CAP Configuration and Security

What it is

CAP configuration is the small set of settings that turns an access point into a CAP and secures its link to the manager.

The CAP needs very little local setup. Most of the wireless settings come from the manager, so the main task is to make the link trusted.

Security here means two things: the control link between the CAP and the manager, and the security profile that protects the wireless clients.

How it works

The CAP identifies itself with a certificate, and the manager decides whether to trust it.

Basic CAP settings

/interface wifi cap set enabled=yes discovery-interfaces=ether1 certificate=request lock-to-caps-man=no
/interface wifi cap print

• enabled turns on the CAP function.
• discovery-interfaces and caps-man-addresses tell the CAP where to look for a manager.
• certificate decides how the CAP gets a certificate, and request asks the manager to provide one.
• lock-to-caps-man limits the CAP to the manager it first joined.

Once a CAP is enabled, its radios are normally controlled by the manager and take their wireless settings from it.

Why certificates

The control link carries the settings of the whole wireless network. If an attacker could pose as a manager or as a CAP, they could change the SSIDs, turn off security or read client data.

Certificates let each side prove who it is. They also allow the link to be encrypted.

The manager side

The manager has a certificate authority (CA) and a certificate of its own.

/interface wifi capsman set enabled=yes ca-certificate=auto certificate=auto require-peer-certificate=no

• ca-certificate is the authority that signs CAP certificates, and auto lets the manager create one.
• certificate is the certificate that the manager presents to CAPs.
• require-peer-certificate makes the manager insist that every CAP shows a valid certificate.

With require-peer-certificate=no, a CAP can join without a certificate. This is easy for a first setup, but it is weaker. For a production network, turn it on once the CAPs have certificates.

How the CAP gets its certificate

When the CAP is set to request, it asks the manager for a certificate during the join. The manager signs it with its CA. The CAP can then prove its identity on later connections.

You can also create and install certificates yourself. This is useful when you use your own certificate authority.

Checking the manager from the CAP

The CAP can verify the manager it joins. Settings such as the allowed manager names or the manager certificate names restrict which managers the CAP trusts.

Use them together with lock-to-caps-man. The CAP then joins only the manager that you expect.

Time

Certificates are valid for a period. If a CAP or a manager has the wrong clock, the certificate can look invalid and the link fails.

Use a time source such as NTP on the manager and the CAPs.

Upgrades

A manager can be set to check the RouterOS packages of its CAPs.

• upgrade-policy on the manager decides whether it only suggests an upgrade or requires the same version.
• package-path names the place on the manager where the packages are stored.

Keeping manager and CAPs on matching versions avoids problems, because the two sides must understand each other.

Protecting the management network

The control link should run on a network that clients cannot reach.

• Put the CAPs and the manager on a management VLAN.
• Do not let the client SSIDs share that VLAN.
• Limit the manager interfaces so it answers only on the management side.
• Use a firewall to allow the CAP traffic only from known addresses.

Security of the clients

The security profile for the wireless clients is a different thing. It is part of the configuration that the manager sends, and the next pages cover it. The control link and the client security must both be set correctly.