WiFi CAPs recommended way to configure VLAN IDs?

RouterOS General
1

I need to config a number (32) of cAP ax devices. The network I have to install them had CAPSMAN forwarding before, and now I would need to use VLAN IDs. VLANS are fine, because switches are VLANned, I would just need to reconfigure more trunks.

What I am wondering is how is the CAP adding supposed to work as per MikroTik? When I reset to CAP mode, it is very simplistic, and it is essentially set for the packets to be tagged by CAPSMAN, which is actually the reason why I bought AX devices in the first place - setting VLANS on old CAPs is hell.

Does the above mean that I am supposed to route trunks to the CAPS and also allow one management VLAN untagged on for management?

The switches already have VLANs configured, and all CAPs are in their own VLAN. What I was thinking to do is just make trunks out of LAN ports and allow both tagged and untagged. Untagged is for management, and tagged packets would then be routed where need be.

It seems to me that in MikroTik they actually wanted for this to be set this way? Or?

I would like to skip doing too much work on CAPs and changing too much on the infrastructure devices already installed.

For the record, this is the default config:

/interface bridge
add admin-mac=xx:xx:xx:xx:xx:xx auto-mac=no comment=defconf name=bridgeLocal
/interface wifi datapath
add bridge=bridgeLocal comment=defconf disabled=no name=capdp
/interface wifi
# no connection to CAPsMAN
set [ find default-name=wifi1 ] configuration.manager=capsman datapath=capdp
# no connection to CAPsMAN
set [ find default-name=wifi2 ] configuration.manager=capsman datapath=capdp
/interface bridge port
add bridge=bridgeLocal comment=defconf interface=ether1
add bridge=bridgeLocal comment=defconf interface=ether2
/interface wifi cap
set discovery-interfaces=bridgeLocal enabled=yes slaves-datapath=capdp
/ip dhcp-client
add comment=defconf interface=bridgeLocal
/system note
set show-at-login=no
2

Since you have only AX devices:
Using datapath settings on capsman controller, you can already split your wifi channels into other vlans.
It is not needed per se to use trunks on caps, caps mode on itself is already enough.
This aligns with the example as provided by MT:
Cap using wifi-qcom package:https://help.mikrotik.com/docs/spaces/ROS/pages/224559120/WiFi#WiFi-CAPusing"wifi-qcom"package:

If you really want to segregate things to the maximum: separate VLAN for management, IP address for cap via that VLAN and all the rest in other VLANs and enable VLAN filtering on CAP.
But again, it is not really needed (obviously your switches in between need to transport all info in the correct way, tagged and/or untagged).

3

I am not sure I understand you, but yes I would like things to be as simple as setting stuff in CAPSMAN as you described.

The current situation is that I have LAN (untagged, memeber of VLAN) for APs. I do not understand how would CAPSMAN handle data forwarding into appropriate VLANs for appropriate SSIDs if I don’t have trunks there for for data to go into?

I understood that in tutorial CAP handless tagging and untagging as per setting on CAPSMAN, and that they turned off the CAPSMAN forwarding exactly because of load on the controller (200-300 mbps WiFi traffic from one AP will eat up 40-45% of CPU power on RB1100AHX4).

4

The point is, your receiving end (your router and all intermediate switches) are to handle all VLAN stuff.
Untagged for the management layer, vlan for whatever you set in datapath.
Nothing on cap.
Look closely at the example provided, lab-test it and you will see it simply works.

If you really want to use VLAN end-to-end, then you need to do some stuff on each single cap device (add vlan interface, foresee IP via DHCP or static, set vlan bridging, required trunk, etc etc)

5

Thank you, I understand.