Organizing a unified wireless space in a home or office often faces the problem of connection drops when moving between rooms. Users are accustomed to mobile internet coverage everywhere and are unwilling to tolerate constant reconnections when moving from the living room to the bedroom. Standard repeaters only extend the coverage area but create a separate network or introduce latency, while seamless roaming ensures continuity of the communication session.
In the ecosystem Mikrotik This task is accomplished through CAPsMAN (Controlled Access Point System Manager) technology. This is a centralized access point management system that enables the creation of a unified logical network from multiple physical devices. Client devices perceive the entire infrastructure as a single point, which is critical for IP telephony, video calls, and online gaming.
Implementing a seamless network requires not only proper physical installation of equipment, but also fine-tuning of radio channel parameters using software. RouterOS Offers flexible tools for managing signal strength, security standards, and fast switching protocols. Understanding these processes will help avoid common pitfalls when devices get stuck on a remote access point with a weak signal.
CAPsMAN operating principles and equipment requirements
CAPsMAN technology is based on the separation of roles between the managing controller and the managed access points. The controller can be run on any device that supports Wireless or Capsman packets, including conventional routers of the hAP or RB series. Access points in this mode operate in CAP mode, receiving configuration and transmitting traffic through tunnels or locally.
To build an effective network, it's important to consider equipment compatibility. Older models with chips AR9xxx may not support all features of modern standards, such as 802.11ac or traffic acceleration. It is recommended to use devices of the wAP, cAP or LHG to ensure stable operation at 2.4 and 5 GHz frequencies.
- 📡 Centralization: All WiFi settings are applied automatically at all points, eliminating human error when scaling.
- ⚡ Seamlessness: The 802.11r/k/v protocols allow the client to quickly switch between access points without re-authorization.
- 🔒 Safety: Unified access policy and the ability to isolate clients at the radio channel level.
⚠️ Attention: When using CAPsMAN in "Local Forwarding" mode, traffic does not go through the controller, which reduces the load on the CPU, but requires proper VLAN configuration on the switches.
The network architecture should be designed with all access points in the same broadcast domain (L2). If the controller and access points are separated by routers, tunnels must be established or specific discovery settings must be used, which complicates the design. For most home and office scenarios, a flat network is sufficient.
Infrastructure preparation and software updates
Before you begin setup, make sure all your devices are running the latest version. RouterOS. In the latest versions of the system (v7 and newer) the package wifi was completely rewritten, and the old package wireless It's considered obsolete for new chips. Checking versions and updating is the first step to stable operation.
It's necessary to reset the configuration on devices that will act as access points (CAPs) to factory defaults. This ensures that there are no conflicts with old firewall or NAT rules that could interfere with CAPsMAN tunnels. After the reset, the device is ready to accept configuration from the controller.
☑️ Equipment preparation
Proper IP addressing is essential. The CAPsMAN controller and all access points require static IP addresses or reserved addresses via DHCP. Dynamically changing an access point's IP address can result in the management tunnel being broken and loss of client connectivity.
Setting up CAPsMAN Manager on the main router
The setup begins with activating the CAPsMAN service in the menu Wireless or Wifi (depending on the OS version). In the section CapsMan You need to enable the service and specify the interfaces on which to search for access points. By default, discovery is performed via broadcast packets on the local network.
The next step is to create configuration profiles (Configuration). Here, the SSID parameters, operating mode, channel, and power are determined. It is critical to create a separate profile for each frequency (2.4 GHz and 5 GHz), as the channel parameters differ between them.
/caps-man channeladd band=2ghz-n width=20/40mhz name="channel-2g"
add band=5ghz-n/ac width=20/40/80mhz name="channel-5g"
/caps-man security
add name="sec-wpa2" authentication-types=wpa2-psk mode=dynamic-key passphrase="YourStrongPassword"
/caps-man configuration
add name="cfg-2g" channel="channel-2g" security="sec-wpa2" ssid="MyNetwork_2G"
add name="cfg-5g" channel="channel-5g" security="sec-wpa2" ssid="MyNetwork_5G"
After creating configurations, they need to be linked to rules (Provisioning). Rules determine which configuration applies to which access point. Macros can be used to automatically select settings based on the device model or MAC address.
