CAPsMAN Configuration Settings

What it is

CAPsMAN configuration settings are the profiles that describe how a managed radio should behave.

Instead of one long list of parameters, v2 splits the settings into small profiles by purpose. A configuration profile then ties them together and adds the SSID and the country.

Because the profiles are separate, you can reuse them. One security profile can serve many configurations, and one channel profile can serve many bands.

How it works

You build the small profiles first, and then you refer to them from a configuration.

The profiles

These menus belong to RouterOS v7 with the wifi driver. The original CAPsMAN used different menus under /caps-man.

Channel

The channel profile sets the band, the frequency and the width.

/interface wifi channel add name=ch5 band=5ghz-ax frequency=5180 width=20mhz

If you leave the frequency out, the radio chooses one itself. The width controls how much spectrum the radio uses, and a narrower width usually gives a cleaner channel in a crowded place.

Security

The security profile sets how clients authenticate and how the data is encrypted.

/interface wifi security add name=sec1 authentication-types=wpa2-psk,wpa3-psk passphrase=StrongPassphrase1

It can also hold the settings for fast roaming between access points. The security chapter explains the methods.

Datapath

The datapath profile controls how client traffic is handled.

/interface wifi datapath add name=dp1 bridge=bridge1 vlan-id=10 client-isolation=yes

• bridge is the bridge that the interface joins.
• vlan-id places the clients of that SSID in a VLAN.
• client-isolation stops clients of one access point from talking to each other.

A guest SSID usually has its own datapath with a guest VLAN and client isolation.

Steering

The steering profile holds the options that help clients to roam and to pick a better band or access point. They depend on the client supporting the matching standards. The RF chapter describes 802.11k and 802.11v.

The configuration profile

The configuration profile ties everything together.

/interface wifi configuration add name=cfg-office ssid=Office country=Germany channel=ch5 security=sec1 datapath=dp1

• ssid is the network name.
• country sets the regulatory rules, which the regulatory chapter covers.
• channel, security and datapath refer to the profiles by name.

You can also write the settings inside the configuration instead of referring to a named profile. Named profiles are better when several configurations need the same settings.

Applying a configuration

A configuration does nothing by itself. A provisioning rule selects it for a radio, and then the manager sends it. The next page covers the rules.

When you change a profile, the manager updates the radios that use it. Plan a change carefully, because clients can disconnect while the radios apply the new settings.

Master and slave configurations

A radio has one master configuration for its main interface. It can also have slave configurations that create extra SSIDs on the same radio, for example for guests.

Each extra SSID uses airtime for its own management traffic, so do not create more than you need.

Consistency across bands

Use the same SSID and security on 2.4 GHz and 5 GHz if clients should move freely between them. Use different channel profiles for each band, because the frequencies and widths are different.