Virtual WIFI and VLAN's - driving me crazy

anav · November 4, 2021, 1:15am

If you are using the WAPAC as an accesspoint/switch then stop configuring it like a router and use the bridge vlan method and it will work very easily.

a. use bridge
b. assign all vlans to the bridge
c. configure bridge port settings etherports and wlans
d. configure bridge vlan settings
e. set IP address of the wapac to be on the management vlan
f. ensure ip discovery is the managment vlan
g. ensure winbox macserver is set to the management vlan
h. ensure one ip route exists to the management vlan gateway IP of the device
Done!

Us this guide for access point… (see access point example)
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1

rgroothuis · November 4, 2021, 9:17pm

Finally got something working Below is the current config. Comments if this is the right and/or best config are always welcome.
Next step is to move this config into, under CAPSMAN

# nov/04/2021 19:57:03 by RouterOS 6.48.1
# software id = TMGN-VZVM
#
# model = RouterBOARD wAP G-5HacT2HnD
# serial number = 69A50578307F
/interface bridge
add fast-forward=no name=bridge101 protocol-mode=none
add name=bridge103
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
    disabled=no distance=indoors frequency=auto installation=outdoor mode=\
    ap-bridge ssid=mikrotik-off wireless-protocol=802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
    20/40/80mhz-XXXX distance=indoors frequency=auto installation=outdoor \
    mode=ap-bridge ssid=MikroTik wireless-protocol=802.11
/interface vlan
add interface=ether1 name=vlan5 vlan-id=5
add interface=ether1 name=vlan101 vlan-id=101
add interface=ether1 name=vlan103 vlan-id=103
/caps-man datapath
add arp=enabled bridge=bridge101 local-forwarding=yes name=DataPathVLAN101 \
    vlan-id=101 vlan-mode=use-tag
add bridge=bridge101 local-forwarding=yes name=DatapathVLAN103 vlan-id=103 \
    vlan-mode=use-tag
/caps-man configuration
add datapath=DataPathVLAN101 name=CAPsVLAN101 ssid=CAPsVLAN101
add datapath=DatapathVLAN103 name=CAPsVLAN103 ssid=CAPsVLAN103
/interface wireless
add disabled=no keepalive-frames=disabled mac-address=E6:8D:8C:72:D5:30 \
    master-interface=wlan1 multicast-buffering=disabled name=wlan-101 ssid=\
    vlan101 wds-cost-range=0 wds-default-cost=0 wps-mode=disabled
add disabled=no keepalive-frames=disabled mac-address=E6:8D:8C:72:D5:31 \
    master-interface=wlan1 multicast-buffering=disabled name=wlan-103 ssid=\
    vlan103 wds-cost-range=0 wds-default-cost=0 wps-mode=disabled
/interface list
add name=WAN
add name=VLAN
add name=BASE
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool0 ranges=192.168.88.100-192.168.88.254
add name=dhcp_pool1_VLAN101 ranges=172.16.0.100-172.16.0.200
add name=dhcp_pool2_VLAN103 ranges=172.16.1.100-172.16.1.200
/caps-man manager
set enabled=yes
/caps-man provisioning
add action=create-dynamic-enabled comment="2.4 Ghz CAPS Config" \
    hw-supported-modes=gn master-configuration=CAPsVLAN101 name-format=\
    prefix-identity name-prefix=CAP- slave-configurations=CAPsVLAN103
add action=create-dynamic-enabled comment="5 Ghz CAPS Config" disabled=yes \
    hw-supported-modes=ac master-configuration=CAPsVLAN101 \
    slave-configurations=CAPsVLAN103
/interface bridge port
add bridge=bridge101 ingress-filtering=yes interface=wlan-101 pvid=101
add bridge=bridge101 interface=vlan101
add bridge=bridge103 interface=wlan-103
add bridge=bridge103 interface=vlan103
/ip neighbor discovery-settings
set discover-interface-list=all
/interface list member
add interface=ether1 list=WAN
add interface=vlan101 list=VLAN
add interface=vlan103 list=VLAN
/interface wireless cap
set caps-man-addresses=192.168.0.216 discovery-interfaces=wlan1 interfaces=\
    wlan1
/ip dhcp-client
add interface=vlan101
add interface=vlan103
add interface=bridge101
add disabled=no interface=vlan5
/ip firewall filter
add action=accept chain=input connection-state=established,related disabled=\
    yes
add action=accept chain=input disabled=yes in-interface-list=VLAN
add action=accept chain=forward connection-state=established,related \
    disabled=yes
add action=accept chain=forward connection-state=new disabled=yes \
    in-interface-list=VLAN out-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/system clock
set time-zone-name=Europe/Amsterdam
/system identity
set name=WIFI01-Test
/tool sniffer
set file-name=capture filter-interface=all memory-limit=1000KiB

mkx · November 5, 2021, 6:49am

Using multiple bridges is not the way to go. You should use single VLAN-aware bridge.

rgroothuis · November 5, 2021, 8:47am

Thanks for the feedback. I’ve now a working CAPSMAN solution using one bridge, but:

VLAN filtering on the CAPS client bridge is not enabled.
In the CAPSMAN config I’ve 2 datapath for VLAN 101 and 103, but both have no tagging and vlan id 1, this is strange to me but it is working.

