I have found a few discussions on this topic but no real solutions.
In my lab I have configured a hEX r3 and a hAP ac with a CRS125 in between. Each device has a management VLAN interface (99) which handles MikroTik discovery and device management. They also handle a public and private VLAN for use by users.
The problem appears to be that when a CAP interface is added to a bridge with VLAN filtering turned on it's tagged with PVID 1 in spite of any configuration you set in the datapath or configuration in CAPsMAN. You can see this same problem at work when you add a single wireless interface to the bridge. If you set the VLAN tagging mode and VLAN ID using /interface wireless, the setting is ignored. If you set it using /interface bridge port instead, it becomes effective.
I've left out the irrelevant bits and the switch's configuration since it's pretty standard stuff. If you want you can imagine the hAP ac connected to ether2 on the hEX r3 since that's effectively what's going on.
Since the switch and the hAP are handling the tagging of packets, a VLAN filtering bridge is, strictly speaking, optional in this topology. For other topologies though there should be a way to have a VLAN filtering bridge and CAPsMAN coexist happily on the same device.
Router's config:
Code: Select all
/interface bridge
add admin-mac=64:D1:54:62:52:FE auto-mac=no name=bridge vlan-filtering=yes
/interface bridge port
add bridge=bridge frame-types=admit-only-vlan-tagged ingress-filtering=yes \
interface=ether2
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
ingress-filtering=yes interface=ether3 pvid=100
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
ingress-filtering=yes interface=ether4 pvid=100
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
ingress-filtering=yes interface=ether5 pvid=99
/interface bridge vlan
add bridge=bridge comment=internal-vlan tagged=bridge,ether2 untagged=\
ether3,ether4 vlan-ids=100
add bridge=bridge comment=public-vlan tagged=bridge,ether2 vlan-ids=200
add bridge=bridge comment=management-vlan tagged=bridge,ether2 untagged=\
ether5 vlan-ids=99
/interface vlan
add interface=bridge name=internal-vlan vlan-id=100
add interface=bridge name=management-vlan vlan-id=99
add interface=bridge name=public-vlan vlan-id=200
/caps-man datapath
add bridge=bridge name=internal-dp vlan-id=100 vlan-mode=use-tag
add bridge=bridge name=public-dp vlan-id=200 vlan-mode=use-tag
/caps-man security
add authentication-types=wpa-psk,wpa2-psk encryption=aes-ccm name=\
lab-internal
add authentication-types=wpa-psk,wpa2-psk encryption=aes-ccm name=lab-public
/caps-man configuration
add datapath=internal-dp datapath.vlan-id=100 datapath.vlan-mode=use-tag \
mode=ap name=cfg-internal security=lab-internal ssid=lab-internal
add datapath=public-dp datapath.vlan-id=200 datapath.vlan-mode=use-tag mode=\
ap name=cfg-public security=lab-public ssid=lab-public
/caps-man manager
set enabled=yes
/caps-man manager interface
set [ find default=yes ] forbid=yes
add disabled=no interface=management-vlan
/caps-man provisioning
add action=create-enabled master-configuration=cfg-internal name-format=\
identity slave-configurations=cfg-public
/ip address
add address=192.168.1.254/24 interface=internal-vlan network=192.168.1.0
add address=192.168.2.254/24 interface=public-vlan network=192.168.2.0
add address=10.255.255.1/24 interface=management-vlan network=10.255.255.0
Code: Select all
/interface bridge
add fast-forward=no name=bridge vlan-filtering=yes
/interface vlan
add interface=bridge name=management-vlan vlan-id=99
/interface bridge port
add bridge=bridge interface=ether1
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
ingress-filtering=yes interface=ether2 pvid=200
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
ingress-filtering=yes interface=ether3 pvid=200
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
ingress-filtering=yes interface=ether4 pvid=200
add bridge=bridge frame-types=admit-only-untagged-and-priority-tagged \
ingress-filtering=yes interface=ether5 pvid=99
/interface bridge vlan
add bridge=bridge comment=management-vlan tagged=bridge,ether1 untagged=\
ether5 vlan-ids=99
add bridge=bridge comment=internal-vlan tagged=bridge,ether1 vlan-ids=100
add bridge=bridge comment=public-vlan tagged=bridge,ether1 untagged=\
ether2,ether3,ether4 vlan-ids=200
/interface wireless cap
set bridge=bridge caps-man-addresses=10.255.255.1 discovery-interfaces=\
management-vlan enabled=yes interfaces=wlan1,wlan2 static-virtual=yes
/ip address
add address=10.255.255.3/24 interface=management-vlan network=10.255.255.0
