wapAC works -- but with poor performance

BeeKeeper · Wed Jan 12, 2022 3:02 pm

Yesterday I started to configure my new wapAC and I reached a configuration which is doing what I want,
but any WLAN connection is quite slow. It is approximately 20 MBps in the 5GHZ band.

Each wired device always shows up nearly the full ISP connection rate 100 Mbit up/ 50 MBits down.
If I change my access point against a wired device it shows at any VLAN 100 MBits Up / 50 Bits down.
So I assume the router port is configured correctly.

I need some help to analyze this WLAn issue because I plan to install further access points.
Thank you very much in advance

The network structure looks like

 ISP---Draytek Modem------ RB4011iGS+ ----Switch Mikrotik
 									-----Switch Netgear
									-----Switch Netgear
									-----wapAC ( only using vlan 10 and 20 )

Each trunk between router and switches/access points is identical: untagged PVID 1, Tagged vlan 10,20,60,111.

Each network device ( router, switch, access point .. ) should have an ip inside 192.168.1.0/24.

All ip services should be provided by the router ( DHCP,DNS,FW,... )

Here is my wapAC configuration:

# jan/12/2022 12:55:24 by RouterOS 6.48.4
# software id = JTTL-RK5C
#
# model = RBwAPG-5HacD2HnD
# serial number = E4640DCE3E09
/interface bridge
add name=vlan-bridge protocol-mode=none vlan-filtering=yes
/interface wireless
set [ find default-name=wlan1 ] ssid=MikroTik
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk eap-methods="" \
mode=dynamic-keys supplicant-identity=MikroTik
add authentication-types=wpa-psk,wpa2-psk eap-methods="" \
management-protection=allowed mode=dynamic-keys name=secDefault \
supplicant-identity=""
/interface wireless
set [ find default-name=wlan2 ] country=germany disabled=no mode=ap-bridge \
name=wlanxGast security-profile=secDefault ssid=xGast
add disabled=no keepalive-frames=disabled mac-address=0A:55:31:D8:35:F9 \
master-interface=wlanxGast multicast-buffering=disabled name=wlanxHypnose \
security-profile=secDefault ssid=xHypnose wds-cost-range=0 \
wds-default-cost=0 wps-mode=disabled
/ip hotspot profile
set [ find default=yes ] html-directory=hotspot
/interface bridge port
add bridge=vlan-bridge interface=ether1 multicast-router=disabled
add bridge=vlan-bridge frame-types=admit-only-untagged-and-priority-tagged \
interface=wlanxGast multicast-router=disabled pvid=10
add bridge=vlan-bridge frame-types=admit-only-untagged-and-priority-tagged \
interface=wlanxHypnose multicast-router=disabled pvid=20
/interface bridge vlan
add bridge=vlan-bridge tagged=ether1 untagged=wlanxGast vlan-ids=10
add bridge=vlan-bridge tagged=ether1 untagged=wlanxHypnose vlan-ids=20
/ip dhcp-client
add disabled=no interface=vlan-bridge
/ip dns
set allow-remote-requests=yes servers=192.168.1.254
/system clock
set time-zone-name=Europe/Berlin
/system identity
set name=wapac01

anav · Wed Jan 12, 2022 8:33 pm

Couple of points

(1) Remove this, as there is no WAN or LAN
/ip dhcp-client
add disabled=no interface=vlan-bridge

(2) Ensure there is a route to the gateway of the trusted subnet
add dst=0.0.0.0/0 gwy=192.168.1.1

(3) Add interface=Manage
add trusted vlan to the interface as a Vlan member
add interface Manage to neighbour discovery
add interface Manage to tools winmac server interface list entry.

(4) The wapac is missing an IP address??

(5) If neither vlan10 or vlan20 is the trusted vlan, in other words they are not described by the subnet of 192.168.1.0/24,
then you need to add the trusted vlan to the trunk traffic, and too the settings above.

THE trusted VLAN should be TAGGED to the bridge and ether1, for that particular vlan-id.

bpwl · Wed Jan 12, 2022 10:16 pm

but any WLAN connection is quite slow. It is approximately 20 MBps in the 5GHZ band.

I don't see much setting for the WLAN interfaces. So most is default setting. Not very good in many cases.

