Use hap ax lite as access point

I have an hap ax³ and one hap ax lite.
My WAN/internet access goes to the hap ax³ eth1. The hap ax³ acts as my router, including DHCP server, and the WiFi is enabled.

Now I want to, via ethernet cable, correct a hap ax lite to the hap ax³. I only want to use the hap ax lite as a wireless access point. Preferably I would like the hap ax lite WiFi to play nice with the hap ax³ WiFi.

On the hap ax³ the eth5 port is ready to connect to the hap ax lite eth1.
The hap ax lite is resetted into “caps mode”.

Could someone please help me out with a basic setup that achieves the above?

hap ax lite only has 2.4G

For me that doesn’t matter. I just want to make it work.

From the documentation:
https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-CAPsMAN-CAPsimpleconfigurationexample:

If you prefer video, check YouTube:
https://youtu.be/bHotZT41w3E?si=PiGRpP_0vQHPQzyd

Feel free to ask additional questions if you fail configuring.

Post what you come up with for review

Everything on bridge should be the easiest.

I don’t see much benefit using capsman (which is what you need when that AX Lite is in caps mode).
You only have 2 devices !

Thanks for the video link. The documentation link was too "extensive".
I'm sad so say that I haven't been able to achieve any success in using my hap ax lite as a wifi AP for my router (hap ax ax3) yet.
Even "step 1" - what ethernet port to connect from on my hap ax lite is an uncertainty for me...

I've tried to reset the configuration on the AP (hap ax lite), and "enable caps mode", then connected it to the router. On the router I've then enabled "Capsman" under the "WiFi" menu\capsman. Nothing shows up here...

I've reset the configuration on the hap ax lite to default, then in quck settings turned off DHCP and NAT. If I'm guessing right here, I could connect the AP to the router, and the router should assign an ip adress from its DHCP server. BUT I really would like to manage the AP (hap ax lite) from my router (hap ax3).

Since this is a lab setup for me at the moment, all help would be appreciated.
For instance just getting the AP to connect to my router via CAPS would be amazing!

Just reset the hAP ax lite one more time and in the Quick Set disable DHCP Server and set IP Address to 192.168.88.2.
Use ports 2,3 or 4 on hAP ax lite for connecting to the hAP ax3. From now on both devices are in the same network and you should be able to manage hAP ax lite while being connected to hAP ax3.

Connect to hAP ax lite and set the same Wi-Fi name and password as you have on your hAP ax3, if you haven’t done so in Quick Set.

Also set DNS server on ax lite (in IP → DNS) to 192.168.88.1 or some public ones (1.1.1.1, 8.8.8.8, etc.) and add a default route (IP → Routes, dst-address=0.0.0.0/0, gateway=192.168.88.1) to let ax lite itself access the Internet.

Hi
Disable DHCP and NAT?
In quick set, there are a number of ways to “set the ip”. Should I use static och automatic? I’ve tried a couple of combinations here, but I haven’t even seen a package move to or from the port on my router from the hap ax lite yet.

I am flabbergasted that there isnt a “default” way to set a device into CapsMan mode, and a router to “enable capsman” to start a configuration.

on hAP ax lite,
create a bridge called br
/interface bridge
add name=br

Add all ports to br you may disconnect from hap, reconnect again and check if all ports have been added
/interface bridge port
add bridge=local.br interface=ether1
add bridge=local.br interface=ether2
add bridge=local.br interface=ether3
add bridge=local.br interface=ether4

create a datapath
/interface wifi datapath
add bridge=br disabled=no name=datapath-slave

turn hap ax into cap
/interface wifi cap
set certificate=request discovery-interfaces=br enabled=yes lock-to-caps-man=
yes slaves-datapath=datapath-slave slaves-static=yes

Set dhcp on br
/ip dhcp-client
add interface=br

Go to the hap ax and select the wifi interface datapath “datapath-slave” for the wifi interface

That is not a CAPsMAN way, but a manual setup of the access point with a static IP address. To make things simple I would not use CAPsMAN in case of just one access point.

You can keep default settings under “Internet” which is “Automatic”. These settings are applied to port 1, and you won’t be using it. The IP needs to be set under “Local Network” and you will use this IP in WinBox or WebFig to manage the AP once it is connected to hAP ax3.
Quick Set 2024-11-09.png

Since I am getting tired of the lack effort and its a 5 minute config from typing from scratch.

ASSUMING the single LAN subnet is 192.168.88.0/24 and the MT is assigned 192.168.88.5

/interface bridge
add name=bridge
/interface list
add name=TRUSTED
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk disable-pmkid=yes management-protection=\
    allowed mode=dynamic-keys name=lab_Security supplicant-identity=""
/interface wireless
set [ find default-name=wlan1 ] ampdu-priorities=0,1,2,3,4,5 band=2ghz-g/n \
    basic-rates-b="" comment=lab country=utopia distance=indoors \
    frequency=2437 guard-interval=long installation=indoor mode=ap-bridge \
    name=WLAN1-Home rate-set=configured security-profile=home-security \
    skip-dfs-channels=all ssid=home1 supported-rates-b=11Mbps \
    wireless-protocol=802.11 wmm-support=enabled wps-mode=disabled
set [ find default-name=wlan2 ] ampdu-priorities=0,1,2,3,4,5 band=2ghz-g/n \
    basic-rates-b="" comment=lab country=utopia  distance=indoors \
    frequency=2437 guard-interval=long installation=indoor mode=ap-bridge \
    name=WLAN2-Home rate-set=configured security-profile=home-security \
    skip-dfs-channels=all ssid=home2 supported-rates-b=11Mbps \
    wireless-protocol=802.11 wmm-support=enabled wps-mode=disabled
/interface bridge port
add bridge=bridge comment=source interface=ether1
add bridge=bridge  interface=WLAN1-HOME
add bridge=bridge  interface=WLAN2-HOME
/ip neighbor discovery-settings
set discover-interface-list=TRUSTED
/ipv6 settings
set disable-ipv6=yes max-neighbor-entries=8192
/interface list member
add interface=bridge list=TRUSTED
/ip address
add address=192.168.88.5/24 interface=bridge network=192.168.88.0
/ip dns
set  servers=192.168.88.1
/ip route
add dst-address=0.0.0.0/0 gateway=192.168.88.1
/tool mac-server
set allowed-interface-list=NONE
/tool mac-server mac-winbox
set allowed-interface-list=TRUSTED

