MikroTik

neki

What do you expect that you will gain? There is no need to lower TX power at all... It sounds like you have APs too close (closer that needed) and now you chase ghosts. Note that there is tons of guides for ROS6 and wireless package that didn't support proper roaming.

neki

You can't go with VLANs just half the way. You must use them everywhere or don't use them... Don't worry, you can do it ;) You need VLAN interfaces for all VLANs on main device, then the DHCP server is bond to VLAN interface of each VLAN. Like this: /interface vlan add interface=bridge1 name=vlan10 ...

neki

It's not useless, just relevant only locally

neki

It is not possible. You are following wrong guides... You must look for guides for WiFi CAPsMAN, not Wireless CAPsMAN. WiFi CAPsMAN has only one mode: local forwarding, so guides that were suggesting manager forwarding mode (and bridge isolation) are not meant for you, they are for old Wireless CAPs...

neki

Why did you cut out wifi interfaces from the config?

neki

You don't need 4 frequencies for 3 APs ?

neki

Check that you have some meaningful identity set on all caps. /interface wifi provisioning add action=create-dynamic-enabled disabled=no master-configuration=cfg1 Change to: /interface wifi provisioning add action=create-enabled disabled=no name-format=%I-wifi master-configuration=cfg1 name-format w...

neki

Your attitude is really strange, you are asking for help and then sudently "know better". If you won't follow instructions or use them just partially then nobody will help you. Is that clear? Saying that the configs were not altered in any way is simply lie. Reset all CAPs to CAP MODE. Thi...

neki

RadioProvisioning CAPsMAN cannot manage it's own wifi interfaces using configuration.manager=capsman, it is enough to just set the same configuration profile on local interfaces manually as you would with provisioning rules, and the end result will be the same as if they were CAPs . That being said...

neki

Hi, looks like your second post today about provisioning and I have a feeling like there is some misunderstanding. Ofcourse, I can be wrong. Anyway, provisioning should be used ONCE. If you are provisioning already provisioned rules it's basically misconfiguration/bad behavior. Workflow of provision...

neki

So... Reset all CAPs to CAP MODE. This is NOT default config. It's almost default, but with removed datapath option and manually added bridge ports. It is for sure causing issues with slave interfaces. For starter edit ONLY identity of the device. For the CAPsMAN it looks like you have wireless pack...

neki

What packages do you have installed on wAPs and CRS?

neki

Hit: It's common for terminals that you must use CTRL+SHIFT+C instead of CTRL+C

Difference in create-enabled and create-dynamic-enabled is that create-enabled allows you to manually change settings of created interfaces. You can completely ignore that for now.

neki

Do you know that you can export to file? You don't need to type anything.... (ecxept of the export command) Use export file=anynameyouwish Then download created file and thats it. You can then open that .rsc file in notepad. I'm now really wondering about another important thing: How exactly are you...

neki

You use US as country, I must use Austria. If there are police officers running around with antennas hunting casual home owners with misconfigured wifi routers then you are right :) SSIDs were just meaningless proposal, you were talking about allowed and disallowed characters in it.... Anyway, you ...

neki

It seems that you are convinced that your observations are 100% correct, just watch out for tunnel vision..... /interface wifi channel add disabled=no frequency=2412,2437,2462 name=channel-2G width=20mhz add disabled=no frequency=5180,5220,5745,5785 name=channel-5G width=20/40mhz-Ce /interface wifi ...

neki

Do you have export from that time? Are you willing to try it again?

neki

A kind of filter "let all 5ghz devices get 5ghz config" doesn't work either.

Why? What is it doing then? ...this config is a mess and should be simplified

neki

Why do you have so many channels?
R403-AC is for air conditioner or AC as wifi5 standard?
Why do you have provisioning for each individual MAC?

neki

How many cAPs are we talking about?

neki

Yes, but you must use wifi-qcom-ac package, in case of CAPsMAN that also means that you must then use WiFi CAPsMAN instead of Wireless CAPsMAN.

neki

Looks like you are missing the parent-child hierarchy?

