HAP AX3 WifiWave2 CAPSMAN

wiltonlee · Fri Jan 13, 2023 4:08 am

Hi,

Just got myself a pair of HAP Ax3 routers running on OS v7.7. Been trying to get WiFiWave2 interfaces working on Capsman (configured via CLI as Winbox GUI does not have this option) but to no success. Interface recognized to be controlled by Capsman but no wifi clients can successfully login to the router.

Am using configuration profiles (specifying country, ssid) + channel profile (specifying band type and channel width) + security profile.

Seeking all the gurus here for comments and pointers if anyone has successfully gotten this to work.

gotsprings · Sun Jan 15, 2023 2:51 am

I thought that was only in the beta?

Sun Jan 15, 2023 10:39 am

7.7 is released as stable version.
We can discuss about the corectness of that label but it is what it is.

mducharme · Sun Jan 15, 2023 11:15 am

I have it working, but in my case it isn't an ax3, but instead an RB4011 and an Audience. Share your config.

wiltonlee · Mon Jan 16, 2023 7:53 am

I have it working, but in my case it isn't an ax3, but instead an RB4011 and an Audience. Share your config.

Thanks for the reply. How do I share the config ?

mducharme · Mon Jan 16, 2023 9:03 am

Thanks for the reply. How do I share the config ?

From the command line run: /export

and paste the results in here. By default it hides sensitive info from the export.

You can have the export only include the wifiwave2 config (as it is probably the only applicable section) if you run: /interface wifiwave2 export

wiltonlee · Mon Jan 16, 2023 2:26 pm

Got some help from Mikrotik support directly and got pointers to correctly setup CAPSMAN with WiFiWave2... Thanks for help

Mon Jan 16, 2023 2:28 pm

And would you mind sharing that info for others ?

gotsprings · Mon Jan 16, 2023 5:42 pm

Now we definitely need a copy of
/ export file=CapswWave2

w0lt · Mon Jan 16, 2023 6:44 pm

And would you mind sharing that info for others ?

I would like to see that also. Actually,, I don't understand why Mikrotik doesn't address this as well in their Wiki.
It doesn't help anyone to provide features without any tools to configure them.

wiltonlee · Tue Jan 17, 2023 3:11 am

Verbatim reply from support - The configuration example in the documentation is written for a setup where CAPsMAN manages an interface, which is on a different device.

To manage an interface, which CAPsMAN is on the same device, just set
/interface wifiwave2 set wifi2 configuration.manager=local configuration=5gConfig(configuration profile which I setup)

For remote devices, I just have to follow the documentations to get it working e.g.
/interface wifiwave2 cap set enabled=yes
/interface wifiwave2 cap set caps-man-addresses=x.x.x.x
/interface wifiwave2 set wifi2 configuration.manager=capsman (or capsman-or-local)

wiltonlee · Tue Jan 17, 2023 3:25 am

Copied relevant sections of the export

CAPSMAN
====================
/interface wifiwave2 channel
add band=5ghz-ax name=5gChannel skip-dfs-channels=all width=20/40/80mhz
add band=2ghz-ax name=2gChannel skip-dfs-channels=all width=20/40mhz

/interface wifiwave2 security
add authentication-types=wpaX name=secProfile

/interface wifiwave2 configuration
add channel=5gChannel country=XXX name=5gConfig security=secProfile ssid=XXX
add channel=2gChannel country=XXX name=2gConfig security=secProfile ssid=XXX

/interface wifiwave2 provisioning
add action=create-enabled master-configuration=5gConfig supported-bands=5ghz-ax
add action=create-enabled master-configuration=2gConfig supported-bands=2ghz-ax

/interface wifiwave2 cap
set caps-man-addresses=X.X.X.X discovery-interfaces=Bridge enabled=yes

/interface wifiwave2 capsman
set ca-certificate=auto enabled=yes interfaces=Bridge