If I add VLAN filtering on the CAPS client bridge, it is not working anymore, the WIFI client device doesn’t get an IP address.

This is the config of the CAPS client:

# nov/05/2021 09:46:22 by RouterOS 6.48.3
# software id = WPUN-FGW8
#
# model = RBD23UGS-5HPacD2HnD
# serial number = CD4F0E12686E
/interface bridge
add admin-mac=2C:C8:1B:5B:6F:E0 auto-mac=no name=bridge1
/interface wireless
# managed by CAPsMAN
# channel: 2447/20-eC/gn(30dBm), SSID: CAPsVLAN101, local forwarding
set [ find default-name=wlan1 ] band=2ghz-g/n channel-width=20/40mhz-XX disabled=no frequency=auto installation=outdoor mode=ap-bridge ssid=MikroTik-5B6FE2
set [ find default-name=wlan2 ] band=5ghz-onlyac frequency=auto installation=outdoor mode=ap-bridge ssid=MikroTik-5B6FE3
/interface vlan
add interface=ether1 name=vlan5 vlan-id=5
add interface=ether1 name=vlan101 vlan-id=101
add interface=ether1 name=vlan103 vlan-id=103
/interface list
add name=WAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/interface bridge port
add bridge=bridge1 interface=vlan101 multicast-router=disabled
add bridge=bridge1 interface=vlan103 multicast-router=disabled
/interface bridge vlan
add bridge=bridge1 disabled=yes tagged=vlan101 vlan-ids=101
add bridge=bridge1 disabled=yes tagged=vlan103 vlan-ids=103
/interface list member
add interface=ether1 list=WAN
/interface wireless cap
# 
set bridge=bridge1 caps-man-addresses=192.168.5.6 discovery-interfaces=bridge1 enabled=yes interfaces=wlan1
/ip dhcp-client
add disabled=no interface=vlan5
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
/system clock
set time-zone-name=Europe/Amsterdam
/system identity
set name=NetMetal-WF01

mkx · November 5, 2021, 9:59am

We’d have to see also the CAPsMAN config (/capsman export[/i), without it we can’t correlate local configuration of wired part from CAP device and remote configuration of wireless from CAPsMAN.

rgroothuis · November 5, 2021, 10:06am

This is the CAPSMAN config:

# nov/05/2021 11:06:07 by RouterOS 6.48.1
# software id = TMGN-VZVM
#
# model = RouterBOARD wAP G-5HacT2HnD
# serial number = 69A50578307F
/caps-man configuration
add datapath=DataPathVLAN101 name=CAPsVLAN101 ssid=CAPsVLAN101
add datapath=DatapathVLAN103 name=CAPsVLAN103 ssid=CAPsVLAN103
/caps-man datapath
add arp=enabled bridge=bridge1 local-forwarding=yes name=DataPathVLAN101 vlan-id=1 vlan-mode=no-tag
add bridge=bridge1 local-forwarding=yes name=DatapathVLAN103 vlan-id=1 vlan-mode=no-tag
/caps-man interface
add configuration=CAPsVLAN101 disabled=no l2mtu=1600 mac-address=2C:C8:1B:5B:6F:E2 master-interface=none name=CAP--NetMetal-WF01-1 radio-mac=2C:C8:1B:5B:6F:E2 radio-name=\
    2CC81B5B6FE2
add configuration=CAPsVLAN103 disabled=no l2mtu=1600 mac-address=2E:C8:1B:5B:6F:E2 master-interface=CAP--NetMetal-WF01-1 name=CAP--NetMetal-WF01-1-1 radio-mac=\
    00:00:00:00:00:00 radio-name=2EC81B5B6FE2
/caps-man manager
set enabled=yes
/caps-man provisioning
add action=create-disabled comment="2.4 Ghz CAPS Config" hw-supported-modes=gn master-configuration=CAPsVLAN101 name-format=prefix-identity name-prefix=CAP- \
    slave-configurations=CAPsVLAN103
add action=create-dynamic-enabled comment="5 Ghz CAPS Config" disabled=yes hw-supported-modes=ac master-configuration=CAPsVLAN101 slave-configurations=CAPsVLAN103

mkx · November 5, 2021, 2:29pm

CAPsMAN datapath settings are completely VLAN-unaware.