Dunno if you saw those:
https://www.youtube.com/watch?v=tnzxrt6bgbs
https://www.youtube.com/watch?v=FsAFDMeDFpQ

neki

Cracking WPA3 this way would be definitely cheaper then cracking WPA2 password conventional way...

neki

Just imagine that you are hacker and you want to hack your network, will you use WPA2 or WPA3 for that attack?

neki

Something I am going to try later today or tomorrow is to disable all but one AP to see if something changes in the behaviour. Because I don't know if there might be an issue with one single AP causing this. I can also physically move some of the devices around to see if anything changes is they co...

neki

I'm sorry about those configs, you are right... I was expecting slave interfaces, but they are not visible in export. Let's try to narrow it down, what is the process of trying? Are you running around the house and trying to connect to each CAP?

neki

There are no VLANs defined so... it can not work at all at this stage... VLANs (or the lack there off) isn't relevant here, once the packets get to the AP's interface, it's all just the untagged traffic as far as the AP is concerned and will flow through the network as untagged traffic. Otherwise, ...

neki

This doesn't make any sense but as you wish... WiFi CAPsMAN has only one mode: local forwarding. That means that each AP decides what to do with each packet it handles, so everything must be set up correctly on CAP. So, post config of your CAP And you don't need /interface wifi datapath add bridge=b...

neki

You don't need: /interface vlan add interface=main-bridge name=vlan10-LAN vlan-id=10 add interface=main-bridge name=vlan20-IoT vlan-id=20 add interface=main-bridge name=vlan30-Guest vlan-id=30 /interface bridge port add bridge=main-bridge interface=ether2 add bridge=main-bridge interface=ether3 add ...

neki

There are no VLANs defined so... it can not work at all at this stage.. Also, it looks like you have wireless package installed, you don't need that... First thing to do: Forget about wifi and CAPsMAN, put that a side completly.. Then.. Using RouterOS to VLAN your network , setup your VLANs as neede...

neki

Forum veteran with 800+ posts can not figure this out? How is that even possible? Anyway.. you have to decide if you want your router to handle DNS requests or if clients should connect directly to public DNS servers. If you want your router to be midleman, you have to enable allow-remote-requests i...

neki

If I can quote myself: What is the point of running WPA2 and WPA3 on same network at same time? It doesn't matter that there are some clients connected over WPA3 when there is WPA2 still available. Security of your network is always the lowest one = WPA2. Just adjust that to WPA and WPA2, idea is sa...

neki

This is just the WIFI config from each device. Provisioned the 5GHz AP properly, but was unable to add VLANs.

Post both, whole, configs.. It's not just about wifi, especially with VLANs.

neki

Just few hints... Wiki is/was for ROS 6 only, so it's obsolete for ROS 7 and especially for WiFi CAPsMAN. Old Wireless CAPsMAN had two modes, local forwarding and manager forwarding and you have to be careful when you are looking at configs on internet because most of the users took manager forwardi...

neki

This is all you have? Did you delete anything from the config?

neki

What is the point of running WPA2 and WPA3 on same network at same time? It doesn't matter that there are some clients connected over WPA3 when there is WPA2 still available. Security of your network is always the lowest one = WPA2. Now you know that your WPA3 is pointless so and you can disable man...

neki

Reason why it was working as described is slaves-datapath under interface wifi cap . By default slave interfaces inherit datapath from master interface, anyway setup script, for some reason, creates bridge, then datapath and then sets this datapath to slaves-datapath . So it overrides default behavi...

neki

rule #1 - never use VLAN 1 bridge is always local entity, CAPsMAN can NOT see/access bridges on CAPs and vice versa. So, datapath configuration profile shouldn't point to any bridge. That must be done on CAPs themselfs. It exists only on device where it was defined. ....and it's best to post raw out...

neki

Problem is, that it doesn't work as you imagine it... And be prepared, it's really deeeeeep rabit hole... https://forum.mikrotik.com/viewtopic.php?p=1065086&hilit=gain#p1065086 https://forum.mikrotik.com/viewtopic.php?p=1062765&hilit=gain#p1062765 After that you can start to search for more ...

neki

Please.. Do not overthink that.. Simply set it to no, join another CAP and then enable it again..

neki

Don't you have require-peer-certificate set to yes? (on CAPsMAN)

/interface wifi capsman
set ca-certificate=auto enabled=yes interfaces=vlan-33-mgmt package-path="" \
    require-peer-certificate=no upgrade-policy=none

neki

That's probably vendor specific, mine doesn't show that...

neki

Maybe QR code reader app? Thing is, the QR code is just text.