Parameters to set:
1: Regulatory domain mode, with country Germany. Out of the box I assume it is "no country set". Those FCC frequencies are not the freq used by client devices set for Germany. This is set and OK for WLAN2.
2: Wifi Channels to be used. In a lonely and idle environment the defaults wil be OK. [ For 5GHz: 802.11a/g/n/ac , 20MHz XXXX (=80 MHz bandwidth!)]. This is OK if all is open and free. However one should check te RF environment for WLAN1 and WLAN2 (e.g. use "Snooper" to see the wifi environment. Avoid to select already used wifi channels. It may be necessary to reduce the bandwidth (like 20MHzCe or 20MHzeC), and do select the best channel frequency.

Values to check:
3. Check the registration In the registration table under wireless interface one can see the connection state and quality. Important things to notice are SIgnal strength, signal to noise, and CCQ (should be high like 97%, but passing a wall will make it 65%). Those numbers will allow the max interface rate, written as 866Mbps-80MHz/2S/SGI, the best case possible, giving +- 360Mbps user throughput. User data is around 1/2 of the interface rate for 1 direction, and 1/4 if bidirectional communication is used.

If the max WLAN speed is 20 Mbps, a 40Mbps--xxMHz/xS interface rate could be causing that. That would be a very poor connection (-86dBm signal?)
There are other reasons for only getting 20Mbps on a much higher interface rate: other channel destructive interference, co-channel waiting, wifi channel busy, ....

Kentzo · Thu Jan 13, 2022 12:22 am

Wouldn't client devices push CCQ down as they enter low-power mode (phones, laptops etc)?

bpwl · Thu Jan 13, 2022 1:34 am

It's bizar. Some do show a weakenend signal, some don't. I have been monitoring some 50 BYOD smartphones and tablets for months at night. A minority (3-4) goes very deep every ten seconds, even generating annoying disconnects because they go below the access list set threshold. Others don't show any change in the registration, except that their "last activity" timer runs up to about 20 sec, then resets. That's even why I extended the "allow signal out of range" in the access list to 30 sec, to avoid disconnects. (viewtopic.php?t=179902#p888536)

It's BYOD, so I don't know exactly what device does what, but most are iPhones.

BeeKeeper · Thu Jan 13, 2022 11:35 am

Thank you very much for your answers. I hope it is OK to write one answer and not to answer each post separately. Please correct me if I am wrong.

@bpwl

The interface wlan1 is currently disabled but I changed regulatory domain to German.
I changed the channel already to 5240.

The behavior didn't change. Same performance value

@kentzo

Yes, I am using an iPhone and iPad pro. The CCQ value is 100%
[url]https://share-your-photo.com/ec2e0a22a7[|url]

@anav

The DHCP line gives an ip address and the route entry to my access point.
The trunk is untagged Vlan=1 and Tagged VALAN=10 , VLAN=20

So my question: Should I remove all this stuff from default VLAN and setup a new management VLAN ?

anav · Thu Jan 13, 2022 1:50 pm

You didnt answer my questions,
Which vlan subnet is the trusted one on our network.........

BeeKeeper · Thu Jan 13, 2022 2:28 pm

Answers to your questions:

(1)
see my last post please

(2)

Yes a route 0.0.0.0/0 is defined with gateway 192.168.1.254

(3)
Currently vlan=1

(4)
The access point gets his ip address and route via DHCP. Currently it is 192.168.1.102

(5)
The trunk consists of untagged vlan=1 and tagged vlan=10,vlan=20

So my question: Should I remove all this stuff ( ip addresses network infrastructure etc.) from default VLAN=1 and setup a new management VLAN=XX?

anav · Thu Jan 13, 2022 3:08 pm

vlan1 is a default vlan that should not be used to carry data IMHO.
So modify the subnet you think is described by vlan 1 and assign it to vlan50 for example not vlanid=1.

As for the wapac, just reviewing the config,
I do not not see the identification of the vlans which includes indicating their parent interface aka the bridge......

we should have seen five vlans identified
vlan1
vlan10
vlan20
vlan111
vlan60

BeeKeeper · Thu Jan 13, 2022 3:29 pm

Well than I have to change my central router and the switches to a new vlan=50.
I am a little bit afraid to "kill" the router. Please let me have a look first.