It should have been something like this:

/capsman datapath
add local-forwarding=yes name=DataPathVLAN101 vlan-id=101 vlan-mode=use-tag
add local-forwarding=yes name=DataPathVLAN103 vlan-id=103 vlan-mode=use-tag

(n.b. setting property bridge doesn’t make any difference with local-forwarding, it’s for CAPsMAN forwarding). If VLAN stuff is not done properly on CAPsMAN device, then nothing’s gonna work actually …

L2 settings (for VLAN) on CAP device are all off. Did you read through VLAN on ROS bible to see how it’s done properly?

rgroothuis · November 5, 2021, 6:06pm

Based on the comments about single bridge to be used, I was trying to configured this differently but without any luck. Yes, I’ve read the VLAN bible. In my current configuration I’ve copied the AccessPoint example from VLAN bible.

I see the registration of the two clients in the registration tab page, but the clients are NOT getting any IP address. I absolutely don’t understand why not. I would love to understand what I’m doing wrong. Who can help me with the magic trick??
Screenshot 2021-11-05 at 19.10.23.png
I even have move the external DHCP server now to the same mikrotik device to prevent any issues on that interface.

Why does the client device not get an IP address? Has this something to do with masquerading? I’ve added a config for this, is this the correct config?

# nov/05/2021 18:58:14 by RouterOS 6.48.1
# software id = TMGN-VZVM
#
# model = RouterBOARD wAP G-5HacT2HnD
# serial number = 69A50578307F
/interface bridge
add frame-types=admit-only-vlan-tagged ingress-filtering=yes name=bridge1 \
    protocol-mode=none vlan-filtering=yes
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
    disabled=no distance=indoors frequency=auto installation=outdoor mode=\
    ap-bridge ssid=vlan101 wireless-protocol=802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
    20/40/80mhz-XXXX distance=indoors frequency=auto installation=outdoor \
    mode=ap-bridge ssid=MikroTik wireless-protocol=802.11
add disabled=no keepalive-frames=disabled mac-address=E6:8D:8C:72:D5:30 \
    master-interface=wlan1 multicast-buffering=disabled name=wlan3 ssid=\
    vlan103 vlan-id=101 wds-cost-range=0 wds-default-cost=0 wps-mode=disabled
/interface vlan
add interface=ether1 name=vlan5 vlan-id=5
add interface=ether1 name=vlan101 vlan-id=101
add interface=ether1 name=vlan103 vlan-id=103
/interface list
add name=WAN
add name=VLAN
add name=BASE
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool0 ranges=192.168.88.100-192.168.88.254
add name=dhcp_pool3 ranges=192.168.201.2-192.168.201.254
/ip dhcp-server
add address-pool=dhcp_pool3 disabled=no interface=vlan101 name=dhcp1
/caps-man manager
set enabled=yes
/interface bridge port
add bridge=bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes \
    interface=ether1
add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=wlan1 pvid=101
add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=wlan3 pvid=103
/ip neighbor discovery-settings
set discover-interface-list=BASE
/interface bridge vlan
add bridge=bridge1 tagged=ether1 vlan-ids=101
add bridge=bridge1 tagged=ether1 vlan-ids=103
add bridge=bridge1 tagged=bridge1,ether1 vlan-ids=5
/interface list member
add interface=ether1 list=WAN
add interface=vlan101 list=VLAN
add interface=vlan103 list=VLAN
add interface=vlan5 list=BASE
/interface wireless cap
set bridge=bridge1 caps-man-addresses=192.168.5.6 discovery-interfaces=vlan5 \
    interfaces=wlan1
/ip address
add address=192.168.201.1/24 interface=vlan101 network=192.168.201.0
/ip dhcp-client
add disabled=no interface=vlan5
/ip dhcp-server network
add address=192.168.201.0/24 dns-server=8.8.8.8 gateway=192.168.201.1
/ip firewall nat
add action=masquerade chain=srcnat out-interface=all-vlan
/ip route
add distance=1 dst-address=192.168.101.0/24 gateway=vlan101
add distance=1 dst-address=192.168.103.0/24 gateway=vlan103
/system clock
set time-zone-name=Europe/Amsterdam
/system identity
set name=WIFI01-Test
/tool mac-server
set allowed-interface-list=BASE
/tool mac-server mac-winbox
set allowed-interface-list=BASE
/tool sniffer
set file-name=capture filter-interface=all memory-limit=1000KiB

anav · November 5, 2021, 6:44pm

My advice regarding any wifi pertains to a non capsman setup.
For the life of me I dont understand why you keep trying to add capsman as it adds needless complexity.
Just get the vlan to work first, as per the linked reference. If you need capsman after that, then add it…at your own risk LOL.