Wifi QR code consists of:

WIFI:S:<SSID>;T:<WEP|WPA|nopass>;P:<PASSWORD>;H:<true|false|blank>;;

You just need an application that will read the QR code.

neki

That's so wrong and the config looks like total mess. You came here because you wanted more transmit power, then we explained to you that there are some country regulations and after that you changed country to get more power and after that you started to limit the power by yourself? Does it make an...

neki

TX power is just one part of the equation, you have to add antenna gain and then there are country regulations... So, if your country regulation dictates max 20 dbi transmit power you have to deduct antenna gain (in case of cAP ax 6 dbi), so you have 20 - 6 = 14. And thats exactly what you have. cre...

neki

I'm some how missing the other CAP in that picture?

neki

That's not really "alternate" solution, you should use both settings. And also set frame-types allowed on the port... /interface bridge port add bridge=bridge1 frame-types=admit-only-vlan-tagged interface=ether1 add bridge=bridge1 frame-types=admit-only-untagged-and-priority-tagged \ inter...

neki

You are missing bridge configuration for wifi interfaces. CAPsMAN /interface wifi set [ find default-name=wifi1 ] configuration.mode=ap datapath.bridge=bridge set [ find default-name=wifi2 ] configuration.mode=ap datapath.bridge=bridge CAP /interface wifi set [ find default-name=wifi1 ] configuratio...

neki

That's actualy the best reason, the roaming...

For a client device to successfully roam between 2 APs, the APs need to be managed by the same instance of RouterOS. For information on how to centrally manage multiple APs, see CAPsMAN

neki

7.17beta2

*) wifi - re-word the "SA Query timeout" log message to "not responding";

neki

You don't need to do that for steering group. You should just apply created configuration profile to local interface and thats it. Local interfaces will be in same steering group as the virtual one created by CAPsMAN.

neki

And what is the benefit?

neki

You didn't post any results of suggested changes... so... we are also waiting...

neki

Would Packet Sniffer help in diagnosing the problem?

Can you then analyse captured packets?

Post your full config, let's check what settings you have.

neki

CAPsMAN can NOT manage local interfaces. (if you have RB4011 with wifi) CAPsMAN cannot manage it's own wifi interfaces using configuration.manager=capsman, it is enough to just set the same configuration profile on local interfaces manually as you would with provisioning rules, and the end result wi...

neki

Nope, it's absolutely fine.. maybe even perfect..

neki

This is weird, as it was already mentioned here, SA Query is part of 802.11w (protected management frames), so this shouldn't be even possible with management-protection=disabled . I also had this issue, but it was caused by misconfiguration on my side. Anyway, I also encountered another bug when my...

neki

Running the Sonos App on my GrapheneOS mobile emulating Android

What about genuine android device?

neki

cAP ax 7.14.3 - free from this bug 7.15.x - BUG present Whats about 7.16? Nothing. Until yesterday I had firmware 7.14.3 installed on AX3 - everything worked without a single problem. Yesterday I installed 7.16 - again there were constant disconnections, SA and a new problem: AX3 unavailability for...

neki

CAPsMAN /interface bridge add admin-mac=00:23:24:D1:4C:DF auto-mac=no fast-forward=no name=bridge1 \ port-cost-mode=short vlan-filtering=yes /interface ethernet set [ find default-name=ether1 ] disable-running-check=no /interface vlan add interface=bridge1 name=vlan10 vlan-id=10 add interface=bridg...

neki

Looks like you configured steering profiles, but they are not linked to configuration profiles.. also do not use access-list for signal checking, it's thing of past. And try to define FT domain in security profiles, different number (hex) for each one. Anyway it's really a lot of SSIDs... We have ab...

neki

Full configs please... This is insufficient... Anyway, you shouldn't set CAPsMAN on CAPs, that should be done on managing device only.

neki

Let's see your configs...

neki

Did you try to disable all firewall rules? And why do you have so many bridges on your devices?

neki

Do you mean ip address?

/ip address
add address=192.168.10.1/24 interface=vlan10 network=192.168.10.0
add address=192.168.20.1/24 interface=vlan20 network=192.168.20.0
add address=192.168.30.1/24 interface=vlan30 network=192.168.30.0

neki

What about hAP ax lite?

neki

Did you try to disable firewall? Your firewall rules are complete mess...

