Centralized WiFi Management with MikroTik CAPsMAN

Configuring a 10-AP network one device at a time, and then maintaining it, does not scale. Need to change the SSID password? Log into 10 devices one by one. CAPsMAN solves this problem: all APs are managed from a central controller, and changes propagate across the whole network within seconds. CAPsMAN centralizes the wireless layer; to manage your entire device fleet (routers, switches, and firewalls included) programmatically rather than one by one, take a look at the bulk device management with the RouterOS API approach.

CAPsMAN Architecture

[CAPsMAN Manager: RB4011]
          |
    [Layer 2/3 Network]
     /    |    \
  [CAP1] [CAP2] [CAP3]
  hAP ac² hAP ac² hAP ac²

Component	Role
CAPsMAN Manager	Configuration center; manages all APs
CAP (Controlled Access Point)	Managed AP; has no config of its own, receives it from the manager
Provisioning	Determines which CAP receives which configuration
Configuration	Radio, security, and datapath settings
Datapath	How traffic is forwarded: locally or through the manager

CAPsMAN v1 vs v2

Feature	v1	v2
RouterOS support	6.x	6.40+
802.11r (fast roaming)	❌	✅
Multiband (2.4+5 GHz)	Separate config	Unified
Channel committee	❌	✅
Datapath	Basic	Advanced

If you are on RouterOS 7, v2 comes automatically. There is no reason to choose v1 for a new deployment.

---

Scenario: 3-Floor Office, 10 APs

• Floor 1: 4 APs (entrance + meeting rooms)
• Floor 2: 3 APs (open office)
• Floor 3: 3 APs (management + server room entrance)
• SSIDs: Office-Staff (VLAN 30) + Office-Guest (VLAN 40)
• Manager: RB4011 (floor 1, network room)

---

Manager Setup

Step 1: Check the CAPsMAN Package

# CAPsMAN is built in on RouterOS 7
/caps-man manager print
# If it reads "enabled: no", enable it:
/caps-man manager set enabled=yes

Step 2: Manager Interface

The manager needs to know which interface to listen for CAPs on:

/caps-man manager interface
add interface=bridge-main disabled=no
# To listen on all interfaces:
# add interface=all disabled=no

Step 3: Security Profile

/caps-man security
add name=sec-staff \
    authentication-types=wpa2-psk \
    passphrase="AStrongPassword2026!" \
    comment="Staff WiFi security profile"

add name=sec-guest \
    authentication-types=wpa2-psk \
    passphrase="GuestPassword2026" \
    comment="Guest WiFi security profile"

Step 4: Datapath Profiles

Local forwarding: Traffic passes directly from the AP to the switch. The manager is not involved. VLAN is handled by the switch/router.

Manager forwarding: All traffic is forwarded by opening a tunnel to the manager. Used to apply central policy.

/caps-man datapath
add name=dp-staff \
    bridge=bridge-main \
    vlan-id=30 \
    vlan-mode=use-tag \
    local-forwarding=yes \
    comment="Staff: local forward, VLAN 30"

add name=dp-guest \
    bridge=bridge-main \
    vlan-id=40 \
    vlan-mode=use-tag \
    local-forwarding=yes \
    comment="Guest: local forward, VLAN 40"

Step 5: Channels

/caps-man channel
add name=ch-2.4ghz-1 frequency=2412 band=2ghz-b/g/n width=20mhz
add name=ch-2.4ghz-6 frequency=2437 band=2ghz-b/g/n width=20mhz
add name=ch-2.4ghz-11 frequency=2462 band=2ghz-b/g/n width=20mhz
add name=ch-5ghz-36 frequency=5180 band=5ghz-a/n/ac width=80mhz
add name=ch-5ghz-100 frequency=5500 band=5ghz-a/n/ac width=80mhz
add name=ch-5ghz-149 frequency=5745 band=5ghz-a/n/ac width=80mhz

Practical: Assign non-overlapping channels to adjacent APs. On 2.4 GHz, only 1-6-11 do not overlap. On 5 GHz there are more channel options.

