CAPsMAN контроллер для управления точками доступа Mikrotik

В Mikrotik ROS 6.11 появился дополнительный пакет wireless-fp - Wireless CAPsMAN для mipsbe - Wireless CAPsMAN и tile - CCR series Wireless CAPsMAN включающий функционал CAPsMAN (контроллер управления для любых беспроводных точек доступа MikroTik).

Настраиваем CAPsMAN

полностью стираем конфигурацию роутера включая конфигурацию по умолчанию

берем конфигурацию роутера из beta для продвинутых пользователей

включаем функционал контроллера

задаем параметры беспроводного интерфейса конфигурации контроллера

задаем параметры безопасности конфигурации контроллера

bridge -- bridge interface to add interface to, as a bridge port, when enabled
bridge-cost -- bridge port cost to use when adding as bridge port
bridge-horizon -- bridge horizon to use when adding as bridge port
client-to-client-forwarding -- controls if client-to-client forwarding between wireless clients connected to interface should be allowed, in local forwarding mode this function is performed by CAP, otherwise it is performed by CAPsMAN.
local-forwarding -- controls forwarding mode
openflow-switch -- OpenFlow switch to add interface to, as port when enabled
vlan-id -- VLAN ID to assign to interface if vlan-mode enables use of VLAN tagging
vlan-mode -- VLAN tagging mode specifies if VLAN tag should be assigned to interface (causes all received data to get tagged with VLAN tag and allows interface to only send out data tagged with given tag)

In this mode wireless interface on CAP behaves as a normal interface and takes part in normal data forwarding. Wireless interface will accept/pass data to networking stack on CAP. CAPsMAN will not participate in data forwarding and will not process any of data frames, it will only control interface configuration and client association process.

создаем конфигурацию контроллера включающую предыдущие параметры

• channel - channel related settings, such as frequency and width
• datapath - data forwarding related settings, such as bridge to which particular interface should be automatically added as port
• interworking - IEEE 802.11u, Hotspot 2.0 related settings
• security - security related settings, such as allowed authentication types or passphrase
• configuration - main wireless settings group, includes settings such as SSID, and additionally binds together other setting groups - that is, configuration profile can refer to channel, security, etc. named setting groups. Additionally any setting can be overridden directly in configuration profile.

включаем поиск контроллером точек доступа (CAP)

Настройка списка доступа /caps-manager access-list

правила в нем обрабатываются в порядке очередности, последнее правило запрещает все что не в списке доступа

• client matching parameters:
  • address - MAC address of client
  • mask - MAC address mask to apply when comparing client address
  • interface - optional interface to compare with interface to which client actually connects to
  • time - time of day and days when rule matches
  • signal-range - range in which client signal must fit for rule to match
• action parameter - specifies action to take when client matches:
  • accept - accept client
  • reject - reject client
  • query-radius - query RADIUS server if particular client is allowed to connect
• connection parameters:
  • ap-tx-limit - tx speed limit in direction to client
  • client-tx-limit - tx speed limit in direction to AP (applies to RouterOS clients only)
  • client-to-client-forwarding - specifies whether to allow forwarding data received from this client to other clients connected to the same interface
  • private-passphrase - PSK passphrase to use for this client if some PSK authentication algorithm is used
  • radius-accounting - specifies if RADIUS traffic accounting should be used if RADIUS authentication gets done for this client
  • vlan-mode - VLAN tagging mode specifies if traffic coming from client should get tagged (and untagged when going to client).
  • vlan-id - VLAN ID to use if doing VLAN tagging.

Настройки точки доступа - CAPs

/system-reset no-defaults=yes

полностью стираем конфигурацию роутера включая конфигурацию по умолчанию

модель роутера может быть любой

вариант когда точка и контроллер — это одно устройство

вариант когда точка и контроллер — это разные устройства