...and you posted your wireguard keys

neki

You don't need wifi package on CRS, it doesn't have wifi. CAPsMAN is part of base RouterOS package since 7.13. You must use bridge on CAPs, and you may use VLAN on CAPsMAN. Post your configs, both sides... /export file=SomeName Remove serial numbers, passwords (there shouldn't be any), etc. (make 3 ...

neki

https://www.krackattacks.com/#faq

neki

is-responder: Specifies if peer is intended to be connection initiator or only responder. Should be used on WireGuard devices that are used as " servers " for other devices as clients to connect to. Otherwise router will all repeatedly try to connect "endpoint-address" or "c...

neki

WiFi -> Remote CAP -> CAPsMAN

neki

Basically those two are incompatible. Unfortunately hAP ac has MIPSBE processor so you can not install newer wifi package. WiFi CAPsMAN WiFi CAPsMAN can only control WiFi interfaces, and WiFi CAPs can join only WiFi CAPsMAN, similarly, regular CAPsMAN only supports non-WiFi caps. You have Wireless C...

neki

WifiWave2 CAPsMAN

WifiWave2 CAPsMAN can only control WifiWave2 interfaces, and WifiWave2 CAPs can join only WifiWave2 CAPsMAN, similarly, regular CAPsMAN only supports non-WifiWave2 caps.

neki

It's still basicaly wrong.. On the router, make backup and config export, save both to computer and uninstall wireless package. Then reset configuration with "no default configuration" option. Then apply this: *admin account has no password with "no defaults" **you have to set wi...

neki

And RB4011 is with or without wifi?

neki

Just to by sure, are you using wifi-qcom-ac on AC caps?

neki

One bridge per device...

Did you add MGMT to LAN interface list? If not, you are probably blocked by firewall...

add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN

neki

I run network with AX cAPs and vlan filtering works flawlessly, but yes, you have to adjust settings of the CAPs...

Anyway, what would you suggest?

neki

You will not lose anything... So don't worry about it... By default traffic is forwarded between VLANs and you have to deny it if you want with firewall rules...

neki

So you are not using VLANs at all, you just created VLAN interface and that's it. For VLANs to work properly, you need to use them for all traffic or not use them. For the naming, don't be too "creative". Right now, you have 3 different things named same, just because you "couldn't&qu...

neki

Can you share your configs? Both sides...

neki

It really is... 8) The wifi interface on a CAP needs to know where to send/receive data. Hence, you need to assign bridge to it. That bridge must exists on the CAP because the physical interface is there too. Let's say that we have 8 CAPs. You can share other settings between those CAPs, but each CA...

neki

Nope

...but it's logical

neki

If you use it for CAPsMAN, then yes... Configuration profile has no means to know where you will later use it.

neki

Forget about the CAPsMAN and wifi for now... Are you sure that your VLANs really work? Because you don't have vlan-filtering enabled on the bridge and there are no access or trunk ports.. You should remove all settings that related to old Wireless CAPsMAN and focus on VLANs. Bridge VLAN Table It cou...

neki

Set it where and which bridge?

If you want to set on CAPsMAN datapath.bridge=bridgeCreatedOnCAP, then it's misconfiguration because only valid options are bridges created on CAPsMAN and vice versa...

neki

And just to correct myself, you must set two things when prepairing CAP for CAPsMAN environment: manager and bridge . Mode defaults to AP, so it can be omitted. If we look at "Reset to CAPS mode" :local brName "bridgeLocal"; :if ($usingWifiPack) do={ :local addDatapath [:parse &q...

neki

They do work

dynamicCap2.png

Note that this is interface on CAPsMAN side... It's same as if you want to change frequency, it's done on CAPsMAN...

Interface was dynamically added to the list (I'm not using this, just test for you..)

dynamicCap3.png

neki

Nope, datapath has effect in CAPsMAN setup. You can use it for VLAN assignment. Just the datapath.bridge is local setting. CAPsMAN device has no means to know what bridge/s exists on CAPs. If you are setting CAP in CAPsMAN environment you must set 3 things on the CAP itself: manager , mode and bridg...

neki

Do not forget about steering... There are three standards that could be used to support roaming: 802.11r/k/v

neki

I'm not sure if I follow you correctly, but they are added just fine... Thing is, that the bridge is always local, you can not access/see bridges on other devices. So if you create a bridge on CAP, it is accesible only from CAP itself, and vice versa. That applies for datapath too, datapath.bridge i...

neki

What device is used for DHCP? Are you aware that you are not tagging or untagging any ports on CAPsMAN device? Are you aware that you are not using VLAN filtering on the bridge? Are you sure that you want to use DHCP client directly on the bridge and not on some VLAN? Do you need to use both, Wirele...

neki

Basically it's not compatible.. There isn't CAPsMAN v6 and v7. Two different versions are Wireless CAPsMAN and WiFi CAPsMAN . WiFi CAPsMAN is for newer devices, mainly 802.11 ax and also for 802.11 ac . Anything older has to use Wireless CAPsMAN. But it can run on ROSv7, you just have to install wir...

neki

That's too far.. What about VLANs?

neki

How many CAPs are we talking about?

neki

What about storage space?

neki

is there any existing CA cert?

neki

Do you see them in neighbor tab? Each other?

