Почему точка доступа не переходит под управление CAPsMAN?

Question

[romaro]

Управляющий маршрутизатор и точка обновлены до последних версий RouterOS, пакеты wifi-qcom установлен. Однако после активации CAP на точке, Wifi-интерфейсы остаются не активными. Если активировать их вручную, они не переходят в режим slave. При этом на маршрутизаторе (во вкладке Wifi/RemoteCAP) точка видна. Точка получает IP от маршрутизатора. Что я делаю не так?

Настройки маршрутизатора:

# 2026-06-04 13:07:35 by RouterOS 7.23.1
# software id = HSRS-PG4A
#
# model = C52iG-5HaxD2HaxD
# serial number = HE908XACV7S
/interface bridge
add admin-mac=48:A9:8A:91:71:18 auto-mac=no name=bridge_LAN port-cost-mode=\
    short
/interface wifi
set [ find default-name=wifi1 ] channel.band=5ghz-ax .skip-dfs-channels=\
    10min-cac .width=20/40/80mhz configuration.mode=ap .ssid=Photogun-5GHz \
    disabled=no security.authentication-types=wpa2-psk,wpa3-psk
set [ find default-name=wifi2 ] channel.band=2ghz-ax .skip-dfs-channels=\
    10min-cac .width=20/40mhz configuration.mode=ap .ssid=Photogun-2GHz \
    disabled=no security.authentication-types=wpa2-psk,wpa3-psk
/interface ethernet switch
set switch1 cpu-flow-control=yes
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wifi channel
add band=2ghz-n disabled=no frequency=2437 name="Brendex-Studio-2GHz N"
/interface wifi configuration
add disabled=no mode=ap name=Brendex-Studios-2GHz-Conf ssid=Studios-2GHz
/interface wifi datapath
add bridge=bridge_LAN disabled=no name=Datapath_Bridge_LAN \
    traffic-processing=on-cap
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disabled=no encryption=ccmp name=\
    Brendex-Studios-WiFi-Security
/ip pool
add name=dhcp-local-pool ranges=10.0.98.10-10.0.98.254
/ip dhcp-server
add address-pool=dhcp-local-pool interface=bridge_LAN lease-time=10m name=\
    defconf
/interface bridge port
add bridge=bridge_LAN comment=defconf interface=ether2 internal-path-cost=10 \
    path-cost=10
add bridge=bridge_LAN comment=defconf interface=ether3 internal-path-cost=10 \
    path-cost=10
add bridge=bridge_LAN comment=defconf interface=ether4 internal-path-cost=10 \
    path-cost=10
add bridge=bridge_LAN comment=defconf interface=ether5 internal-path-cost=10 \
    path-cost=10
add bridge=bridge_LAN comment=defconf interface=wifi1 internal-path-cost=10 \
    path-cost=10
add bridge=bridge_LAN comment=defconf interface=wifi2 internal-path-cost=10 \
    path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge_LAN list=LAN
add comment=defconf interface=ether1 list=WAN
/interface ovpn-server server
add mac-address=FE:B2:A1:7B:E0:43 name=ovpn-server1
/interface wifi capsman
set enabled=yes interfaces=bridge_LAN
/interface wifi provisioning
add action=create-dynamic-enabled disabled=no master-configuration=\
    Brendex-Studios-2GHz-Conf radio-mac=00:00:00:00:00:00
/ip address
add address=10.0.98.1/24 comment=defconf interface=bridge_LAN network=\
    10.0.98.0
/ip dhcp-client
add comment=defconf interface=ether1 name=client1
/ip dhcp-server network
add address=10.0.98.0/24 comment=defconf dns-server=10.0.98.1 gateway=\
    10.0.98.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=10.0.98.1 comment=defconf name=router.lan type=A
/ip firewall filter
add action=log chain=forward log=yes log-prefix=output_asterisk protocol=udp
add action=accept chain=input comment="ROMARO :: WinBox non-standardt port" \
    dst-port=8811 log-prefix=winbox protocol=tcp
add action=accept chain=input comment="UPD for phones try" connection-state=\
    new dst-port=5090,5060 log=yes log-prefix=ip_udp protocol=udp
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
/ip firewall nat
add action=src-nat chain=srcnat comment=\
add action=masquerade chain=srcnat comment="defconf: masquerade" disabled=yes \
    ipsec-policy=out,none out-interface-list=WAN
/ip ipsec profile
set [ find default=yes ] dpd-interval=2m dpd-maximum-failures=5
/ip service
set ftp disabled=yes
set ssh disabled=yes
set telnet disabled=yes
set api disabled=yes
set api-ssl disabled=yes
set winbox port=8811
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/ipv6 nd
set [ find default=yes ] advertise-dns=yes
/system clock
set time-zone-name=Europe/Moscow
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

Конфиг точки:

# 2026-06-04 13:11:05 by RouterOS 7.18.2
# software id = IWAK-P5GH
#
# model = cAPGi-5HaxD2HaxD
# serial number = HK30AGQEK2K
/interface bridge
add name=bridge_LAN
/interface bridge port
add bridge=bridge_LAN interface=ether1
add bridge=bridge_LAN interface=wifi1
add bridge=bridge_LAN interface=wifi2
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/interface wifi cap
set discovery-interfaces=bridge_LAN enabled=yes
/interface wifi capsman
set package-path="" require-peer-certificate=no upgrade-policy=none
/ip dhcp-client
add interface=bridge_LAN
/system clock
set time-zone-name=Europe/Moscow
/system note
set show-at-login=no

Comments

[Dieman666]

капсман это что-то от лукавого)

[romaro]

Dieman666, а как еще на микротиках настроить бесшовный вайфай?

[Dieman666]

romaro,
делать вайфай не не микротиках)

Answer 1

[Пума Тайланд]

А на wifi1/wifi2 самой точки стоит configuration.manager=capsman-or-local? В RouterOS 7 с wifi-qcom это нужно прописать явно — без этого CAP-режим включён, но интерфейсы не переходят в slave.

Заодно версии выровняй (контроллер 7.23.1, CAP 7.18.2).

Comments

[romaro]

Спасибо за помощь! Проблема действительно была в этом конфиге - точки встали под управление. Правда устройства их все равно не видят... Возможно потому, что у них не прописался SSID:


При том, что в конфигурации у меня идентификатор точек прописан:


Антены я кстати включил вручную (по умолчанию они вроде как все отключены):


Профиль безопасности в конфиге выбран:


Сам профиль выглядит так:

[Пума Тайланд]

да, вот оно: provisioning-rule тянет 2GHz-конфиг на оба радио — 5GHz не знает что вещать. Добавь отдельный конфиг для 5GHz и два provisioning rule по band.

Answer 2

[Юрий MikroTik]

system > reset > caps mode и она сама все сделает если контроллер в той же L2