Beginner CAPsMAN questions

ConiKost · Thu Dec 05, 2024 11:47 am

I am using an RB5009 with ROS 7.17rc2 and would like to add multiple wAP ax in future. Do I see it correctly, what I don't need to add any wireless package, as CAPSmAN is now integrated? I do have

/interface/wifi

which seems to provide the CAPsMAN functionality? My setup is very simple. I have a single bridge _without_ any VLANs.

I currently did prepared this configuration. Is this enough for CAPsMAN on RB5009 side? I want so have 2.4 GHz and 5 GHz on the same SSID. Can I start without certificates? I so plan to use my own CA anyway. The current used certificates are generated by ROS.

/interface wifi channel
add band=2ghz-ax comment="BSC (2.4 GHz)" disabled=no frequency=2412,2437,2462 name=BSC24G width=20/40/80mhz
add band=5ghz-ax comment="BSC (5 GHz)" disabled=no frequency=5180,5260,5500,5580,5660,5745 name=BSC50G width=20/40/80/160mhz

/interface wifi datapath
add bridge=bridge comment="BSC" disabled=no name=BSCDP

/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk comment="BSC" disabled=no ft=yes ft-over-ds=yes name=BSC-PSK passphrase=xxx

/interface wifi configuration
add channel=BSC24G channel.frequency=2412,2437,2462 comment="BSC (2.4 GHz)" country=Germany datapath=BSCDP disabled=no mode=ap name=BSG24G security=BSC-PSK ssid="BSC"
add channel=BSC50G channel.frequency=5180,5260,5500,5580,5660,5745 comment="BSC (5 GHz)" country=Germany datapath=BSCDP disabled=no manager=capsman mode=ap name=BSC50G security=BSC-PSK ssid="BSC"

/interface wifi capsman
set ca-certificate=WiFi-CAPsMAN-CA certificate=WiFi-CAPsMAN enabled=yes interfaces=bridge package-path="" require-peer-certificate=no upgrade-policy=none

/interface wifi provisioning
add action=create-dynamic-enabled comment="BSC (2.4 GHz)" disabled=no master-configuration=BSG24G supported-bands=2ghz-ax
add action=create-dynamic-enabled comment="BSC (5 GHz)" common-name-regexp="" disabled=no master-configuration=BSC50G supported-bands=5ghz-ax

Thu Dec 05, 2024 12:11 pm

You don't need anything else on RB5009 except for base ROS package, capsman is available and can be used.

High level it looks ok with some remarks:

You allow channels on 5Ghz which may result in overlaps/interference if you use 160MHz on your APs (e.g. 5180 and 5260, 5500 and 5580).
You also let the AP choose which frequency to use (from a limited list). I prefer to choose myself which AP has to use which frequency (through provisioning rules based on radio MAC). But that's my view.

Since you use datapath, I am going to assume you plan on using VLAN later on ? Be careful with bridge settings on controller and AP then.

ConiKost · Thu Dec 05, 2024 12:26 pm

You don't need anything else on RB5009 except for base ROS package, capsman is available and can be used.

Thanks, so I did correctly understand.

You allow channels on 5Ghz which may result in overlaps/interference if you use 160MHz on your APs (e.g. 5180 and 5260, 5500 and 5580).

Indeed, thanks for the catch. Somehow I was thinking in 80 MHz steps, but yes, I would like to use 160 MHz.

You also let the AP choose which frequency to use (from a limited list). I prefer to choose myself which AP has to use which frequency (through provisioning rules based on radio MAC). But that's my view.

You mean my settings in

/interface/wifi/provisioning/export

, but instead per AP and Radio MAC defined there? I guess, by setting which frequency you mean, so you don't have any overlapping, which could happen, if AP chooses on its own a frequency from list?

Since you use datapath, I am going to assume you plan on using VLAN later on ? Be careful with bridge settings on controller and AP then.

No. I won't use any VLANs in future. Seems, that I haven't understood datapath at all. I though, this is always for communication needed.