Did you try to set up exact IP of CAPsMAN on CAP? ...and not use discovery

neki

...its in your conifg? vlan interface named LAN ?

/interface vlan
add interface=br0 name=LAN vlan-id=1

neki

Order of entries in firewall is crucial. It starts at top and goes down... For the input add action=accept chain=input comment="Allow Estab & Related" connection-state=established,related add action=drop chain=input comment="drop invalid" connection-state=invalid add action=d...

neki

/interface wifi capsman
set ca-certificate=auto certificate=auto enabled=yes interfaces=br0

Did you try to use VLAN interface?

neki

The CRS and cAP's are all reachable in the same IP subnet. Reachable how? ...another thing is, that you have VLANs configured on CRS, but there are no VLANs on CAP? Counldn't that be the issue? I really doubt that you could get "no connection to CAPsMAN" with config you posted, because th...

neki

do you see wifi interfaces on CAP itself?

neki

Looks like you are missing wifi interface setup on the CAP set [ find default-name=wifi1 ] configuration.manager=capsman .mode=ap \ datapath.bridge=bridgeLocal disabled=no set [ find default-name=wifi2 ] configuration.manager=capsman .mode=ap \ datapath.bridge=bridgeLocal disabled=no Also this is we...

neki

I don't know man, your info is in very weird order.. Anyway, aren't you looking for "slaves-static" ?

neki

Post your configs, both sides...

/export file=FILENAME

remove license and serial number

neki

You have to chose if you want to use VLANs or not, if you want them, you have to use them all the way... datapath.bridge must be set on CAP not CAPsMAN. CAPsMAN /interface wifi datapath add bridge=vlan-bridge1 disabled=no name=vlan-datapath missing VLAN ID /interface wifi datapath add bridge=vlan-br...

neki

Post your configs... Both sides...

neki

Instead of create-dynamic-enabled, in provisioning, you can use create-enabled and you will be then able to select frequency manually (on CAPsMAN).

neki

AX devices can assign VLANs dynamically via datapath from CAPsMAN, so you don't have to worry about the names...

neki

Bridge has to be defined on CAPs, not in CAPsMAN configuration profile, same applies to mode. Also VLAN filtering is incomplete. But hard to tell when you cut just part of the config. CAPsMAN /interface wifi datapath add bridge=bridge client-isolation=yes disabled=no name=wlan_datapath vlan-id=\ 27 ...

neki

Why do you need that? AX devices are backward compatible with older standards..

And yes, it's possible and working fine with AX devices..

neki

It doesn't work for wifi-qcom-ac, not your case... Wiki is for ROSv6, also not your case... Post your configs..

neki

You plan to have 12 SSIDs?

neki

Yep, that's the one...

neki

What is the output of:

/interface/wifi/radio/reg-info country="Switzerland"  number=0

neki

It is allowed by default, so you had to disallow that.. look at you firewall rules..

If you can post your config we can check that..

export file=FILENAME

neki

You are following RouterOS v6 wiki page, but you are using RouterOS v7

https://help.mikrotik.com/docs/display/ ... +switching

neki

Additionally, CAPsMAN can not control local interface..

+ you shouldn't pass VLAN in datapath to AC devices, that means, you have to have two provisioning rules or set the VLAN everywhere manually.

...basically, all your observations are correct

neki

In the wiki page: https://wiki.mikrotik.com/wiki/Manual:CAPsMAN It says the there is an option that can be put in the configuration profile: datapath.client-to-client-forwarding (yes | no; Default: no) I have never seen this option available. Doing torch and pcaps, it appears my CAPs are locally fo...

neki

Wouldn't be better to get newer cAP AX then older cAP AC?

neki

If you followed this guide, you are probably missing VLAN definition in datapath on CAPsMAN.

VLAN should be set in datapath on CAPsMAN.
Bridge, in datapath, must be set on each CAP locally.

neki

You have to reset with "No default configuration", then you will have clear config without bridge and any other default configuration. But as you can see, guys here are suggesting otherwise.. Anyway I still believe that without bridge you have no switching....

neki

isn't the bridge responsible for the switching? so if you don't have bridge you have no switching? ...reseting seems faster then deleting everything individually

neki

This should be quiet easy.. Reset to blank config (no routing, no switching) Do NOT create bridge Asign desired IPs to ports Create interface list "NTP-only" (...or something) Create input firewall rule to allow incoming traffic from created list on port 123 and drop everything else Ofc, t...

neki

What RouterOS version are you using? It looks like you have ROS v6, but with those new devices it would be better to use ROS v7.

neki

I did try it before posting..