(1) For now remove the ingress and other changes you have made to the top level Bridge identification.
/interface bridge
add frame-types=admit-only-vlan-tagged ingress-filtering=yes name=bridge1
protocol-mode=none vlan-filtering=yes

The only change to the default bridge line should be setting vlan-filtering to yes, at the end.
identified, configured the vlans to ether1 and not the bridge for the interface setting.

(3) You have two IP pools but 3 vlans…??? (okay I see late vlan5 is Internet??)

(4) You have 3 vlans and only one DHCP server (still missing one)

(5) You have 3 vlans and only one DHCP server network. (still missing one)

(6) In your Bridge vlan settings you are missing tagging the bridge as well.
/interface bridge vlan
add bridge=bridge1 tagged=ether1.??? vlan-ids=101
add bridge=bridge1 tagged=ether1,??? vlan-ids=103
add bridge=bridge1 tagged**=bridge1,**ether1 vlan-ids=5

(7) Interface list members… (note changed since realized vlan5 is actually a WANVLAN…
disregard next
VLAN5 should be also be listed as a VLAN member
/interface list member
add interface=ether1 list=WAN
add interface=vlan101 list=VLAN
add interface=vlan103 list=VLAN
add interface=vlan5 list=VLAN
add interface=vlan5 list=BASE

NEW Improved version…
/interface list member
add interface=ether1 list=WAN
ad interface=vlan5 list=WAN
add interface=vlan101 list=VLAN
add interface=vlan103 list=VLAN
add interface=vlan103 list=BASE (assuming 103 is the management vlan)

(8) You have three vlans but only one IP address (in this case you may be missing two)

(9) Finally at DHCP client , it is noted that vlan5 is actually a vlan for your WAN connection ???

(10) You have routes for your LAN subnets that I have no clue why they are there.

(11) The final straw that seems wrong. should be out-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat out-interface=all-vlan

(12) Is this device attached to an ISP modem? If so where are the firewall rules??

IN SUMMARY
Please provide a detailed network diagram to show connectivity between devices…
and the Subnets/vlans expected.

I dont understand your ISP connection at all…

rgroothuis · November 5, 2021, 7:23pm

I made the suggested changes, see config below, but still the wifi client doesn’t get an IP address.

Explanation on the network config:

VLAN101 and VLAN103 are for the wifi, one guest and one office wifi network.
VLAN5 is for the devices/management network
The ethernet/WAN interface as tagged data for VLAN5, VLAN101 and VLAN103.
There are multiple DHCP servers on the network behind the ethernet1/WAN interface. The IP addresses for the various VLANs should come from that DHCP server.
As this is not working, I’ve added for VLAN101 a DHCP server on the Mikrotik device, to see if that makes a difference (which is does not).
So for VLAN101 there are now two DHCP server, one on the main network and one on the Mikrotik device.
That is the reason why you only see one DHCP server, I can add more but that doesn’t change the situation as it is not working for WIFI VLAN101
I agree with you that CAPSMAN makes it more complex, hence in the previous config it was already disabled. I’m already nog using it anymore.

Below also a screenshot from the Winbox config.
Screenshot 2021-11-05 at 20.12.40.png
Again, what is strange is that the WIFI client is connected as I can see it in the registration tab page. But there is Leases record in the DHCP server tab page. My conclusion is therefore that somehow the WIFI client reach the DHCP server, or the reply from the DHCP server is not reaching the WIFI client.