All five VLAN are defined at the router:
vlan1
vlan10
vlan20
vlan111
vlan60

All of them are working and managed through DHCP.

The wapAC is setup for testing with only 3 VLAN. Vlan1,Vlan10 and VLAN 20

My setup:

1) define separate WLAN ( xGAST and xHypnose) with no VLAN
2) Create Bridge
3) Add ether1 PVID=1 (Trunk)
4) Add xGast with PVID=10
5) Add xHypnose with PVID=20
6) setup bridge vlan
7) enable vlan-filtering

So no explicitly defined VLAN Interfaces, PVID and Bridge should do the work

Maybe this is not correct or processing is too slow ?

anav · Thu Jan 13, 2022 4:24 pm

I didnt say you had to create the full vlans on the wapac, as you noted that is already done!
but you have not even identified them on the wapac.....

So you need to state
vlanxx with interface bridge.
vlanyy with interface bridge
etc.

do that first then will have a look at the rest............

BeeKeeper · Fri Jan 14, 2022 12:49 pm

Meanwhile I followed the hint of @bpwl to check my channel parameters.
I changed channel width to 20/40/80MHz XXX. ( Not seen below, because export file was done before )

!! WLAN performance much better !! Full speed to ISP 100 MBit/s up and 50 MBit down from macbook pro / iPad pro and iPhone.

I hope I understood your request regarding vlans. I put my configuration away and changed configuration to:

# jan/14/2022 09:38:02 by RouterOS 6.48.4
# software id = JTTL-RK5C
#
# model = RBwAPG-5HacD2HnD
# serial number = E4640DCE3E09
/interface bridge
add igmp-snooping=yes igmp-version=3 name=vlan-bridge protocol-mode=none vlan-filtering=yes
#
/interface vlan
add interface=vlan-bridge name=vlan001-kabel vlan-id=1
add interface=vlan-bridge name=vlan010-Kabel vlan-id=10
add interface=vlan-bridge name=vlan020-Kabel vlan-id=20
#
/interface wireless
set [ find default-name=wlan1 ] country=germany ssid=MikroTik
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk eap-methods="" \
    mode=dynamic-keys supplicant-identity=MikroTik
add authentication-types=wpa-psk,wpa2-psk eap-methods="" \
    management-protection=allowed mode=dynamic-keys name=secDefault \
    supplicant-identity="" 
/interface wireless
set [ find default-name=wlan2 ] country=germany disabled=no frequency=5240 \
    mode=ap-bridge name=wlanxGast security-profile=secDefault ssid=xGast
add disabled=no keepalive-frames=disabled mac-address=0A:55:31:D8:35:F9 \
    master-interface=wlanxGast multicast-buffering=disabled name=wlanxHypnose \
    security-profile=secDefault ssid=xHypnose wds-cost-range=0 \
    wds-default-cost=0 wps-mode=disabled
/interface bridge port
add bridge=vlan-bridge interface=ether1
add bridge=vlan-bridge frame-types=admit-only-vlan-tagged interface=vlan001-kabel \
    multicast-router=disabled
add bridge=vlan-bridge frame-types=admit-only-vlan-tagged interface=vlan010-Kabel \
    multicast-router=disabled pvid=10
add bridge=vlan-bridge frame-types=admit-only-vlan-tagged interface=wlanxGast \
    multicast-router=disabled pvid=10
add bridge=vlan-bridge frame-types=admit-only-vlan-tagged interface=vlan020-Kabel \
    multicast-router=disabled pvid=20
add bridge=vlan-bridge frame-types=admit-only-vlan-tagged interface=wlanxHypnose \
    multicast-router=disabled pvid=20
/interface bridge vlan
add bridge=vlan-bridge tagged=vlan-bridge,vlan001-kabel untagged=ether1 vlan-ids=1
add bridge=vlan-bridge tagged=vlan-bridge,vlan010-Kabel,wlanxGast,ether1 \
    vlan-ids=10
add bridge=vlan-bridge tagged=vlan-bridge,vlan020-Kabel,wlanxHypnose,ether1 \
    vlan-ids=20
/ip dhcp-client
add disabled=no interface=vlan-bridge
/ip dns
set allow-remote-requests=yes servers=192.168.1.254
/system clock
set time-zone-name=Europe/Berlin
/system identity
set name=wapac01

BeeKeeper · Fri Jan 14, 2022 1:08 pm

Sorry configuration file above was not correct.