Anyway you choose to ignore the advice (not from me, but from ROS itself) and you are now curious why it's not working.. I have no idea why not to try it...

At the end, my cake is working fine...

neki

The red text reporting you misconfiguration doesn't strike you? Also the values are wrong, use just M or k

# CAKE type with bandwidth setting detected, configure traffic limits within queue itself

sq01.png

Mbps is not valid

neki

On the created static interface in CAPsMAN..

Anyway, back to my first question.... is it always same AP?

What version of ROS do you use? Did you upgraded firmware of those units or just ROS?

neki

Are you sure about that?

cm02.png

cm03.png

...that's why you have create-enabled instead of create-dynamic-enabled... and OP is using create-enabled....

neki

Is it always same AP?

Why do you have 4 configurations and 4 provisioning rules?

neki

So...in other words, I can't create a mesh network like I tried?

What about going back to my first reply?

neki

You can also look at cAP ax, if you don't need ethernet ports.. And for CAPsMAN, you don't need anything powerful to run CAPsMAN, it just tells to connected APs "hey use this config"..

neki

Try to remove frame-types=admit-only-vlan-tagged from the bridge.

neki

You should be able to set it up. Basically you need to set same SSID and password (same auth type, WPA2) for both networks and each network should use different channel. You also need to use same DHCP server for both networks. So, cAP should be only AP without routing and DHCP. That's all what you n...

neki

I saw it here....

mfc1.png

neki

Try to remove radio-mac

/interface wifi provisioning
add action=create-enabled disabled=no master-configuration=R403-Wifi6 radio-mac=00:00:00:00:00:00

radio-mac (MAC address) MAC address of radio to be matched. No default value.

neki

Because it's top secret or because you don't know?

neki

May I ask you, why do you use same channel on both devices?

neki

Now I see... we need whole config... not just wifi (/interface/wifi/export)

Use (both devices)

export file=filename

neki

Can you have multiple VLANs for one SSID? (...basic setup, no RADIUS)

One divice (AP) can have multiple radios (2Ghz, 5Ghz)... FT works between different radios...

neki

This is all? Or did you reducted everything apart of serial number?

...sympthoms seems like misconfigured bridge, so you have to post whole config, or if this is it you have to configure the bridge (and please don't name it bridgeLocal)

neki

Is fast roaming (ft=yes) supposed to work between 2.4 and 5GHz with different SSIDs and different vlans ?

No, it is supposed to work with different radios with same SSID. It is part of security for each SSID like password.

neki

We need to see both ends... CAP configs too, at least one AC and one AX...

neki

https://help.mikrotik.com/docs/display/ ... iFiCAPsMAN

WiFi CAPsMAN can only control WiFi interfaces, and WiFi CAPs can join only WiFi CAPsMAN, similarly, regular CAPsMAN only supports non-WiFi caps.

The CAPs don't send traffic usage information to CAPsMAN.

neki

You should install wifi-qcom package, not wireless..

neki

You should install wifi-qcom package, not wireless..

neki

You are looking for 802.11r/k/v, for that you need to set up fast transition and steering . Properties related to 802.11r fast BSS transition only apply to interfaces in AP mode. WiFi interfaces in station mode do not support 802.11r. For a client device to successfully roam between 2 APs, the APs n...

neki

You should probably update to latest version of RouterOS on both devices. Your cap is running 7.15 and capsman 7.12.
(it probably will not solve your issue)

neki

I was not able to find anything like that about dynamic interface creation but the VLAN datapath is commonly known limitation. Lost features The following notable features are lost when running 802.11ac products with drivers that are compatible with the 'wifi' management interface Nstreme and Nv2 wi...

neki

Superb, anyway at the end, it is up to the client device to decide where it will connect to and that's usually not in your power. You can just properly configure your network...

neki

Can you post your config? Do you have steering configured? I believe that key is using all three 802.11r/k/v. When sending neighbor reports and BSS transition management requests, an AP will list all other APs within its neighbor group as potential roaming candidates. By default, a dynamic neighbor ...

neki

So, I got to your configs and your main issue now, are misconfigured VLANs. You have to have working network before you start playing with CAPsMAN. VLAN interface should be defined only for main/management network where you need IP for the device itself (for cAP) Bridge ports must have frame-types s...

