• ccr2116 as a capsman and two hap ax2 and one ax3 as CAPs.
• Two wifi networks: "trusted" (vlan-id 10) and "untrusted" (vlan-id 30)

/interface wifi datapath
add bridge=bridge bridge-horizon=10 client-isolation=yes name=untrusted-datapath vlan-id=30
add bridge=bridge name=trusted-datapath vlan-id=10

• 5 D wifi1 bridgeLocal 10 0x80 none
• 6 D wifi11 bridgeLocal 30 0x80 none

Do these interfaces get added as access ports or trunk ports to bridge? Check it using /interface/bridge/vlan/print .

If they are added as untagged, then it VLAN settings are ihnored and you'll have to set

Code: Select all

vlan-filtering

=yes on bridge on all cAP devices. (Do enable safe mode before enabling vlan-filtering on bridge, you could loose management access if bridge config is not "ready" for vlan-filtering).

If they are added as tagged, then traffic separation based on VLAN IDs works without bridge being aware of it, wifi interfaces make sure of it (bridge is in this case operating as a dumb switch, passing frames between ports only according to dst MAC addresses ... which means that occasionally a frame with wrong VID will be delivered to wifi interface, but wifi interface will drop it as unusable according to its own config).

/interface/bridge/vlan