Thu Dec 05, 2024 12:48 pm

You mean my settings in
Code: Select all
/interface/wifi/provisioning/export
, but instead per AP and Radio MAC defined there? I guess, by setting which frequency you mean, so you don't have any overlapping, which could happen, if AP chooses on its own a frequency from list?

Yes. If you let them choose, it might still happen some APs end up using the same frequency. And it's a matter of time or luck if/when reselect process will take care of it (at a random moment) and choose another frequency.
Better to choose yourself so you know where it has to be.
This also allows you to avoid some frequency on one side of the building which can perfectly be used on the other side. As an example.
But again, that's my approach. Not everyone does it this way and that's fine too if you accept the consequences

No. I won't use any VLANs in future. Seems, that I haven't understood datapath at all. I though, this is always for communication needed.

No problem. As it is now it doesn't do anything so you can leave it.

ConiKost · Thu Dec 05, 2024 8:10 pm

Thanks! My wAP ax now arrived and I did a first test with one device. Works fine with CAPsMAN

I have a small question about that. On my RB5009, "cap-wifi1" and "cap-wifi2" do show up. Is there any way to rename the name? As those interface are auto generated on RB5009 and managed by CAPsMAN, I don't see any way to rename it?

Also, is this normal, that its shown like:

operated by CAP AA:BB:CC:DD:EE:FF%bridge, traffic processing on CAP.

I mean here

%bridge

. That's a strange way of display the interface by

?

Also suprised, when running a simple speedtest on client, CPU usage on wAP ax goes up to~50%. Is this normal? I suspect, this could be something related to traffic processing on CAP?

erlinden · Thu Dec 05, 2024 8:47 pm

Thanks! My wAP ax now arrived and I did a first test with one device. Works fine with CAPsMAN

I have a small question about that. On my RB5009, "cap-wifi1" and "cap-wifi2" do show up. Is there any way to rename the name? As those interface are auto generated on RB5009 and managed by CAPsMAN, I don't see any way to rename it?

Name-format can be adjusted:

Base string to use when constructing names of provisioned interfaces. Each new interface will be created by taking the base string and appending a number to the end of it, a number will only be appended if the string is not unique.

If included in the string, the character sequence %I will be replaced by the system identity of the cAP, %C will be replaced with the cAP's TLS certificate's Common Name, %R, or %r for lowercase, will be replaced with the CAP's radio MAC

Default: "cap-wifi"

Lots of information can be found in the documentation:
https://help.mikrotik.com/docs/spaces/R ... iFiCAPsMAN

Are you using btest, or are you testing with a test tool like iperf (or speedtest)?

ConiKost · Fri Dec 06, 2024 12:57 am

Lots of information can be found in the documentation:
https://help.mikrotik.com/docs/spaces/R ... iFiCAPsMAN

Great. Thats helps! Should answer most of my stuff

Are you using btest, or are you testing with a test tool like iperf (or speedtest)?

Neither nor. I meant with client my iPhone and ThinkPad. When both just produce traffic, like speedtest.net, the cpu usage seems pretty high? I have no firewall rules. The wAP ax is only used as a "dumb" AP.

gigabyte091 · Fri Dec 06, 2024 5:52 am

If you look at the block diagram you will see why, so all the traffic must pass through CPU and that's why you are seeing high CPU load.

It doesn't matter if you are using it as plain AP.

ConiKost · Fri Dec 06, 2024 10:31 am

Indeed. No Switch chip. So cpu usage is perfectly fine. Yes, I won't exceed 100% with 1Gbit throughput. So all fine. Thanks!

Beginner CAPsMAN questions

Beginner CAPsMAN questions

Re: Beginner CAPsMAN questions

Re: Beginner CAPsMAN questions

Re: Beginner CAPsMAN questions

Re: Beginner CAPsMAN questions

Re: Beginner CAPsMAN questions

Re: Beginner CAPsMAN questions

Re: Beginner CAPsMAN questions

Re: Beginner CAPsMAN questions

Who is online