neki

I have few suggestions... Don't use VLAN1, use 10,20,30 instead (or whatever numbers, but not 1) As you demonstrated in the video, CAPsMAN is capable of creating interfaces, so unprovision everything and delete those manually created from the CAPs, lets see what will happen. Also, in provisioning ta...

neki

https://forum.mikrotik.com/viewtopic.php?p=988941#p988941 When a device is running WifiWave2 CAPsMAN, it cannot set its own wireless interfaces as CAPs. This is a known limitation, due to how the driver works, there is a "hidden" (system level) provision rule for local interfaces, which m...

neki

Shouldn't you use "create enabled" instead of "create dynamic enabled" if you want to change anything?

neki

looks like devil is hiding in detail, as always

neki

What's new in 7.14.3 (2024-Apr-17 15:47):
*) wifi-qcom - added configuration.distance setting to enable operation over multi-kilometer distances (CLI only);

neki

Yes, you can... With ARM based devices you don't even need both WiFi/Wireless packages on your CAPsMAN. But you need to upgrade your cAP AC to new driver.. And beside that you can run both WiFi and Wireless CAPsMANs on same devices... What was once called CAPSMAN and is now named WiFi CAPsMAN is CAP...

neki

Thing is, that you should never use multiple bridge interfaces to separate traffic... and because it's not working as you imagine it should, you think that it's broken...

Sorry but your procedure is wrong...

neki

I was hoping I could use it for terminal access, i.e. using PuTTY or the like.

L009 has dedicated console port..

neki

Try to change country to United States and pick 5745, not range, just one...

neki

Thats correct, WiFi CAPsMAN does not implement forwarding... It was decreasing throughput anyway... Nothing you want to use...

neki

What version of RouterOS do you use?

Can you try:

/interface/wifi/radio/reg-info country="Spain"

Why do you use channel.reselect-interval=1h? If you want something to be stable, shouldn't that be stable and not variable?

neki

The IP - DNS options apply to device itself, if you want to specify them yourself untick the Use Peer DNS , then you need to tell client devices what servers should they use and thats in IP - DHPC , if you want your router to resolve DNS requests then it will be IP of your router.. and ofc you have ...

neki

yes and yes

neki

What are you trying to achive? This doesn't make much sence...

Anyway, nothing in your first post implies that you want or need "station-bridge".. And why do you have multiple bridges?

neki

For a client device to successfully roam between 2 APs, the APs need to be managed by the same instance of RouterOS. For information on how to centrally manage multiple APs, see CAPsMAN You can configure both devices separately but you will be without 802.11r/k/v Another thing is, that if you have ...

neki

Hello

When i change my CAP from local forwarding to capsman forwarding why there different performance?
When using local forwarding the throughput can more than 150Mbps but drop to around 80Mbps when switch to capsman forwarding,

It's obsolete function, so question is, why do you want to use it?

neki

It is possible... anyway, are we talking about wired or wireless mesh?

neki

Thing is, that with VLAN filtering off all VLAN related settings are ignored... So if you fcked up and you have all ports in the bridge you will lock yourself out. :D I don't know how committed you are, but I would save the config now, as "partialy working" and start over.. Update the OS t...

neki

10.0.0.133 is some stand alone server? PiHole?

neki

what does the DNS tab say? IP - DNS, are there any dynamic servers? Suppose that you didn't fill static one... and what about the allow remote requests?

neki

that is the message at my mobile "without internet connected" very strange. My laptop works fine in all SSids. What could be the difference in connection ? CAPsMAN can't manage local wireless interfaces, only remote CAPs. Datapath will work when you connect your remote CAP but on local in...

neki

CAPsMAN can't manage local wireless interfaces, only remote CAPs. Datapath will work when you connect your remote CAP but on local interface it will not work like that. I tested today just to check. You will have to check again... 8) ldp.png Point is, that in datapath profile, you set up the VLAN a...

neki

what does it mean that you dont have internet? what if you try ping 1.1.1.1 or 8.8.8.8? ....if that works, its DNS

probably not allowed request forwarding or how its called...

edit:
allow-remote-requests

neki

@gigabyte091 hmm in #12 you told me that I have to setup datapath .. :? and .. Then untag desired wifi interface to desired VLAN. where can I do that ? you should use datapath, if you will use AX devices there is no problem in doing that, and it will handle the VLANs in the bidge automatically.. I ...

