I have the following WLAN setup using CAPsMAN on RB5009 and cAP ax connected directly to RB5009 using a trunk port:
# 2023-11-24 22:44:05 by RouterOS 7.12
# software id = E83S-AAZN
#
# model = RB5009UPr+S+
/interface wifiwave2 channel
add frequency="" name=5ghz
add name=2ghz width=20/40mhz
/interface wifiwave2 datapath
add bridge=bridge-lan name=vlan100 vlan-id=100
add bridge=bridge-lan name=vlan400 vlan-id=400
/interface wifiwave2 security
add authentication-types=wpa2-psk,wpa3-psk name=sec-private
add authentication-types=wpa2-psk,wpa3-psk name=sec-guest
/interface wifiwave2 configuration
add country=Germany datapath=vlan400 name=wlan-guest-5ghz security=sec-guest ssid=Guest
add channel=5ghz country=Germany datapath=vlan100 name=wlan-private-5ghz security=sec-private ssid=Private
add channel=2ghz country=Germany datapath=vlan100 name=wlan-private-2ghz security=sec-private ssid=Private_2.4
/interface wifiwave2 capsman
set enabled=yes interfaces=vlan50
/interface wifiwave2 provisioning
add action=create-dynamic-enabled master-configuration=wlan-private-5ghz name-format=5ghz-%I slave-configurations=wlan-guest-5ghz supported-bands=5ghz-ax
add action=create-dynamic-enabled disabled=no master-configuration=wlan-private-2ghz name-format=2ghz-%I supported-bands=2ghz-ax
/interface bridge vlan
add bridge=bridge-lan tagged=bridge-lan,ether7-capax vlan-ids=400
add bridge=bridge-lan tagged=bridge-lan untagged=ether7-capax vlan-ids=50
add bridge=bridge-lan tagged=bridge-lan,ether7-capax untagged=ether1-desktop vlan-ids=100
/interface vlan
add comment=mgmt interface=bridge-lan name=vlan50 vlan-id=50
add comment=private interface=bridge-lan name=vlan100 vlan-id=100
add comment=guest interface=bridge-lan name=vlan400 vlan-id=400
It works as expected and I cannot inject 802.1Q VID 100 tagged frames when connected to the Guest network. However, when I was setting up my hAP ac^2 as a wifi repeater/extender connected to the Guest network and using the following configuration I noticed that a PC connected to one of the ports of the hap ac^2 was receiving 802.1Q frames tagged with VID 400:
# 1970-01-02 02:45:22 by RouterOS 7.13beta2
# software id = CGZZ-X439
#
# model = RBD52G-5HacD2HnD
/interface bridge
add admin-mac=3C:C5:1A:D6:87:D1 auto-mac=no comment=defconf name=bridge port-cost-mode=short
/interface wifi
set [ find default-name=wifi1 ] configuration.mode=station-bridge .ssid=notinuse name=wifi-station-2ghz
set [ find default-name=wifi2 ] configuration.mode=station-bridge .ssid=Guest datapath.bridge=bridge disabled=no name=wifi-station-5ghz
/interface bridge port
add bridge=bridge interface=ether2 internal-path-cost=10 path-cost=10
add bridge=bridge interface=ether3 internal-path-cost=10 path-cost=10
add bridge=bridge interface=ether4 internal-path-cost=10 path-cost=10
add bridge=bridge interface=ether5 internal-path-cost=10 path-cost=10
add bridge=bridge interface=ether1 internal-path-cost=10 path-cost=10
add bridge=bridge interface=wifi-station-2ghz
add bridge=bridge interface=wifi-station-5ghz
I’ve tried multiple VLAN configurations on the PC and these are the results:
- DHCP works on the untagged physical interface, but the replies that are recieved are 802.1Q tagged.
- Sending untagged frames with ARP requests of the RB5009 IP on the vlan400 interface - the reply comes in from RB5009, but it is 802.1Q tagged and is ignored by the host.
- Sending VID 100 tagged frames with ARP requests of the RB5009 IP on the vlan100 interface - no response.
- Sending VID 400 tagged frames with ARP requests of the RB5009 IP on the vlan400 interface - no response.
- Set the same IP on the VID 400 interface as on the physical interface and do an ARP ping. I’m now able to receive the ARP replies on the VID 400 interface, but they have to be send untagged by the physical interface.
Have I set up the datapaths incorrectly or is this a bug in VLAN untagging when using the 4-address frame format?