Step 6: Configurations

/caps-man configuration

# Staff 5 GHz
add name=cfg-staff-5g \
    ssid="Office-Staff" \
    security=sec-staff \
    datapath=dp-staff \
    channel=ch-5ghz-36 \
    rates.ht-basic-mcs="mcs-0,mcs-1,mcs-2" \
    comment="Staff 5 GHz"

# Staff 2.4 GHz (for older devices)
add name=cfg-staff-24g \
    ssid="Office-Staff" \
    security=sec-staff \
    datapath=dp-staff \
    channel=ch-2.4ghz-1 \
    comment="Staff 2.4 GHz"

# Guest 2.4 GHz (rate limit in the datapath)
add name=cfg-guest-24g \
    ssid="Office-Guest" \
    security=sec-guest \
    datapath=dp-guest \
    channel=ch-2.4ghz-6 \
    comment="Guest 2.4 GHz"

Step 7: Provisioning

Provisioning determines which CAP receives which configuration. You can match on MAC address, IP range, or a name pattern:

/caps-man provisioning

# General rule for all APs: both 2.4 and 5 GHz
add action=create-dynamic-enabled \
    master-configuration=cfg-staff-5g \
    slave-configurations=cfg-staff-24g,cfg-guest-24g \
    comment="All APs: staff 5G master, staff+guest 2.4G slave"

---

CAP Side Setup

To be done on each AP:

# Put the AP into CAPsMAN mode
/interface wireless
set [ find ] mode=ap-bridge

/caps-man client
set enabled=yes

Or more simply: in the AP’s WinBox, Wireless tab → CAP → manager IP or broadcast discovery.

Discovery Method

CAPs find the manager in two ways:

1. Layer 2 broadcast: If it is on the same L2 network, it finds the manager automatically, with no extra configuration
2. IP discovery: If it is on a different network, enter the manager IP manually

# Specify the manager IP on the CAP side
/caps-man client
set enabled=yes manager-ip-addresses=192.168.88.1

Once the manager connection is established, the AP’s existing configuration is wiped and a new configuration is applied according to the provisioning rule.

---

Roaming Optimization

802.11r (Fast BSS Transition)

A device does not have to re-authenticate when moving between APs. Critical for VoIP and video conferencing:

/caps-man security
set [find name=sec-staff] ft=yes ft-over-ds=yes

Minimum Signal Threshold

Devices tend to “stick” to the current AP; they stay connected on a weak signal and speed drops. A minimum signal threshold forces the AP to drop the connection, so the device connects to a better AP:

/caps-man configuration
set [find name=cfg-staff-5g] \
    disconnect-timeout=3s \
    hw-retries=3 \
    comment="For aggressive roaming"

Band Steering

Steer devices that support both 2.4 and 5 GHz toward 5 GHz:

/caps-man configuration
set [find name=cfg-staff-24g] \
    keepalive-frames=disabled \
    comment="2.4 GHz: push 5G-capable devices away"

Provide the 5 GHz configuration first (as the master during provisioning). Devices that support 5 GHz connect there, while those that do not fall back to 2.4 GHz.

---

Datapath: Local vs Manager Forwarding

	Local Forwarding	Manager Forwarding
Where does traffic go?	Directly to the switch	Opens a tunnel to the manager
Latency	Low	Slightly higher
CPU load (manager)	Low	High
Central policy	Hard	Easy
Client isolation	Via network design	Easy on the manager

When local forwarding?

• All APs are on the same L2 network
• The VLAN structure can be handled on the switch side
• High bandwidth is needed (video conferencing, file transfer)

When manager forwarding?

• Security policies must be applied centrally
• Client isolation (devices on the same SSID must not see each other)
• APs connected to different locations over tunnels

---

Common Problems

“The CAP cannot find the manager”

# Check the manager log
/log print where topics~"caps"
# Check the CAP log
/log print where topics~"caps"

# Is broadcast discovery working on Layer 2?
/caps-man remote-cap print
# Does the CAP appear in the list?

Common causes:

• The manager interface is not defined correctly
• The CAP and manager are on different VLANs (L2 broadcast does not reach)
• The firewall is blocking UDP ports 5246/5247

/ip firewall filter
add chain=input action=accept protocol=udp dst-port=5246,5247 \
    comment="CAPsMAN ports"

“The same channel was assigned to all APs”

Check the provisioning rules. Manage channel assignment either manually or with automatic channel selection:

/caps-man channel
add name=auto-5g band=5ghz-a/n/ac extension-channel=Ce \
    reselect-interval=1h comment="Automatic channel selection"

“Connected devices cannot get an IP”

Is the VLAN setting in the datapath correct? Is the switch port the AP connects to configured as a trunk?

# See connected clients on the manager
/caps-man registration-table print
# Is there an IP address? Is the VLAN correct?

---

Monitoring and Maintenance

# List connected CAPs
/caps-man remote-cap print

# All connected WiFi clients
/caps-man registration-table print

# Reboot a specific AP
/caps-man remote-cap reboot [find name=cap1]

# Force configuration onto all APs
/caps-man remote-cap provision

Practical tip: Give each AP a descriptive name, such as cap-floor1-entrance or cap-floor2-meeting. It becomes much easier to tell what is where in the remote-cap print output. Trying to identify an AP by its MAC address wastes time in the field.