/interface wifiwave2
add configuration=2gConfig configuration.mode=ap disabled=no name=cap-wifi-2g
add configuration=5gConfig configuration.mode=ap disabled=no name=cap-wifi-5g
set [ find default-name=wifi2 ] channel=2gChannel configuration=2gConfig configuration.manager=local .mode=ap \
disabled=no name=wifi-2g security=secProfile
set [ find default-name=wifi1 ] channel=5gChannel configuration=5gConfig configuration.manager=local .mode=ap \
disabled=no name=wifi-5g security=secProfile

CAP
===
/interface wifiwave2 cap
set caps-man-addresses=X.X.X.X discovery-interfaces=Bridge enabled=yes

kzm · Wed Jan 18, 2023 8:21 pm

Dear wiltonlee,

sorry if my questions will be stupid, but I'm a newbie...

1. For your config to work, shall I run

/system reset-configuration no-defaults=yes

on both devices before?

2. How the devices shall be physically connected? Can I do something like:

Internet ----------ETH1- Mikrotik CAPSMAN - ETH2 --------------- ETH1 - Mikrotik CAP

?

Kind regards

SliP · Thu Jan 19, 2023 12:10 pm

Tell me, did anyone check if such a configuration supports CAPs that do not know how to wave2? Or do they still need a separate CAPSMAN server for them?

Thu Jan 19, 2023 12:20 pm

You will need 2 capsman controllers in a mixed environment.
One for Wave2 devices, one for non-wave2 devices.

gotsprings · Thu Jan 19, 2023 5:46 pm

What are you quotiing whole preceding post for? Does it help answering? Use "Post Reply" button. When you talk to somone do you repeat what was said before answering?

Really?

I see posts that don't say this, and ones that do.

mkx · Thu Jan 19, 2023 6:11 pm

Current (in reality pre-beta) version of capsman2 doesn't support legacy capsman clients and legacy capsman doesn't (and never will) support wave2 clients.

However, in another thread some MT staffer wrote that MT will consider adding support for legacy capsman clients to capsman2. As usual, no commitment has been made and there's certainly no ETA. But crowds (myself included) are thrilled by such a possibility and some even consider it "almost done".

MartinsG · Fri Jan 20, 2023 8:56 pm

Hi, somhow i can not manage do capsman on hAP ax3 on its own interface.
My config:

# jan/20/2023 20:51:47 by RouterOS 7.8beta2
# software id = KVAM-7GMC

/interface wifiwave2
# managed by CAPsMAN
set [ find default-name=wifi1 ] configuration.manager=capsman-or-local .mode=ap disabled=no
# managed by CAPsMAN
set [ find default-name=wifi2 ] configuration.manager=capsman-or-local .mode=ap disabled=no
/interface wifiwave2 security
add authentication-types=wpa2-psk,wpa3-psk name=sec1
/interface wifiwave2 configuration
add channel.skip-dfs-channels=all country=Latvia name=5ghz security=sec1 ssid=CAPsMAN_5
add country=Latvia name=2ghz security=sec1 ssid=CAPsMAN2
add country=Latvia name=5ghz_v security=sec1 ssid=CAPsMAN5_v
/interface wifiwave2 cap
set caps-man-addresses=127.0.0.1 discovery-interfaces=bridge_LV enabled=yes
/interface wifiwave2 capsman
set ca-certificate=auto enabled=yes package-path="" require-peer-certificate=no upgrade-policy=none
/interface wifiwave2 provisioning
add action=create-dynamic-enabled disabled=no master-configuration=2ghz radio-mac=00:00:00:00:00:00 supported-bands=2ghz-n
add action=create-dynamic-enabled disabled=no master-configuration=5ghz radio-mac=00:00:00:00:00:00 slave-configurations=5ghz_v supported-bands=5ghz-ac

-----

/interface/wifiwave2/capsman> print 
                   enabled: yes
            ca-certificate: auto
  require-peer-certificate: no
              package-path: 
            upgrade-policy: none
  generated-ca-certificate: CAPsMAN-CA-18FD74FE92C0
     generated-certificate: CAPsMAN-18FD74FE92C0

/interface/wifiwave2/capsman/remote-cap> print
Columns: ADDRESS, IDENTITY, STATE, BOARD-NAME, VERSION
#  ADDRESS    IDENTITY  STATE  BOARD-NAME           VERSION 
0  127.0.0.1  ax3       Ok     C53UiG+5HPaxD2HPaxD  7.8beta2

Standart FW including:

add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1

Looks like does provision, but still nothing happans.