# jan/14/2022 09:45:02 by RouterOS 6.48.4
# software id = JTTL-RK5C
#
# model = RBwAPG-5HacD2HnD
# serial number = E4640DCE3E09
/interface bridge
add igmp-snooping=yes igmp-version=3 name=vlan-bridge protocol-mode=none vlan-filtering=yes
#
/interface vlan
add interface=vlan-bridge name=vlan001-kabel vlan-id=1
add interface=vlan-bridge name=vlan010-Kabel vlan-id=10
add interface=vlan-bridge name=vlan020-Kabel vlan-id=20
#
/interface wireless
set [ find default-name=wlan1 ] country=germany ssid=MikroTik
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa-psk,wpa2-psk eap-methods="" \
    mode=dynamic-keys supplicant-identity=MikroTik
add authentication-types=wpa-psk,wpa2-psk eap-methods="" \
    management-protection=allowed mode=dynamic-keys name=secDefault \
    supplicant-identity="" 
/interface wireless

set [ find default-name=wlan2 ] band=5ghz-n/ac channel-width=20/40/80mhz-XXXX \
    country=germany disabled=no installation=indoor mode=ap-bridge name=\
    wlanxGast preamble-mode=long security-profile=secDefault ssid=\
    xGast station-roaming=enabled vlan-id=10 vlan-mode=use-tag

add disabled=no keepalive-frames=disabled mac-address=0A:55:31:D8:35:F9 \
    master-interface=wlanxGast multicast-buffering=disabled name=wlanxHypnose \
    security-profile=secDefault ssid=xHypnose vlan-id=20 vlan-mode=use-tag  \
    wds-cost-range=0 wds-default-cost=0 wps-mode=disabled
/interface bridge port
add bridge=vlan-bridge interface=ether1
add bridge=vlan-bridge frame-types=admit-only-vlan-tagged interface=vlan001-kabel \
    multicast-router=disabled
add bridge=vlan-bridge frame-types=admit-only-vlan-tagged interface=vlan010-Kabel \
    multicast-router=disabled pvid=10
add bridge=vlan-bridge frame-types=admit-only-vlan-tagged interface=wlanxGast \
    multicast-router=disabled pvid=10
add bridge=vlan-bridge frame-types=admit-only-vlan-tagged interface=vlan020-Kabel \
    multicast-router=disabled pvid=20
add bridge=vlan-bridge frame-types=admit-only-vlan-tagged interface=wlanxHypnose \
    multicast-router=disabled pvid=20
/interface bridge vlan
add bridge=vlan-bridge tagged=vlan-bridge,vlan001-kabel untagged=ether1 vlan-ids=1
add bridge=vlan-bridge tagged=vlan-bridge,vlan010-Kabel,wlanxGast,ether1 \
    vlan-ids=10
add bridge=vlan-bridge tagged=vlan-bridge,vlan020-Kabel,wlanxHypnose,ether1 \
    vlan-ids=20
/ip dhcp-client
add disabled=no interface=vlan-bridge
/ip dns
set allow-remote-requests=yes servers=192.168.1.254
/system clock
set time-zone-name=Europe/Berlin
/system identity
set name=wapac01

anav · Fri Jan 14, 2022 1:09 pm

Good, you identified the vlans on the wapac and the wifi item noted by bpwl, and it looks like you are up and running as desired.
Dont change something thats working!

wapAC works -- but with poor performance

wapAC works -- but with poor performance

Re: wapAC works -- but with poor performance

Re: wapAC works -- but with poor performance

Re: wapAC works -- but with poor performance

Re: wapAC works -- but with poor performance

Re: wapAC works -- but with poor performance

Re: wapAC works -- but with poor performance

Re: wapAC works -- but with poor performance

Re: wapAC works -- but with poor performance

Re: wapAC works -- but with poor performance

Re: wapAC works -- but with poor performance

Re: wapAC works -- but with poor performance

Re: wapAC works -- but with poor performance

Re: wapAC works -- but with poor performance

Who is online