Power and channel adjustment for seamless roaming
The most common mistake when building WiFi networks is setting the transmitter power on all access points to maximum. This results in the client device "seeing" a farther access point with a strong signal and not switching to a closer one, even though the connection speed drops. This results in a "sticky client."
To achieve true seamless roaming, transmitter power must be reduced. Indoors, 10-15 dBm for 5 GHz and 10-12 dBm for 2.4 GHz is sufficient. This will create clear cell boundaries and force the client device to search for a new access point when signal strength declines.
| Parameter | Recommended value (room) | Recommended value (open space) | Impact on roaming |
|---|---|---|---|
| 2.4 GHz power | 10-12 dBm | 15-17 dBm | High power "holds" the client |
| 5 GHz power | 14-16 dBm | 20-23 dBm | Optimal for speed |
| Channel width | 20 MHz (2.4), 40/80 (5) | 40 MHz (2.4), 80/160 (5) | Affects the noise level |
| Min. signal | -75 dBm | -70 dBm | Disables weak clients |
Using the parameter min-signal In the CAPsMAN configuration, you can forcefully disconnect clients whose signal strength drops below a certain threshold. This forces the device to immediately search for another access point, implementing active roaming.
802.11r, 802.11k, and 802.11v protocols
Modern IEEE standards play a key role in switching speed. Protocol 802.11r (Fast BSS Transition) allows the client to transmit authorization credentials before the switchover, reducing connection downtime to milliseconds. This is critical for VoIP and video conferencing.
Protocol 802.11k Provides the client with a list of neighboring access points and their channels. Instead of scanning all the channels in the air (which takes time and battery), the device immediately knows where to switch. The protocol 802.11v Allows the access point to recommend that the client move to another access point if the current one is overloaded.
⚠️ Attention: Some older devices (such as older printers and IoT lamps) may not function correctly with 802.11r enabled. In such cases, create a separate SSID without fast transition support for the gadgets.
IN Mikrotik These features are configured in the security profile or radio configuration. For 802.11r, a Mobility Domain ID must be specified. All access points in the same roaming zone must have the same ID.
/caps-man securityadd name="sec-fast" authentication-types=wpa2-psk mode=dynamic-key \
passphrase="SecretPass" ft-mode=fact \
ft-preserved-group-membership=yes \
mobility-domain="a1b2"
/caps-man configuration
add name="cfg-seamless" security="sec-fast" ssid="SeamlessWiFi" \
hide-ssid=no installation=indoor country="no_country_set"
What is Mobility Domain?
This is the identifier of a group of access points between which fast roaming is allowed. The client sees them as a single logical network. If the IDs don't match at different access points, fast roaming won't work.
Diagnosing and troubleshooting shifting problems
Even with proper configuration, situations may arise where clients fail to switch or lose connection. The first diagnostic tool is the CAPsMAN log file. The logs display connection and disconnection events, along with the reasons for the disconnection (e.g., "disassociated due to low signal").
Use utilities on client devices (eg. WiFi Analyzer on Android or Wireless Diagnostics (on macOS) to view the actual signal strength (RSSI) and switching time. A normal switching time with 802.11r support is considered to be in the range of 50-150 ms.
- 🔍 Checking logs: Look for "caps,info" entries in the controller's system log.
- 📶 Spectrum analysis: Make sure your neighbors are not using the same channels, causing interference.
- 🔄 Speed test: Run ping with a continuous request (-t) and move around the room. One or two lost packets are acceptable with perfect roaming.
If the client is stuck on a distant access point, try temporarily disabling the nearby access point. If the client doesn't switch even when the signal from the nearest access point completely disappears (until the connection is lost completely), the problem may be with the client drivers or the minimum signal settings.
Why doesn't my iPhone switch to the nearest Mikrotik access point?
Apple devices are known for their conservative roaming algorithm. They prefer to hold on to a current access point until the last possible moment. To improve the situation, ensure 802.11k/v/r is enabled and transmitter power is reduced so that the coverage area of each access point is clearly limited by walls.
Do I need to purchase a license for CAPsMAN?
No, CAPsMAN functionality is built into RouterOS for free. A license is required only for the RouterOS operating system itself (level 4 and higher for multi-client support), but there is no separate fee for using the controller.
Is it possible to combine points of different models into one network?
Yes, CAPsMAN allows you to combine different models (for example, cAP ac and wAP ac) into a single network. The main thing is that they support the required standards (for example, 802.11ac) and have the latest firmware.