What i am doning wrong?

MartinsG · Tue Jan 24, 2023 12:58 pm

Addad hAP ac3 with WifiWave2 as CAP controled by Capsman on hAP ax3 . Still dont wokr. All i can see:

on Capsman hAP ax3

/interface/wifiwave2/capsman/remote-cap> print
Columns: ADDRESS, IDENTITY, STATE, BOARD-NAME, VERSION
#  ADDRESS    IDENTITY  STATE  BOARD-NAME           VERSION 
0             MikroTik  Ok     RBD53iG-5HacD2HnD    7.7     
1  127.0.0.1  ax3       Ok     C53UiG+5HPaxD2HPaxD  7.8beta2

on cap hAP ac3

/interface/wifiwave2> print
Flags: M - MASTER; B - BOUND; I, R - RUNNING
Columns: NAME, CONFIGURATION.MODE
#     NAME         CONFIGURATION.MODE
;;; managed by CAPsMAN
0 MBI wifi1--2Ghz  ap                
;;; managed by CAPsMAN
1 MBI wifi2-5Ghz   ap

osc86 · Tue Jan 24, 2023 9:49 pm

I really hope they'll add support for capsman forwarding in the next release, not the best solution to add vxlan/eoip everywhere and bridge cap interfaces locally

maigonis · Fri Jan 27, 2023 8:36 pm

I really hope they'll add support for capsman forwarding in the next release, not the best solution to add vxlan/eoip everywhere and bridge cap interfaces locally

AFAIK there will be no capsman forwarding.

MartinsG · Fri Feb 10, 2023 5:37 pm

Hi!
Ok, now did manage to get wokring CAPsMAN on hAP ax3 and hAP ac3 as CAP.
As it stated then there is no CAPsMAN forwarding mode (hope it is temporary). Trying to set up with VLAN, no luck there too (see picture) . Am i doing someting wrong, or it is not suported for now?
VLAN works on CAPsMAN it self (hAP ax3). All good there.

On CAPsMAN

# feb/10/2023 17:28:23 by RouterOS 7.8rc1
# software id = KVAM-7GMC
#
# model = C53UiG+5HPaxD2HPaxD

/interface wifiwave2 datapath
add bridge=bridge_ disabled=no name=datapath_1
add bridge=bridge_ disabled=no name=datapath_10 vlan-id=10
/interface wifiwave2 security
add authentication-types=wpa2-psk disabled=no encryption="" ft=yes name=sec1
/interface wifiwave2 configuration
add channel.skip-dfs-channels=all country=Latvia datapath=datapath_1 disabled=no name=conf_1 security=sec1 security.ft=yes ssid=Aaaa
add channel.skip-dfs-channels=all country=Latvia datapath=datapath_10 disabled=no name=conf_10 security=sec1 security.ft=yes ssid=Aaaa_10
/interface wifiwave2 capsman
set enabled=yes package-path="" require-peer-certificate=no upgrade-policy=none
/interface wifiwave2 provisioning
add action=create-dynamic-enabled master-configuration=conf_1 slave-configurations=conf_10

and not much on CAP

# feb/10/2023 17:32:24 by RouterOS 7.8rc1
# software id = WYZC-DIZ1
#
# model = RBD53iG-5HacD2HnD

/interface bridge
add name=bridge1
/interface wifiwave2
# managed by CAPsMAN
# mode: AP, SSID: Aaaa, channel: 2427/n/Ce
set [ find default-name=wifi1 ] configuration.manager=capsman .mode=ap disabled=no
# managed by CAPsMAN
# mode: AP, SSID: Aaaa, channel: 5240/ac/eeeC
set [ find default-name=wifi2 ] configuration.manager=capsman .mode=ap disabled=no
/interface bridge port
add bridge=bridge1 interface=all
/interface wifiwave2 cap
set discovery-interfaces=bridge1 enabled=yes

pbaumgartner · Tue Feb 14, 2023 5:14 pm

As I just ordered my AX³ , i found this thread and checked the manual, but I don't understand one part:

The wifiwave2 package can be installed on some products, which ship with the bundled 'wireless' package, replacing it.
Installing the wifiwave2 package disables other means of configuring wireless interfaces. Before installation, make sure to back up any wireless and regular CAPsMAN configuration you may want to retain.