# nov/05/2021 20:12:48 by RouterOS 6.48.1
# software id = TMGN-VZVM
#
# model = RouterBOARD wAP G-5HacT2HnD
# serial number = 69A50578307F
/interface bridge
add ingress-filtering=yes name=bridge1 protocol-mode=none vlan-filtering=yes
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
    disabled=no distance=indoors frequency=auto installation=outdoor mode=\
    ap-bridge ssid=vlan101 wireless-protocol=802.11
add disabled=no keepalive-frames=disabled mac-address=E6:8D:8C:72:D5:30 \
    master-interface=wlan1 multicast-buffering=disabled name=wlan3 ssid=\
    vlan103 vlan-id=101 wds-cost-range=0 wds-default-cost=0 wps-mode=disabled
/interface vlan
add interface=ether1 name=vlan5 vlan-id=5
add interface=ether1 name=vlan101 vlan-id=101
add interface=ether1 name=vlan103 vlan-id=103
/interface list
add name=WAN
add name=VLAN
add name=BASE
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool0 ranges=192.168.88.100-192.168.88.254
add name=dhcp_pool3 ranges=192.168.201.2-192.168.201.254
/ip dhcp-server
add address-pool=dhcp_pool3 disabled=no interface=vlan101 name=dhcp1
/caps-man manager
set enabled=yes
/interface bridge port
add bridge=bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes \
    interface=ether1
add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=wlan1 pvid=101
add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=wlan3 pvid=103
/ip neighbor discovery-settings
set discover-interface-list=WAN
/interface bridge vlan
add bridge=bridge1 tagged=ether1,bridge1 vlan-ids=101
add bridge=bridge1 tagged=ether1,bridge1 vlan-ids=103
add bridge=bridge1 tagged=bridge1,ether1 vlan-ids=5
/interface list member
add interface=ether1 list=WAN
add interface=vlan101 list=VLAN
add interface=vlan103 list=VLAN
add interface=vlan5 list=WAN
add interface=vlan5 list=VLAN
/interface wireless cap
set bridge=bridge1 caps-man-addresses=192.168.5.6 discovery-interfaces=vlan5 \
    interfaces=wlan1
/ip address
add address=192.168.201.1/24 interface=vlan101 network=192.168.201.0
/ip dhcp-client
add disabled=no interface=vlan5
/ip dhcp-server network
add address=192.168.201.0/24 dns-server=8.8.8.8 gateway=192.168.201.1
/ip firewall nat
add action=masquerade chain=srcnat out-interface-list=WAN
/ip route
add disabled=yes distance=1 dst-address=192.168.101.0/24 gateway=vlan101
add distance=1 dst-address=192.168.103.0/24 gateway=vlan103
/system clock
set time-zone-name=Europe/Amsterdam
/system identity
set name=WIFI01-Test
/system logging
add topics=dhcp
add topics=firewall
/tool mac-server
set allowed-interface-list=WAN
/tool mac-server mac-winbox
set allowed-interface-list=WAN
/tool sniffer
set file-name=capture filter-interface=all memory-limit=1000KiB

rgroothuis · November 5, 2021, 7:28pm

When I check (Torch) the wlan1 interface, I see the DHCP request coming, see screenshot.
But the DHCP request is not on VLAN101 which I expect is should be. I believe that that is the reason when the WIFI client cannot reach the DHCP server.
Screenshot 2021-11-05 at 20.25.07.png
But I don’t know how to fix this. The wlan1 interface is configure as “no tag” and VLAN ID = 1. So how and when is the VLAN101 tag being added to the wlan1 traffic so that it can reach the DHCP server on VLAN101?

Maybe this is were we should focus on fixing the problem?

rgroothuis · November 5, 2021, 8:56pm

I’ve added the two VLANs created on the ethernet interface to the same bridge and now it seems to be working

Despite the fact it is working, would this be the correct config?

This is the config:

# nov/05/2021 21:53:42 by RouterOS 6.48.1
# software id = TMGN-VZVM
#
# model = RouterBOARD wAP G-5HacT2HnD
# serial number = 69A50578307F
/interface bridge
add ingress-filtering=yes name=bridge1 protocol-mode=none vlan-filtering=yes
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
    disabled=no distance=indoors frequency=auto installation=outdoor mode=\
    ap-bridge ssid=vlan101 wireless-protocol=802.11
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
    20/40/80mhz-XXXX distance=indoors frequency=auto installation=outdoor \
    mode=ap-bridge ssid=MikroTik wireless-protocol=802.11
add disabled=no keepalive-frames=disabled mac-address=E6:8D:8C:72:D5:30 \
    master-interface=wlan1 multicast-buffering=disabled name=wlan3 ssid=\
    vlan103 vlan-id=101 wds-cost-range=0 wds-default-cost=0 wps-mode=disabled
/interface vlan
add interface=ether1 name=vlan5 vlan-id=5
add interface=ether1 name=vlan101 vlan-id=101
add interface=ether1 name=vlan103 vlan-id=103
/interface list
add name=WAN
add name=VLAN
add name=BASE
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=dhcp_pool0 ranges=192.168.88.100-192.168.88.254
add name=dhcp_pool3 ranges=192.168.201.2-192.168.201.254
/ip dhcp-server
add address-pool=dhcp_pool3 interface=vlan101 name=dhcp1
/caps-man manager
set enabled=yes
/interface bridge port
add bridge=bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes \
    interface=ether1
add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=wlan1 pvid=101
add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=wlan3 pvid=103
add bridge=bridge1 interface=vlan101 pvid=101
add bridge=bridge1 interface=vlan103 pvid=103
/ip neighbor discovery-settings
set discover-interface-list=WAN
/interface bridge vlan
add bridge=bridge1 tagged=ether1,bridge1 untagged=wlan1 vlan-ids=101
add bridge=bridge1 tagged=ether1,bridge1 untagged=wlan3 vlan-ids=103
add bridge=bridge1 tagged=bridge1,ether1 vlan-ids=5
/interface list member
add interface=ether1 list=WAN
add interface=vlan101 list=VLAN
add interface=vlan103 list=VLAN
add interface=vlan5 list=WAN
add interface=vlan5 list=VLAN
/interface wireless cap
set bridge=bridge1 caps-man-addresses=192.168.5.6 discovery-interfaces=vlan5 \
    interfaces=wlan1
/ip address
add address=192.168.201.1/24 interface=vlan101 network=192.168.201.0
/ip dhcp-client
add disabled=no interface=vlan5
/ip dhcp-server network
add address=192.168.201.0/24 dns-server=8.8.8.8 gateway=192.168.201.1
/ip route
add distance=1 dst-address=192.168.101.0/24 gateway=vlan101
add distance=1 dst-address=192.168.103.0/24 gateway=vlan103
/system clock
set time-zone-name=Europe/Amsterdam
/system identity
set name=WIFI01-Test
/system logging
add topics=dhcp
add topics=firewall
/tool mac-server
set allowed-interface-list=WAN
/tool mac-server mac-winbox
set allowed-interface-list=WAN
/tool sniffer
set file-name=capture filter-interface=all memory-limit=1000KiB

