Manual:CAPsMAN with VLANs
It is possible to create centralized Access Point management setup for home or office environment that is scalable to many Access Point, such a setup is quite easy to configure and has been explained in the Simple CAPSMAN setup guide, but for more complex setups VLANs might be required. CAPsMAN has a functionality to assign a certain VLAN ID under certain conditions. This guide will provide an example how assign a VLAN ID to Wireless packets based on the AP, to which a Wireless client connects to. CAPsMAN with VLANs can be achieved either by using Local Forwarding Mode or CAPsMAN Forwarding Mode, the Local Forwarding Mode will provide the possibility to use a switch between your APs and CAPsMAN router to switch packets (to achieve larger throughput), while CAPsMAN Forwarding Mode should be used when all traffic should always be forwarded to the CAPsMAN router (in most cases to filter packets).
Here we are going to assign all our Wireless clients to VLAN10, if they connect to WiFi_WORK, and going to assign Wireless clients to VLAN20, if they connect to WiFi_GUEST. We are going to use CAPsMAN provisioning rules to assign proper SSID to each Access Point (AP) by checking the AP's identity.
Using Local Forwarding Mode
- Create appropriate CAP configurations for each VLAN
/caps-man configuration add country=latvia datapath.local-forwarding=yes datapath.vlan-id=10 datapath.vlan-mode=use-tag name=Config_WORK security.authentication-types=wpa-psk,wpa2-psk \ security.passphrase=secret_work_password ssid=WiFi_WORK add country=latvia datapath.local-forwarding=yes datapath.vlan-id=20 datapath.vlan-mode=use-tag name=Config_GUEST security.authentication-types=\ wpa-psk,wpa2-psk security.passphrase=secret_guest_password ssid=WiFi_GUEST
- We will assign the "WORK" configuration, if the identity starts with "AP_WORK_*" and will assign the "GUEST" configuration, if the identity starts with "AP_GUEST_*", this can be done by using CAPsMAN provisioning rules
/caps-man provisioning add action=create-dynamic-enabled identity-regexp=^AP_GUEST_ master-configuration=Config_GUEST add action=create-dynamic-enabled identity-regexp=^AP_WORK_ master-configuration=Config_WORK
- For security reasons, limit the CAPsMAN to a single interface
/caps-man manager interface set [ find default=yes ] forbid=yes add disabled=no interface=ether1
- Enable the CAPsMAN manager
/caps-man manager set enabled=yes
- Setup DHCP Server for each VLAN
/interface vlan add interface=ether1 name=VLAN10 vlan-id=10 add interface=ether1 name=VLAN20 vlan-id=20 /ip address add address=192.168.10.1/24 interface=VLAN10 add address=192.168.20.1/24 interface=VLAN20 /ip pool add name=dhcp_pool10 ranges=192.168.10.2-192.168.10.254 add name=dhcp_pool20 ranges=192.168.20.2-192.168.20.254 /ip dhcp-server add address-pool=dhcp_pool10 disabled=no interface=VLAN10 name=dhcp10 add address-pool=dhcp_pool20 disabled=no interface=VLAN20 name=dhcp20 /ip dhcp-server network add address=192.168.10.0/24 dns-server=220.127.116.11 gateway=192.168.10.1 add address=192.168.20.0/24 dns-server=18.104.22.168 gateway=192.168.20.1
In this example we are going to be using Bridge VLAN Filering to filter unknown VLANs and to assign other devices to the same networks. Some devices are capable of offloading this to the built-in switch chip, check Basic VLAN switching guide to see how to configure it on different types of devices.
- Setup Bridge VLAN Filtering
/interface bridge add name=bridge1 vlan-filtering=yes /interface bridge port add bridge=bridge1 interface=ether1 add bridge=bridge1 interface=ether2 add bridge=bridge1 interface=ether3 add bridge=bridge1 interface=ether4 pvid=10 add bridge=bridge1 interface=ether5 pvid=20 /interface bridge vlan add bridge=bridge tagged=ether1,ether2,ether3 untagged=ether4,ether5 vlan-ids=10,20
- Create a bridge and assign a port to it, that is connect to the CAPsMAN Router
/interface bridge add name=bridge1 /interface bridge port add bridge=bridge1 interface=ether1
- Enable CAP mode on the AP, make sure you specify to use the newly created bridge
/interface wireless cap set bridge=bridge1 discovery-interfaces=bridge1 enabled=yes interfaces=wlan1
That is it! Connect Wireless clients to your APs and check connectivity.