Does this mean I need one physical device which acts as capsman for legacy wireless and one device as wifiwave2-capsman?
Currently my CRS326 works as capsman for all my APs and it should do this for both AC and AX devices in the future. I really don't see any sense in this behaviour?

Tue Feb 14, 2023 5:45 pm

Correct ... for now.
They are planning on integrating both but as it is now, you need 2 controllers each having the required wifi package since they can not be used together on the same device.
ETA ? Nobody knows.

pbaumgartner · Tue Feb 14, 2023 6:15 pm

I know, this answer is needless, but this situation is ridiculous. wifiwave2 packages was released in december 2020, around 2 yeas later they released devices which rely only on this package and half a year later still no proper capsman support for both worlds?
I just installed a ubiquity wifi6 AP into an existing wifi5 environment with nearly no configuration effort - it just works and is in the same pricerange as mikrotik.

Tue Feb 14, 2023 6:18 pm

Can't say I disagree there ...

anav · Tue Feb 14, 2023 7:02 pm

But crowds (myself included) are thrilled by such a possibility and some even consider it "almost done".

Magic mushrooms for lunch??

anav · Tue Feb 14, 2023 7:06 pm

I know, this answer is needless, but this situation is ridiculous.

Not needless and well appreciated!!
For at least two years I have been begging mikrotik to hire BPWL or somebody that knows wifi and can help develop their
product so that its accessible to non-wifi PHDs........
The two multimillionaire owners of the company are too cheap to assign additional developers...... might get in the way of purchasing their yachts ( some good deals to be had on post-oligarch owned boats).

It would appear that they have left the task to Viktor, to do in his spare time as he is often busy making videos and seemingly, being really the outdoors type, frolicking with reindeer,......

MartinsG · Tue Feb 14, 2023 8:16 pm

More over, at least i did not manage to get VLAN on hAP ac3 wifiwave2 managed by CAPsMAN from hAP ax3. See my previos post viewtopic.php?t=192458#p983369. Basically now i hold all my continusly impovments in my network deployment while this is sorterd out.

Kataius · Fri Feb 17, 2023 4:27 am

Hi, I have a problem with capsman... I can provision a guest network, but if I put bridge -> port all it gives me the ip of the main network and not the guest network, if instead I set it as bridge -> port eth1, I don't gives me ip on wifi (both guests and main network). Where am I doing wrong?

CAPSMAN:

/interface wifiwave2 channel
add frequency= name=silent
/interface wifiwave2 datapath
add bridge=BR-Casa disabled=no name=Wifi_Main
add bridge=BR-Mamma disabled=no name=Wifi_Mamma
add bridge=BR-Guest disabled=no name=Wifi_Guest
/interface wifiwave2 security
add authentication-types=wpa2-psk name=home
add authentication-types=wpa2-psk disabled=no name=guest
add authentication-types=wpa2-psk name=silent
/interface wifiwave2 configuration
add country=Italy datapath=Wifi_Main datapath.bridge=BR-Casa disabled=no name=home security=home ssid=
add country=Italy datapath=Wifi_Guest datapath.bridge=BR-Guest disabled=no name=guest security=guest ssid=
add channel=silent country=Italy datapath=Wifi_Mamma datapath.bridge=BR-Mamma disabled=no hide-ssid=yes name=silent security=silent ssid=

/interface wifiwave2 capsman
set enabled=yes package-path="" require-peer-certificate=no upgrade-policy=none
/interface wifiwave2 provisioning
add action=create-dynamic-enabled disabled=no master-configuration=home slave-configurations=guest
add action=create-dynamic-enabled disabled=no master-configuration=home radio-mac= slave-configurations=guest
add action=create-dynamic-enabled disabled=no master-configuration=home radio-mac= slave-configurations=guest,silent