rgroothuis · November 8, 2021, 7:31am

On one access point i’ve working and stable solution using one bridge as recommended above (see config below). Next problem happens. When connecting a second access point to the switch, I add vlan5, vla101 and vlan103 to the ether1 and vlan101 and vlan103 to the bridge (on the 2nd device) I get the following error message:

vlan103: bridge port received packet with own address as source address (e4:8d:8c:72:d5:2e), probably loop

I’ve been reading on STP, RSTP and MSTP but I’m not sure if this is the solution to the problem. Any suggestions from somebody?

The VLAN’s, ether1 and the bridge on the 1st AP all have the same MAC address. The VLAN’s, ether1 and bridge on the 2nd AP have all the same but different MAC address compared to the 1st AP. Is this the correct configuration? Should all VLAN’s etc not have their own MAC address?

# nov/08/2021 07:30:15 by RouterOS 6.48.1
# software id = TMGN-VZVM
#
# model = RouterBOARD wAP G-5HacT2HnD
# serial number = 69A50578307F
/interface bridge
add ingress-filtering=yes name=bridge1 protocol-mode=mstp region-name=Test \
    vlan-filtering=yes
/interface wireless
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
    20/40/80mhz-XXXX distance=indoors frequency=auto installation=outdoor \
    mode=ap-bridge ssid=MikroTik wireless-protocol=802.11
/interface vlan
add interface=ether1 name=vlan5 vlan-id=5
add interface=ether1 name=vlan101 vlan-id=101
add interface=ether1 name=vlan103 vlan-id=103
/interface list
add name=WAN
add name=VLAN
add name=BASE
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=\
    profile1 supplicant-identity="" wpa2-pre-shared-key=geenwachtwoord
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
    disabled=no distance=indoors frequency=auto installation=outdoor mode=\
    ap-bridge security-profile=profile1 ssid=vlan101 wireless-protocol=802.11
add disabled=no keepalive-frames=disabled mac-address=E6:8D:8C:72:D5:30 \
    master-interface=wlan1 multicast-buffering=disabled name=wlan3 \
    security-profile=profile1 ssid=vlan103 vlan-id=101 wds-cost-range=0 \
    wds-default-cost=0 wps-mode=disabled
/interface bridge port
add bridge=bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes \
    interface=ether1
add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=wlan1 pvid=101
add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged \
    ingress-filtering=yes interface=wlan3 pvid=103
add bridge=bridge1 interface=vlan101 pvid=101
add bridge=bridge1 interface=vlan103 pvid=103
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge1 tagged=ether1,bridge1 untagged=wlan1 vlan-ids=101
add bridge=bridge1 tagged=ether1,bridge1 untagged=wlan3 vlan-ids=103
add bridge=bridge1 tagged=bridge1,ether1 vlan-ids=5
/interface list member
add interface=ether1 list=WAN
add interface=vlan101 list=VLAN
add interface=vlan103 list=VLAN
add interface=vlan5 list=WAN
add interface=vlan5 list=VLAN
add interface=bridge1 list=LAN
/ip dhcp-client
add disabled=no interface=vlan5
/ip route
add distance=1 dst-address=192.168.101.0/24 gateway=vlan101
add distance=1 dst-address=192.168.103.0/24 gateway=vlan103
/system clock
set time-zone-name=Europe/Amsterdam
/system identity
set name=WIFI01-Test
/system logging
add topics=dhcp
add topics=firewall
/tool mac-server
set allowed-interface-list=WAN
/tool mac-server mac-winbox
set allowed-interface-list=WAN
/tool sniffer
set file-name=capture filter-interface=all memory-limit=1000KiB

mkx · November 8, 2021, 5:19pm

That’s because your VLAN config is still a huge mess. Seems like you managed to misunderstand all the suggestions by @anay and myself.

