...

Overview Overview 

CAPsMAN allows applying wireless settings to multiple MikroTik AP devices from a central configuration interface.

...

Depending on the configuration, data is either forwarded to CAPsMAN for centralized processing (default) or forwarded locally at the CAP itself (local forwarding mode).

...

...

Starting from RouterOS v6.22rc7 a different CAPsMAN implementation is used, it is not compatible with older versions

Requirements

• Any RouterOS device can be a controlled wireless access point (CAP) as long as it has at least a Level 4 RouterOS license
• CAPsMAN server can be installed on any RouterOS device, even if the device itself does not have a wireless interface
• Unlimited CAPs (access points) supported by CAPsMAN
• 32 Radios per CAP maximum
• 32 Virtual interfaces per master radio interface maximum
• Not possible to use Nv2 and NStreme proprietary protocols

...

Simple setup of a CAPsMAN system

Image Modified

Before deep-diving into the details of CAPsMAN operation, let us quickly illustrate how to set up the most basic system where you have a MikroTik router that manages two MikroTik AP devices. The benefit of CAPsMAN is that the CAP units don't need to be configured, all settings are done in the CAPsMAN server.

...

In the central device, which will be your CAPsMAN server, create a new "Configuration" template with only the basic settings (network name, country, the local LAN bridge interface, the wireless password):

1.Image Modifiedadd new configuration profile 2.Image Modified 3.Image Modified

Then create a new "Provisioning" rule, which will assign the created configuration template to the CAP devices:

4. Image Modified

All that remains to do on the CAPsMAN, is to enable it:

5. Image Modified

Most MikroTik AP devices already support CAP mode out of the box, all you need to do, is make sure they are on the same network as your CAPsMAN, and then boot them up, while holding the reset button.

...

Note that CAP can be manually "locked" to CAPsMAN by setting caps-man-certificate-common-names.

Auto Certificates

To simplify CAPsMAN and CAP configuration when certificates are required (e.g. for automatic locking feature), CAPsMAN can be configured to generate necessary certificates automatically and CAP can be configured to request certificate from CAPsMAN.

...

CAP behavior of AP is configured in /interface wireless cap menu. It contains the following settings:From there you can:

• Disable or enable CAP feature on the device
• Set list of wireless interfaces to be controlled by Manager
• Set list of interfaces over which CAP should attempt to discover Manager
• Set list of Manager IP addresses that CAP will attempt to contact during discovery
• Set list of Manager names that CAP will attempt to connect
• Set list of Manager certificate CommonNames that CAP will connect to
• Set bridge to which interfaces should be added when local forwarding mode is used

Each wireless interface on a CAP that is under CAPsMAN control appears as a virtual interface on the CAPsMAN. This provides maximum flexibility in data forwarding control using regular RouterOS features, such as routing, bridging, firewall, etc.CAPsMAN Configuration Concepts

Many wireless interface settings are able to be grouped together into named groups (Each wireless interface on a CAP that is under CAPsMAN control appears as a virtual interface on the CAPsMAN. This provides maximum flexibility in data forwarding control using regular RouterOS features, such as routing, bridging, firewall, etc.CAPsMAN Configuration ConceptsMany wireless interface settings are able to be grouped together into named groups ('profiles') that simplifies the reuse of configuration - for example, common configuration settings can be configured in a 'configuration profile' and multiple interfaces can then refer to that profile. At the same time any profile setting can be overridden directly in an interface configuration for maximum flexibility.

...

...

• client matching parameters:
  • address - MAC address of clientMAC address of client (or, if mask is specified, only those parts will be checked as per the mask, so to match vendor D8 from "D8:1C:79:6E:1E:FE", simply enter a bogus entry, such as "D8:00:00:00:00" and then use the mask as per next line)
  • mask - MAC address mask to apply when comparing client address. For example, use FF:00:00:00:00:00 to match only the first octet of the specified MAC address. In above example, regardless of entered MAC, it will match only first octet. Similarly, entering 00:00:00:00:FF will only match the last octet (FE) of a hypotetical MAC "D8:1C:79:6E:1E:FE"). So in the mac line, you could just enter 00:00:00:00:00:FE, if you would use such a mask. 
  • interface - optional interface to compare with interface to which client actually connects to
  • time - time of day and days when rule matches
  • signal-range - range in which client signal must fit for rule to match
• action parameter - specifies action to take when client matches:
  • accept - accept client
  • reject - reject client
  • query-radius - query RADIUS server if particular client is allowed to connect
• connection parameters:
  • ap-tx-limit - tx speed limit in direction to client
  • client-tx-limit - tx speed limit in direction to AP (applies to RouterOS clients only)
  • client-to-client-forwarding - specifies whether to allow forwarding data received from this client to other clients connected to the same interface
  • private-passphrase - PSK passphrase to use for this client if some PSK authentication algorithm is used
  • radius-accounting - specifies if RADIUS traffic accounting should be used if RADIUS authentication gets done for this client
  • vlan-mode - VLAN tagging mode specifies if traffic coming from client should get tagged (and untagged when going to client).
  • vlan-id - VLAN ID to use if doing VLAN tagging.

...