CAP:

/interface bridge
add name=bridge1
/interface wifiwave2
# managed by CAPsMAN
# mode: AP, SSID: , channel: 5680/ax/eCee
set [ find default-name=wifi1 ] configuration.manager=capsman .mode=ap \
    disabled=no
# managed by CAPsMAN
# mode: AP, SSID: , channel: 2462/ax/eC
set [ find default-name=wifi2 ] configuration.manager=capsman .mode=ap \
    disabled=no
/interface list
add name=WAN
add name=LAN
/interface bridge port
add bridge=bridge1 interface=ether1
add bridge=bridge1 interface=wifi1
add bridge=bridge1 interface=wifi2
/interface list member
add interface=bridge1 list=LAN
/interface wifiwave2 cap
set discovery-interfaces=bridge1 enabled=yes
/ip address
add address=192.168.0.4/24 interface=bridge1 network=192.168.0.0
add address=192.168.0.4/24 interface=ether1 network=192.168.0.0
/ip dhcp-client
add disabled=yes interface=ether1
# DHCP client can not run on slave or passthrough interface!
add interface=ether1
/system clock
set time-zone-name=Europe/Rome
/system identity
set name="AP"

sevo77 · Sun Feb 19, 2023 8:45 pm

Is there local-forwarding in CAPSMAN2 (WifiWave2)?

sc0ch · Tue Mar 07, 2023 11:31 am

Hi, everyone.
I've got HAP AX3 and HAP AX2.

routeros + wifiwave2 - version 7.8

Necessary: configure everything through CAPSMAN2 (done according to the manual from mikrotik site), CAPSMAN2 is deployed on Hap AX3

Problem: Unable to registrate HAP AX3 interfaces on itself, while it register well all interfaces from Hap AX2.
There are no FW rules anywhere. Configuring Only 5Ghz AX.

Any ideas?

Tue Mar 07, 2023 5:13 pm

@sc0ch viewtopic.php?t=190351#p967604

peterbarlabas · Wed Mar 08, 2023 12:43 pm

Hello!

I have the same problem!
I have an AX3 router and an Audience. The AX3 is the capsmanager. Audience connect well and working fine with casman AX3.
But the AX3 own wifi not working well. Just show manageed by capsman, but status show disable!

Regards: Péter

Wed Mar 08, 2023 3:12 pm

When a device is running WifiWave2 CAPsMAN, it cannot set its own wireless interfaces as CAPs. This is a known limitation, due to how the driver works, there is a "hidden" (system level) provision rule for local interfaces, which makes them incompatible with local CAPsMAN.

Though you can just pass the same configuration manually for local WifiWave2 interfaces, as you would via provisioning rules - just use "/interface/wifiwave2/ set wifiX configuration=X", which could be argued that it is more simple to do, than configuring "/interface/wifiwave2/cap" and setting "configuration.manage=r" to capsman-or-local/capsman.
The end result is the same, as WifiWave2 CAP interfaces and regular WifiWave2 interfaces use the same exact system, it's not divided into separate menus as original CAPsMAN and regular wireless was.

On a separate note, make sure you don't set "configuration.manager=capsman", in the configuration profile that you assign via provisioning rules, this setting should be set on CAP device "/interface/wifiwave2 set " itself, and must not be passed to CAP that has already joined CAPsMAN.

MartinsG · Wed Mar 08, 2023 5:55 pm

@Guntis, but how about CAPsMAN and VLAN?
On CAPsMAN therer is all good with VLAN, but on CAP VLAN is shows as not supported.
See post: viewtopic.php?t=192458#p983369

alibloke · Thu Mar 09, 2023 10:26 am

It would be useful to have this critical information documented rather than having to fish for it in a random forum thread.

Thu Mar 09, 2023 2:39 pm

Unfortunately, vlan-id is supported only on 802.11ax interfaces. Documentation has been adjusted.