I suggest you to reset gear to defaults and start doing VLAN stuff from scratch. First do the bridge stuff, show us the result for review. Forget about wireless (both capsman and local config) until you get ether ports, bridge and VLANs right.

anav · November 8, 2021, 5:23pm

Use this as a guide…
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1

Again, please provide a network diagram, I have no idea why you are trying to use DHCP with VLANs on this device and then pass them up through the WAN connection to god knows what??

IF I was to guess, this WAPC is strictly supposed to be an Accesspoint/Switch and thus should have very little setup other than wifi, and bridge/vlans.
What is before the WAP? Another MT router?, an ISP router?

rgroothuis · November 10, 2021, 7:58am

Looking backwards, I was making things more complicated as they should be. Indeed the VLAN config was not done correctly. Putting VLANs into a bridge on both APs caused looping problems as well. I reviewed the whole situation again, after a good night sleep, started from scratch again and now I’ve a good and stable working solution. A solution with and without CAPSMAN.

Below the current working config for the CAPSMAN and the CAPs client.

CAPSMAN:

# nov/10/2021 08:55:08 by RouterOS 6.48.1
# software id = TMGN-VZVM
#
# model = RouterBOARD wAP G-5HacT2HnD
# serial number = 69A50578307F
/caps-man channel
add band=5ghz-onlyac control-channel-width=20mhz extension-channel=Ce \
    frequency=5180,5200,5220,5240 name=5Ghz-Channels-40Mhz skip-dfs-channels=\
    yes
add band=2ghz-g/n control-channel-width=20mhz extension-channel=disabled \
    frequency=2412,2437,2462 name=2.4Ghz-Channels skip-dfs-channels=yes \
    tx-power=7
/caps-man datapath
add local-forwarding=yes name=datapath101 vlan-id=101 vlan-mode=use-tag
add local-forwarding=yes name=datapath103 vlan-id=103 vlan-mode=use-tag
/caps-man configuration
add channel=2.4Ghz-Channels datapath=datapath101 name=Test-2.4Ghz-Gast \
    ssid=Test
add channel=2.4Ghz-Channels datapath=datapath103 name=Test-2.4Ghz-Beheer \
    ssid=Test-Beheer
add channel=5Ghz-Channels-40Mhz datapath=datapath101 name=Test-5Ghz-Gast \
    ssid=Test
add channel=5Ghz-Channels-40Mhz datapath=datapath103 name=\
    Test-5Ghz-Beheer ssid=Test-Beheer
/interface bridge
add name=bridge1
/interface wireless
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=\
    20/40/80mhz-XXXX disabled=no distance=indoors frequency=auto \
    installation=outdoor mode=ap-bridge ssid=MikroTik wireless-protocol=\
    802.11
/caps-man interface
add configuration=Test-2.4Ghz-Gast disabled=no l2mtu=1600 mac-address=\
    2C:C8:1B:5B:6F:B6 master-interface=none name=MikroTik-1 radio-mac=\
    2C:C8:1B:5B:6F:B6 radio-name=2CC81B5B6FB6
add configuration=Test-2.4Ghz-Beheer disabled=no l2mtu=1600 mac-address=\
    2E:C8:1B:5B:6F:B6 master-interface=MikroTik-1 name=MikroTik-1-1 \
    radio-mac=00:00:00:00:00:00 radio-name=2EC81B5B6FB6
/interface list
add name=WAN
add name=VLAN
add name=BASE
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk eap-methods="" mode=dynamic-keys name=\
    profile1 supplicant-identity="" wpa2-pre-shared-key=geenwachtwoord
/interface wireless
# managed by CAPsMAN
# channel: 2437/20/gn(5dBm), SSID: Test, local forwarding
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX \
    disabled=no distance=indoors frequency=auto installation=outdoor mode=\
    ap-bridge security-profile=profile1 ssid=vlan101 wireless-protocol=802.11
/caps-man manager
set enabled=yes
/caps-man provisioning
add action=create-dynamic-enabled comment="==>> 2.4Ghz WIFI Config" \
    hw-supported-modes=gn master-configuration=Test-2.4Ghz-Gast \
    name-format=identity name-prefix=cap- slave-configurations=\
    Test-2.4Ghz-Beheer
add action=create-dynamic-enabled comment="==>> 5Ghz WIFI Config" \
    hw-supported-modes=ac master-configuration=Test-5Ghz-Gast \
    name-format=identity name-prefix=cap- slave-configurations=\
    Test-5Ghz-Beheer
/interface bridge port
add bridge=bridge1 frame-types=admit-only-vlan-tagged ingress-filtering=yes \
    interface=ether1
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge1 disabled=yes tagged=ether1,bridge1 untagged=wlan1 \
    vlan-ids=101
add bridge=bridge1 disabled=yes tagged=ether1,bridge1 untagged=*A vlan-ids=\
    103
add bridge=bridge1 disabled=yes tagged=bridge1,ether1 vlan-ids=5
/interface list member
add interface=ether1 list=WAN
add list=VLAN
add list=VLAN
add list=WAN
add list=VLAN
add interface=bridge1 list=LAN
/interface wireless cap
# 
set bridge=bridge1 caps-man-addresses=192.168.0.216 discovery-interfaces=\
    wlan1 enabled=yes interfaces=wlan1
/ip dhcp-client
add disabled=no interface=bridge1
/system clock
set time-zone-name=Europe/Amsterdam
/system identity
set name=WIFI01-Test
/system logging
add topics=dhcp
add topics=firewall
/tool mac-server
set allowed-interface-list=WAN
/tool mac-server mac-winbox
set allowed-interface-list=WAN
/tool sniffer
set file-name=capture filter-interface=all memory-limit=1000KiB