neki

Basicaly, you want end devices untagged and network devices tagged. Another thing is, that you don't have frame-types set on bridge ports. Turn off VLAN filtering on the bridge first, or you can cut yourself off and also remove/disable one of the port from bridge, so you can connect back over MAC if...

neki

Do you have VLANs defined on the bridge?

neki

wifi1 and wifi2 are native interfaces of your radios, wifi1 is for 5Ghz and wifi2 is for 2,4Ghz. You have to add slave interfaces. Simply click on the plus sign and then select master . You will probably want both 5G and 2G for private and guest networks and 2G for IoT, that means that you will crea...

neki

I would definetly return the AC and bought the AX one. If you have some free return policy and can afford the AX go for it. Not because of the configuration complications but because of newer technology, there is huge difference between 802.11 ax and 802.11 ac . I will try to help you with the confi...

neki

First of all, are you planning to use older AC devices or newer AX? It seems like you have only AX devices but you follow AC guide, but it should work anyway...

neki

What is the point of that? If you want different config on each device you don't need to use CAPsMAN?

neki

You can also add IP address to ether1, that way you will be able to access the modem... Suppose it has it's default address 192.168.1.1

/ip address
add address=192.168.1.2/24 interface=ether1 network=192.168.1.0

neki

You can try this tutorial for PCQ: PCQ Queue Type on MikroTik RouterOS v7 or look for CAKE (Queue types)

neki

What happens when you set require-peer-certificate to no?

neki

You have to provide more info, but basically yes, it should be possible... Are we talking about wireless connection between those two APs? hAP is main?

neki

You have to sacrifice one of the radios on cAP ax to create link between both devices, this can not be done via CAPsMAN, you have to do it manually and then you can control the second, remaining, radio by CAPsMAN

neki

Seems like lack of imagination... What if you want your client devices to use different server then the router itself? And why to use a router to resolve DNS requests on behalf of clients?

neki

Ok, I think that I found it :D On CAPsMAN remove manager=capsman from /interface wifi configuration This is working for me.. CAPsMAN: # 2024-03-28 15:45:29 by RouterOS 7.14.1 # model = RB5009UG+S+ /interface bridge add admin-mac=78:9A:18:C3:18:7F auto-mac=no name=bridge1 vlan-filtering=yes /interfac...

neki

I have exactly same issue, cap reports "managed by capsman" and capsman reports "no connection to capsman". I feel like this will be something really stupid... I have my config bloated by try and fail method, so I will start over, let's see if we will manage...

neki

Did you check the transmit power of the radios while you were testing those APs?

neki

Little bit off topic, but you may want to check Mikrotik Router integration...

neki

Try to change this: /ip firewall nat add action=masquerade chain=srcnat out-interface="Bell PPPoE" src-address=192.168.1.0/24 add action=masquerade chain=srcnat out-interface="Bell PPPoE" src-address=192.168.2.0/24 add action=masquerade chain=srcnat out-interface="Bell PPPoE...

neki

Thank you guys. I was scared to do it by myself, anyway it turned out that it's not that hard. If anybody wonders how to do it by MQTT (JSON), it can be as easy as this: :if ($msgData~"\\{\"guest_wifi\":\"disable\"\\}") do={/interface set wifi4 disable=yes} :if ($msgDat...

neki

So, if I get that right... If I'm stuck with 25/5 VDSL line and saturation of that link is common, everyday, issue then it actually make sense to use CAKE? I tend to play games, so I prefer lower latency and I'm constatly "fighting" over the line with teenage daughter... :lol: This seems t...

neki

Yes, ether2 is connected to modem and not part of the bridge. PPPoE can not be added on slave interface.

ether5 is not used and not part of the bridge, it's meant as "disaster recovery" port

ether4 is not used and it is part of the bridge

neki

pppoe is fine, that's what I need, ether2 itself is used only for modem interface. Your setup is working fine for internet traffic, but now the LAN traffic is limited by download queue (bridge1). That's probably why I ended up with magle rules. BTW, is it possible to put another queue over that to p...

neki

Okay! Its about bufferbloat. For me I would have to weigh any advantage of bufferebloat over the loss in throughput due to losing fastrack ??? That's what I'm thinking about, I have slow link 25/5 and fast CPU (hAP ax3) so It's better for me to use queues? Because I don't have any throughput anyway...

neki

I won't comment on your config from a general perspective as there may be other things to organize/cleanup Please do! Any suggestions are welcome... I understand where is the issue, but couldn't find way around it, maybe little bit of tunnel vision, because I was focused on OUT interfaces but you c...

Search found 216 matches