Topic: tech mikrotik prev next
tech mikrotik > CAPsMAN
Configuring CAPsMAN for a small network with several access points. In this instance, the CAPsMAN controller is a CRS (not recommended due to performance) and the access points are hAP Lites. A better configuration would be to offload the CAPsMAN processing to a more powerful router - even a separate hEX device.
CAPsMAN is a Mikrotik proprietary protocol for managing Mikrotik wireless access points. It runs on a Mikrotik router (really, any device running RouterOS).
It operates in Layer 2 or Layer 3 modes. Layer 2 mode is particularly easy to configure, but requires that the access point and the controller are in the same broadcast domain.
WiFi data can be forwarded locally, by the access point, to its destination VLAN, or encapsulated and sent to the controller for forwarding.
CAPsMAN receives some criticism for being a proprietary Mikrotik protocol, not compatible with other vendors’ equipment. It was extensively rewritten, and the version that ships with RouterOS v7 is substantially different to the version in v6; do not attempt to mix APs and controllers between major versions.
The following must be configured on the CAPsMAN controller:
Open the Wireless, CAPsMAN window. Work from right to left to configure the following:
Security settings are the wireless security, e.g. WPA2 passphrase. They can also be set directly in the configuration tab (second to last in this process).
Datapath settings are how and where the WiFi payload data is processed. In this setup, WiFi data is tagged into its own VLAN - that’s the how - and process on the CAPsMAN controller - that’s the where. Create a new datapath. Set ‘Local Forwarding’ to unticked and ‘Client to Client Forwarding’ to ticked. Be careful; the defaults are for local forwarding to be enabled and client to client forwarding to be disabled. Set the ‘VLAN mode’ to ‘use tag’ and specify the tag. WiFi payloads will have this tag applied before they are sent to the specified bridge.
Configurations bring together security, channel, and datapath settings to create an SSID, that end users will see and connect to. Create a new configuration, provide the SSID that users will see, and select the security and datapath settings created earlier.
Provisioning binds configurations to specific access points, or classes of access points. Access points may be classed by their identification or radio type. Create a new provisioning item and leave all fields as their defaults, except ‘configuration’ to select the configuration just created, and action to ‘create enabled’, which will create the local caps device to be able to send and receive traffic.
Under ‘CAP Interface’, to the right, click ‘Manager’ to access global CAPsMAN settings. Enable CAPsMAN and set both ‘Certificate’ and ‘CA Certificate’ to ‘auto’. Save this configuration. Certificates will be generated automatically.
Traffic can be forwarded locally by the AP to the destination; this was the only option in early versions of CAPsMAN. Traffic can also be forwarded via the encrypted CAPsMAN tunnel to the controller, which will then forward the traffic on; this is available only in newer versions of CAPsMAN and operates in a similar way to CAPWAP solutions from other vendors.
If traffic is forwarded locally, then the VLAN to which the traffic is
forwarded must be added, on the bridge, to ports facing the access points.
CAPsMAN will add the VLAN automatically to the cap interfaces which are
automatically created.
The interfaces on which CAPsMAN will operate at Layer 2 can be limited under ‘Interfaces’ under the global CAPsMAN settings. Typically, the default rule allowing CAPsMAN on all interfaces should be modified to ‘forbid’, and specific interfaces on which CAPsMAN should be allowed, should be added.
Connect a radio to a hybrid switch port. Choose a new access VLAN for CAPs traffic only, and add the WiFi data VLAN as a trunked VLAN on the same port. Set the access point (hAP Lite) to CAPs mode by holding down the reset button as the power is connected. Wait for the LED to start flashing, which it will do for ten seconds. Once the LED is lit solidly, releast the reset button. The access point will look for a CAPsMAN server on the Layer 2 segment and provision itself automatically. Go to the ‘Remote CAP’ tab under ‘Wireless, CAPsMAN’ and see that the remote device appears. Set an identity. Under ‘Bridge’ see that the CAPs VLAN specificied in the datapath has been added to the port facing the AP.
Not strictly necessary; create a VLAN for CAPsWAN traffic. This VLAN will only be tagged on the bridge. It can be used in the CAPsMAN interface list to specify interfaces that will accept Layer 2 CAPsMAN traffic.
/interface vlan
add interface=bridge1 name=cap-lan vlan-id=12
Instruct APs to forward data into VLAN 3 by pushing a tag.
/caps-man datapath
add bridge=bridge1 client-to-client-forwarding=yes local-forwarding=yes name=\
datapath1 vlan-id=3 vlan-mode=use-tag
/caps-man security
add authentication-types=wpa2-psk name=security1
/caps-man configuration
add datapath=datapath1 mode=ap name=cfg1 security=security1 ssid=Oak
Add the CAPsWAN VLAN as the PVID on AP ports. This just isolates CAPsWAN traffic and stops other traffic leaking; it is not a requirement.
/interface bridge port
add bridge=bridge1 comment=wifi interface=ether13 pvid=12
When local forwarding is in use, add the WiFi VLAN to the AP ports.
/interface bridge vlan
add bridge=bridge1 comment="CAPsMAN local forwarding" disabled=yes tagged=\
ether13,ether18 vlan-ids=3
Specify interfaces to work with CAPsWAN at Layer 2,
/caps-man manager interface
set [ find default=yes ] forbid=yes
add disabled=no interface=cap-lan
or specify interfaces individually.
add disabled=no interface=ether13
add disabled=no interface=ether18
Provisioning, instructions on which configurations to provision to which radios.
/caps-man provisioning
add action=create-enabled master-configuration=cfg1 name-format=prefix-identity \
name-prefix=cap-