CAPs client:

# nov/10/2021 08:30:02 by RouterOS 6.47.9
# software id = WJ7F-ZQU9
#
# model = RBD23UGS-5HPacD2HnD
# serial number = CD4F0E556CB9
/interface bridge
add admin-mac=2C:C8:1B:5B:6F:B4 auto-mac=no name=bridge1
/interface wireless
# managed by CAPsMAN
# channel: 2462/20/gn(7dBm), SSID: WsvHelius, local forwarding
set [ find default-name=wlan1 ] band=2ghz-b/g/n channel-width=20/40mhz-XX disabled=no frequency=auto installation=\
    outdoor mode=ap-bridge ssid=vlan101-2
# managed by CAPsMAN
# channel: 5220/20-Ce/ac(17dBm), SSID: WsvHelius, local forwarding
set [ find default-name=wlan2 ] band=5ghz-a/n/ac channel-width=20/40/80mhz-XXXX disabled=no frequency=auto \
    installation=outdoor mode=ap-bridge ssid=MikroTik-5B6FB7
add mac-address=2E:C8:1B:5B:6F:B6 master-interface=wlan1 mode=station name=wlan26
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip hotspot profile
set [ find default=yes ] html-directory=flash/hotspot
/interface bridge port
add bridge=bridge1 interface=ether1
/interface wireless cap
# 
set bridge=bridge1 caps-man-addresses=192.168.5.6 discovery-interfaces=bridge1 enabled=yes interfaces=wlan1,wlan2
/ip dhcp-client
add disabled=no interface=bridge1
/system clock
set time-zone-name=Europe/Amsterdam

mkx · November 10, 2021, 2:14pm

CAP config is more or less fine with a couple of remarks:

/interface wireless cap

set bridge=bridge1 > caps-man-addresses=192.168.5.6 > discovery-interfaces=bridge1 enabled=yes interfaces=wlan1,wlan2

No need to configure IP address of CAPsMAN as it is located in same L2 network and CAPsMAN client can find it using broadcasts. This property has to be set-up if CAPsMAN is located in different IP subnet and thus CAP can not find it automatically.

currently bridge acts as a dumb switch between ether1, wlan1 and wlan2 ports. Which in this case is more or less fine. However, if your CAP would have multiple wired ports which would connect different (untrusted) devices, then it would be much better to configure VLANs on CAP properly. The missing setup is pretty simple:

/interface bridge vlan
add bridge=bridge tagged=ether1 vlan-ids=101,103
/interface bridge
set [ find name=bridge] vlan-filtering=yes

CAPsMAN provisioning takes care of setting VLAN properties for wlan1 and wlan2 interfaces (and others as each virtual AP gets its own interface). The code snippet above just makes sure bridge interface never sees any tagged frames.

How are CAP and CAPsMAN connected? ether1 of CAP connected to ether1 of CAPsMAN? How does management work? CAPsMAN only allows tagged frames on ether1 ingress (VLANs 101, 103 and 5 which is disabled) while CAP requires untagged on ether1 for management (it’s IP address is set directly on bridge interface). Actually CAPsMAN device lacks all “logical” VLAN config (i.e. interfaces under /interface vlan) and IP config … or is it only missing from export?