CAPsMAN with two SSID

Zwodka · Wed Jan 07, 2015 9:32 am

Hi All!

I get to know the CAPsMAN topic. I tried a following:
- CAPsMAN: RB951G-2HnD
- Cap1: Wifi of RB951G-2HnD
- Cap2: Wifi of RBmAP-2n
My first step was success: one SSID on both devices. Everithing works fine.
But when I set a second SSID (guest wifi)... No one wifi device can connect to the second SSID (laptop, PC, mobile phone). The second SSID is visible, but isn't usable.
FYI:
- I created 2 config for the 2 SSID (Name, Mode, SSID, Country, Bridge, Security). I tested them seperately, they work fine.
- I created 2 Provisoning for the 2 devices (RB951G-2HnD and RBmAP-2n).
I add a new CAP interface in the CAPsMAN (RB951G-2HnD and/or RBmAP-2n), select a config (SSID1 or SSID2), set the phisical interface Channel/Frequency, Width, Band, Extension Channel) ... and works fine (Master, Bounded)
But when add a second wifi/SSID (Virtual AP - the Master Interface is the first one - of course) the second wifi/SSID appears in the WinBox (Slave, Bounded). It is visible for any wireless capable device - laptop, PC, mobile - but isn't usable. They can't connect to second wifi/SSID

( The first wifi/SSID contiues to function.
Is it my fault?
I've tried these with CAPsMAN-v1.

Thanx,
Z

Wed Jan 07, 2015 2:34 pm

please try to use CAPsMAN v2
The seconds CAP interface is also added to some bridge port?

What do you see in the log file when the client tries to connect to the SSID?

JasonEde · Thu Jan 08, 2015 12:14 pm

I'm having a similar issue with Capsman V2 running on 6.23.

I've got a primary SSID running on an interface and datapath is to bridge1 on the capsman unit.
If I then attach a sub-interface with a new SSID (and corresponding datapath to bridge2) then I can see the wireless network, but I just cannot connect to it at all.

If I switch the config to the primary interface then I can connect fine.

There is nothing logged on the capsman unit (with cap logging on) when i try to connect to the sub-interface ssid.

Thu Jan 08, 2015 1:10 pm

please make sure that you use v6.24 as there are some fixes for CAPsMAN v2 that could help.
If it doesn't then contact support@mikrotik.com

JasonEde · Thu Jan 08, 2015 1:27 pm

I'm trying with 6.24, but still can't get the second SSID to connect. I'm still not sure there isn't something wrong with my config and I'd like to check before contacting support

JasonEde · Thu Jan 08, 2015 1:39 pm

Below is the my router config in case anyone can spot anything silly...