Anav
Firstly; You are evidently a very knowledgeable individual, regarding these products. Good for you, and thanks for sharing that knowledge with others!

I’m a not a it/networking professional, nor trained/educated in those areas. I’m a family guy, with several kids running around the house, that really likes Mikrotik IT products. I have [insert single digit number] minutes of “free time” each day, and I just want to make this work.

If I want to learn how-to configure these products the forums are the only practical place to do so. I don’t have the time nor the resources to learn “everything” about “every detail”.

If you can’t be courteous, and stop with your passive aggressive taunting, don’t reply on my questions in the forum. You are making me regret buying these MT products, and frankly it’s just hurtful.

Best regards
A forty something year old dad with >4 kids at home, trying to setup a cool wifi LAN, on the seven minutes of free time he has per day.

flynno
This got the AP/Cap (my hap ax lite) to show in the hap ax³ (router/Capsman) \Wifi\Remote Caps\

I’m going to read up on the basic setup now! Thanks!
Btw; I used Reset Config, No Default Config on my AP/Cap/hap ax lite before.
Q; should I enable the WiFi interface on my AP/cap/hap ax lite or can I now control it remotely from my Router? I can’t see the cap WiFi yet on my Router…

Thanks for pointing me in the right direction!
Much appreciated

mszru
Thanks for the coaching :smiling_face_with_sunglasses:
And you are probably right about not needing to configure Capsman and just go with your suggested solution. The confusion stems from the fact that I’ve hinted on that I was open to both solutions in this thread.

It would be awesome to get the Capsman solution working for me, as that seems to be a better way of managing several APs. And I might want to add more on the future…

I’m going to try to read up on the Capsman default setup now
:smiling_face_with_sunglasses::person_shrugging:t2::heart_hands:t2: Wish me luck :joy:

Best regards

It seems to be working… This is what I got at the moment;

CAP: hap ax lite (aka Access Point)
hapaxlite-ap-cap.rsc (918 Bytes)
CAPsMAN: hap ax3 (aka Router)
hap-ax3-capsman.rsc (7.65 KB)
CAP is connected to CAPsMAN via ethernet (CAP port 2 to CAPsMAN port 5).

I started of by doing a system reset configuration, and checked the “CAPs mode” check box. After reboot the hap ax lite seemed “not communicating” with the hap ax3, CAPsMAN. So then I started following this help text here;
https://help.mikrotik.com/docs/spaces/ROS/pages/46759946/WifiWave2+-+for+7.12+and+older#WifiWave2for7.12andolder-CAPsMAN-CAPsimpleconfigurationexample:

CAPsMAN:
#create a security profile
/interface wifiwave2 security
add authentication-types=wpa3-psk name=sec1 passphrase=HaveAg00dDay

#create configuraiton profiles to use for provisioning
/interface wifiwave2 configuration
add country=Latvia name=5ghz security=sec1 ssid=CAPsMAN_5
add name=2ghz security=sec1 ssid=CAPsMAN2
add country=Latvia name=5ghz_v security=sec1 ssid=CAPsMAN5_v

#configure provisioning rules, configure band matching as needed
/interface wifiwave2 provisioning
add action=create-dynamic-enabled master-configuration=5ghz slave-configurations=5ghz_v supported-bands=\
    5ghz-n
add action=create-enabled master-configuration=2ghz supported-bands=2ghz-n

#enable CAPsMAN service
/interface wifiwave2 capsman
set ca-certificate=auto enabled=yes

CAP:
#enable CAP service, in this case CAPsMAN is on same LAN, but you can also specify "caps-man-addresses=x.x.x.x" here
/interface/wifiwave2/cap set enabled=yes

#set configuration.manager= on the WifiWave2 interface that should act as CAP
/interface/wifiwave2/set wifi1,wifi2 configuration.manager=capsman-or-local

And now I can connect to the wifi broadcasted from the CAP, get an IP address from the router (router running as CAPsMAN).
:smiley:
All help in reviewing the configuration files, and tips for improving them, are very welcomed.

Best regards!

R u using capsman to manage the hap ax³ wifi also?

Not sure if this still works with capsman v2
/interface wifi provisioning
add action=create-dynamic-enabled disabled=no master-configuration=cfg1
radio-mac=00:00:00:00:00:00

Yes, so it seems. And the test I’ve done shows that I can connect to the hap ax³ WiFi, and I will be assigned an IP address.

Not sure if this still works with capsman v2
/interface wifi provisioning
add action=create-dynamic-enabled disabled=no master-configuration=cfg1
radio-mac=00:00:00:00:00:00

I’ll have a look at my setup in the coming days and report back!