootp-lease-time=lease-time bootp-support=\
    dynamic disabled=no interface=BridgeLAN lease-time=4w2d name=\
    dhcp-BridgeLAN
add add-arp=yes address-pool=poolGuest always-broadcast=yes bootp-lease-time=\
    lease-time bootp-support=dynamic disabled=no interface=BridgeGuest \
    lease-time=4w2d name=dhcp-BridgeGuest
	
	
/interface bridge port
add bridge=BridgeLAN interface=ether2
add bridge=BridgeLAN interface=ether3
add bridge=BridgeLAN interface=ether5
add bridge=BridgeLAN interface=ether1
add bridge=BridgeLAN hw=no interface=ether7
add bridge=BridgeLAN hw=no interface=ether6
add bridge=BridgeGuest interface=vlan100

/interface bridge settings
set use-ip-firewall-for-pppoe=yes use-ip-firewall-for-vlan=yes


/ip address
add address=10.0.0.1/25 interface=BridgeLAN network=10.0.0.0
add address=192.168.1.100/24 interface=ether4 network=192.168.1.0
add address=192.168.190.0/24 interface=BridgeGuest network=192.168.190.0
6

A VLAN is not a bridge port!

7

I’m really bad at theory, so I’ll study the material on the post above and I’ll post again

8

IF you only have 2 or 3 wifi devices I would avoid capsman for now. Its another layer of config to avoid until you get the basics working.

9

Do you see any other bad things at my config I will have to fix and read about?