MartinsG · Thu Mar 09, 2023 6:49 pm

Unfortunately, vlan-id is supported only on 802.11ax interfaces. Documentation has been adjusted.

Is this temporary, while missing functionality will be added or it will be "Lost functionality"?
And how you suggest to set up Guest network on hap ac3 wave2 with Caps-man?

alibloke · Fri Mar 10, 2023 11:55 am

Ugh that's a very frustrating limitation, but thanks for documenting it. Can you also include a mention in the documentation of wifiwave2 not working with local wireless devices?

mrtur · Tue Mar 14, 2023 3:36 pm

Unfortunately, vlan-id is supported only on 802.11ax interfaces. Documentation has been adjusted.
Is this temporary, while missing functionality will be added or it will be "Lost functionality"?
And how you suggest to set up Guest network on hap ac3 wave2 with Caps-man?

same question here! Will this be released one day, or is it a permanent hardware limitation?

Is there some workaround? Is it possible to acheive L2 level separation of multiple ssids on wifiwave2 + capsman on ac interfaces (ex: hap ac3) without using vlans?

magchiel · Thu Mar 23, 2023 11:11 pm

Unfortunately, vlan-id is supported only on 802.11ax interfaces. Documentation has been adjusted.

It's indeed unbelievably frustrating. Lost a good day on this trying to migrate a CAPsMANv1 setup to wifiwave2, before it was documented. Right, it should be considered alpha-stage so it is to be expected maybe. But I think the limitations should be made quite a bit more explicit still, under the wifiwave2 compatibility section, instead of expecting potential buyers or upgraders to sift through every parameter to see which features are not supported. An unqualified listing of e.g. Audience to me suggests full compatibility, especially given such a limitation is listed for the RB4011iGS+5HacQ2HnD.

And it's not just CAPsMANv2 datapath that's crippled on non-ax hardware, it's also the client specific VLAN tagging through access list that's limited in wifiwave2, which is at the heart of my IoT configuration (with device-specific keys and vlans, similar to the cases made in viewtopic.php?t=191008 and viewtopic.php?p=989540).

While wireless offering has never been a particular strong suite for MikroTik, with these precedents and without a clear roadmap for wireless offering it's hard to justify any investments here, because until wifiwave2 is feature complete it apparently is a complete lottery if your investment will ever receive these features. I've already written off the wAP ac's I have as they will never receive wifiwave2 support and there's no backwards compatibility from CAPsMANv2 (ok, they're approaching 7 years of operations - that's fair). But should I now also write off the Audiences I specifically bought last year with wifiwave2 compatibility in mind, because they will never receive vlan-tagging? And even if one wanted to invest here, MikroTik currently has no 802.11ax offerings in a formfactor that you would consider placing in a visible location (contrary the suggestion from the marketing material to mount a black box to a wall - which is typically of a lighter colour...).

Like the previous models, hAP ax² can be mounted vertically, horizontally, or even on the wall

- https://mikrotik.com/product/hap_ax2

I'd like to +1 the statement made in another thread:

Summary: RoS combined with crappy wifi/wifi wave2package is an INSULTINGLY poor companion to the fabulous RoS and pushes clients towards other solutions.

paddypatpat · Wed Apr 19, 2023 6:24 am

Copied relevant sections of the export

CAPSMAN
====================
...

/interface wifiwave2
add configuration=2gConfig configuration.mode=ap disabled=no name=cap-wifi-2g
add configuration=5gConfig configuration.mode=ap disabled=no name=cap-wifi-5g

Trying to follow along with this on a RouterOS CHR virtual machine as the CAPsMAN for two hAP AX3 caps.

At this step it asks me for a master-interface. I figured that the bridge would be one, but as far as I can tell there are no master-interfaces listed. Any idea how I can specify/create a master-interface? At the moment it errors, either saying:

Script Error: action cancelled

... or ...

 input does not match any value of master-interface

... depending on how I enter this command.

gotsprings · Thu Apr 20, 2023 3:57 pm

magchiel

It was a pretty bitter pill.... but I had to move on a few years ago.

Support tickets stopped dead when we yanked the Tik access points.