CAPsMAN v2 · Topic 5 of 6
CAP Interface Provisioning
Learn how CAPsMAN v2 provisioning rules match CAP radios and create dynamic wireless interfaces from configuration profiles, and how rule order matters.
- 5 min
- Includes a diagram
- A provisioning rule matches a radio and tells the manager what to do with it.
- Rules can match
radio-mac,identity-regexpandsupported-bands. create-dynamic-enabledcreates a dynamic interface that exists while the CAP is connected.
What it is
Provisioning is the step where the manager decides which configuration each CAP radio receives and creates the interface for it.
A provisioning rule describes a type of radio, and says what to do with it. When a joined CAP has a radio that matches the rule, the manager applies the rule.
Without a rule, a CAP can be connected to the manager and still have no working wireless interface.
How it works
The manager compares each radio with the rules, from the top of the list down.
What a rule contains
A provisioning rule has two parts: what to match and what to do.
| Part | Parameters | Meaning |
|---|---|---|
| Match | radio-mac, identity-regexp, supported-bands | Which radios the rule applies to |
| Action | action | What the manager does with a matching radio |
| Configuration | master-configuration, slave-configurations | Which profiles the radio receives |
The match options can be combined. A radio must satisfy all the options that you set.
Matching options
radio-macmatches one radio by its MAC address.identity-regexpmatches the identity name of the CAP with a regular expression.supported-bandsmatches the bands that the radio can use, such as 2.4 GHz or 5 GHz.
Matching by band is the most common way to give 2.4 GHz and 5 GHz radios different configurations. Matching by identity lets you treat a group of CAPs, such as those on one floor, differently.
If you leave an option empty, it matches everything.
Actions
| Action | Result |
|---|---|
create-enabled | Creates a permanent interface and enables it |
create-disabled | Creates a permanent interface and leaves it disabled |
create-dynamic-enabled | Creates a dynamic interface that exists while the CAP is connected |
none | Does nothing with the radio |
create-dynamic-enabled is the usual choice. The interface follows the configuration, and you manage the network by editing profiles and rules.
Example rules
/interface wifi provisioning add action=create-dynamic-enabled supported-bands=2ghz-ax master-configuration=cfg-2g
/interface wifi provisioning add action=create-dynamic-enabled supported-bands=5ghz-ax master-configuration=cfg-5g slave-configurations=cfg-guest
/interface wifi provisioning print- The first rule gives every 2.4 GHz radio the
cfg-2gconfiguration. - The second rule gives every 5 GHz radio the
cfg-5gconfiguration and adds a guest SSID as a slave. printlists the rules in the order that the manager checks them.
The band names in your rules must match what the radios support. The names depend on the hardware and the wireless standards of the radio.
Order of the rules
The manager checks the rules from top to bottom and uses the first one that matches. Later rules are not used for that radio.
Put the specific rules first and the general rules last. A rule for one CAP name or MAC address should come before a rule for all 5 GHz radios.
A broad rule at the top of the list can hide every rule below it. If a radio gets the wrong configuration, check the order first.
Dynamic interfaces
When a rule applies, a dynamic interface appears in the interface list of the manager. It is marked as dynamic in the list, and it disappears when the CAP leaves if the action was create-dynamic-enabled.
You can use the dynamic interface in other settings, but you cannot change its wireless parameters directly. Change the configuration or the rule.
Reprovisioning
A change to a rule or a configuration does not always reach a CAP that is already running. The manager applies the new settings when the CAP is provisioned again, so you may need to let the CAP rejoin to see the change. Check your RouterOS version for the exact behaviour.
Checking the result
/interface wifi capsman remote-cap print
/interface wifi printremote-cap printshows the joined CAPs and their radios.printshows the interfaces, including the dynamic ones that the rules created.
If a radio has no interface, check that a rule matches it and that the action is not none.
Start with one rule per band and add specific rules only when a group of CAPs needs special treatment.
What to remember for the exam
Seven facts cover this topic.
- A provisioning rule matches a radio and tells the manager what to do with it.
- Rules can match
radio-mac,identity-regexpandsupported-bands. create-dynamic-enabledcreates a dynamic interface that exists while the CAP is connected.master-configurationgives the main SSID, andslave-configurationsadd extra SSIDs.- The manager checks the rules from top to bottom and uses the first match.
- Put specific rules above general rules.
- With no matching rule, the radio gets no managed interface.
Common mistakes
These four errors are common.
Broad rule first. It matches every radio and hides the specific rules below it.
No rule for a band. The radios of that band get no interface.
Editing the dynamic interface. Change the configuration or the rule instead.
Expecting an instant change. A running CAP may need to be provisioned again.
Check yourself
Work through these three questions.
What does a provisioning rule do?
It matches a CAP radio and tells the manager what to do with it, including which configuration to send and whether to create an interface.
Why does rule order matter?
The manager uses the first rule that matches. A broad rule at the top can hide the specific rules below it.
Which action creates an interface that exists only while the CAP is connected?
create-dynamic-enabled. It creates a dynamic interface from the configuration.
Topic 5 of 6 in CAPsMAN v2
Test yourself on CAPsMAN v2
The full MikroTik MTCEWE question bank has 476 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by MikroTik. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.