# jan/08/2015 11:36:51 by RouterOS 6.24
#
/caps-man channel

add band=2ghz-b/g/n frequency=2422 name=2.4G-channel-3 tx-power=-5
add band=5ghz-a/n frequency=5180 name=5G-channel-36 tx-power=-5
/interface bridge
add name=Priv-Bridge protocol-mode=none
add mtu=1500 name=man-bridge protocol-mode=stp
add name=pub-bridge protocol-mode=none
/ip neighbor discovery
set ether1 discover=no
/caps-man datapath
add bridge=Priv-Bridge name=datapath-Priv
add bridge=pub-bridge name=datapath-Pub
/caps-man security
add authentication-types=wpa2-psk encryption=aes-ccm group-encryption=aes-ccm \
    name=security1 passphrase=abc123Password
/caps-man configuration
add channel=2.4G-channel-3 channel.tx-power=5 mode=ap name=cfg1-2.4GHz \
    security=security1 ssid=Priv-Test
add channel=5G-channel-36 channel.tx-power=-10 mode=ap name=cfg2-5GHz \
    security=security1 ssid=Priv-Test
add channel=2.4G-channel-3 mode=ap name=cfg3-public security=security1 ssid=\
    Public-test
/caps-man interface
# 
add arp=enabled channel=5G-channel-36 configuration=cfg2-5GHz datapath=\
    datapath-Priv disabled=no l2mtu=1600 mac-address=4C:5E:0C:84:8D:C1 \
    master-interface=none mtu=1500 name=cap1-5GHz radio-mac=4C:5E:0C:84:8D:C1 \
    security=security1
# 
add arp=enabled channel=2.4G-channel-3 configuration=cfg1-2.4GHz \
    configuration.rx-chains=0,1,2 configuration.tx-chains=0,1,2 datapath=\
    datapath-Priv disabled=no l2mtu=1600 mac-address=4C:5E:0C:11:13:14 \
    master-interface=none mtu=1500 name=cap3-2.4GHz-Master radio-mac=\
    4C:5E:0C:11:13:14 security=security1
# 
add arp=enabled channel=2.4G-channel-3 configuration=cfg3-public datapath=\
    datapath-Pub disabled=no l2mtu=1600 mac-address=4C:5E:0C:11:13:14 \
    master-interface=cap3-2.4GHz-Master mtu=1500 name="cap2-slave public" \
    radio-mac=4C:5E:0C:11:13:14 security=security1
/ip pool
add name=man_bridge ranges=192.168.188.2-192.168.188.254
add name=public ranges=192.168.254.2-192.168.254.254
add name=priv_net ranges=192.168.126.2-192.168.126.254
/ip dhcp-server
add address-pool=man_bridge authoritative=yes disabled=no interface=\
    man-bridge lease-time=3d name=dhcp1
add address-pool=public authoritative=yes disabled=no interface=pub-bridge \
    lease-time=3d name=dhcp2
add address-pool=priv_net authoritative=yes disabled=no interface=Priv-Bridge \
    lease-time=3d name=dhcp3
/system logging action
set 3 src-address=0.0.0.0
/caps-man access-list
add action=accept interface=all signal-range=-80..120
add action=reject interface=all signal-range=-120..-81
/caps-man manager
set ca-certificate=auto certificate=auto enabled=yes upgrade-policy=\
    suggest-same-version
/caps-man provisioning
add action=create-dynamic-enabled comment=2.4GHz master-configuration=cfg1-2.4GHz \
    radio-mac=4C:5E:0C:6F:B0:BA
add action=create-dynamic-enabled comment=5GHz master-configuration=cfg2-5GHz \
    radio-mac=4C:5E:0C:84:8D:C1
/interface bridge port
add bridge=man-bridge interface=ether5
add bridge=man-bridge interface=ether2
/interface bridge settings
set use-ip-firewall-for-vlan=yes
/ip address
add address=192.168.188.1/24 interface=man-bridge network=192.168.188.0
add address=192.168.254.1/24 interface=pub-bridge network=192.168.254.0
add address=192.168.126.1/24 interface=Priv-Bridge network=192.168.126.0
/ip dhcp-client
add default-route-distance=0 dhcp-options=hostname,clientid disabled=no \
    interface=ether1
/ip dhcp-server network
add address=192.168.126.0/24 dns-server=8.8.8.8 gateway=192.168.126.1
add address=192.168.188.0/24 dns-server=8.8.8.8 gateway=192.168.188.1
add address=192.168.254.0/24 dns-server=8.8.8.8 gateway=192.168.254.1
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1
/ip ipsec policy
set 0 dst-address=0.0.0.0/0 src-address=0.0.0.0/0
/system logging
add topics=caps,debug
add topics=wireless
/system ntp client
set enabled=yes primary-ntp=192.168.124.1

Zwodka · Thu Jan 08, 2015 1:43 pm

please try to use CAPsMAN v2
The seconds CAP interface is also added to some bridge port?

What do you see in the log file when the client tries to connect to the SSID?

1. I'll try the CAPsMAN v2.
2. Yes, it is added to the same Bridge as Master Interface.
3. I'll see it.

Thu Jan 08, 2015 1:57 pm

JasonEde, specify different MAC address for that VirtualAP as you can't have the same MAC address. Usually when you add a new VirtualAP it automatically changes the MAC address.

JasonEde · Thu Jan 08, 2015 2:14 pm

Cheers, that sorted it

New interfaces now do auto-increment... Might try again in 6.23

Zwodka · Thu Jan 08, 2015 10:34 pm

When I add a new Interface there are two MAC: "mac-address" and "radio-mac".
What is the difference?

stoch · Thu Aug 20, 2015 4:10 pm

JasonEde, specify different MAC address for that VirtualAP as you can't have the same MAC address. Usually when you add a new VirtualAP it automatically changes the MAC address.

Thank you for advice.
Today faced with this problem. After reset configuration AP and further configuration second SSID (Virtual AP) users can see second SSID but could not connect to it.
I changed MAC address of the Virtual AP. After changing MAC address users can connect.

Wish you luck!

JasonEde · Fri Aug 21, 2015 10:00 am

If you add the interface from the menu rather than just copying then it sorts the MAC address for you automatically.

CAPsMAN with two SSID

CAPsMAN with two SSID

Re: CAPsMAN with two SSID

Re: CAPsMAN with two SSID

Re: CAPsMAN with two SSID

Re: CAPsMAN with two SSID

Re: CAPsMAN with two SSID

Re: CAPsMAN with two SSID

Re: CAPsMAN with two SSID

Re: CAPsMAN with two SSID

Re: CAPsMAN with two SSID

Re: CAPsMAN with two SSID

Re: CAPsMAN with two SSID

Who is online