Creating a stable wireless network in densely populated areas or large offices often becomes a complex engineering challenge. Users are accustomed to the idea of internet access "always and everywhere" on smartphones and tablets, but the standard setup with multiple independent access points doesn't ensure this. When a device moves from one access point's coverage area to another, the connection is lost, leading to dropped calls on instant messaging apps or buffered videos.
To solve this problem, engineers use technology seamless roaming (Seamless Roaming). In the ecosystem Mikrotik the central manager is responsible for this CAPsMAN (Controlled Access Point System Manager). It allows you to manage dozens of access points as a single unit, allowing client devices to seamlessly switch between them. However, simply enabling this feature doesn't guarantee perfect operation, as it requires proper configuration of the radio system and security policy.
Implementing such a system requires an understanding of the physics of radio wave propagation and the specifics of the 802.11 protocol. Design errors, such as incorrect antenna placement or channel selection, can negate the benefits of centralized management. Therefore, before configuring the software, it's essential to conduct a site audit and develop a hardware layout plan.
The main difficulty is that the decision to switch access points (roaming) is often made by the client device itself, not the infrastructure. The administrator's job is to create conditions (signal thresholds) that allow the device to "understand" it's time to move to another access point and do so quickly. Mikrotik provides powerful tools to control this process, but they require precise calibration of parameters.
⚠️ Attention: RouterOS interfaces are constantly being updated. Menu names and parameter locations may differ between v6 and v7. Always check the official documentation on the manufacturer's website before making changes to a running network.
Network construction principles and equipment selection
The foundation of any wireless network is the physical infrastructure. To ensure seamless coverage, simply purchasing several identical routers is not enough. You need equipment that supports wireless operation. CAP (Controlled Access Point). In the line Mikrotik these are the models of the series cAP, wAP, hAP (in AP mode) and RB with installed wireless communication interfaces.
A critical aspect is the bandwidth of the cable network. Since all traffic from client devices will be routed to a central router (CAPsMAN server) or switch, using the Gigabit Ethernet standard is mandatory. Older cables or switches with 100 Mbps speeds will become a bottleneck, even if the radio modules support higher speeds.
When planning coverage, keep in mind that access points should overlap each other but not interfere. The overlap zone should be sufficient to allow a device to locate an alternative point with a better signal before losing connection with its current one. However, excessive overlap will result in devices locking onto the farther point while ignoring the closer one.
Frequency band selection is also key. The 2.4 GHz band is suitable for passing through walls, but it's highly noisy. The 5 GHz band offers high speeds but is less effective at penetrating obstacles. To ensure high-quality seamless Wi-Fi, it's essential to use both bands, carefully balancing the load between them.
CAPsMAN Network Architecture and Server Preparation
The central element of the system is the management server, which is usually the most powerful router on the network. This is where the service runs. CAPsMANThe logical structure of the network is built so that all access points (CAPs) are in the same broadcast domain (L2) as the management server, or have routing to it.
The first step is to create a special bridge interface that will connect the wired and wireless network segments. RouterOS v7 The bridge has become a fully-fledged switch with hardware acceleration support, significantly simplifying configuration. All ports connected to access points and users must be added to this bridge.
/interface bridge
add name=bridge-local
/interface bridge port
add bridge=bridge-local interface=ether2
add bridge=bridge-local interface=ether3
Next, you need to configure a DHCP server that will assign IP addresses not only to clients but also to the access points themselves. The access points must receive an address automatically so that the management server can discover them. To do this, create an address pool and a DHCP server linked to the bridge created earlier.
Time settings are crucial. Security protocols like WPA2/WPA3 Enterprise are sensitive to time desynchronization. An NTP client should be configured on the server to ensure the time is consistent across all network devices. This will eliminate user authentication issues in corporate environments.
Setting up security profiles and configurations
After preparing the base, the actual configuration of the wireless part begins. In terminology Mikrotik The settings are divided into logical blocks: Datapath (data path), Security (security) and Configuration (configuration). This separation allows for the flexible application of different policies to different user groups.
The security profile specifies encryption parameters. For modern networks, the standard is to use the protocol WPA2/WPA3The access password is also specified here. Creating a separate security object allows you to apply the same password to multiple SSIDs (network names) without duplicating settings.
Next, a configuration is created that combines radio, security, and data path settings. This block specifies the SSID that users will see, the operating mode (AP Bridge), and frequency characteristics. This is the configuration that the server will push to connected access points.
⚠️ Attention: When using WPA3, ensure all client devices support it. Some older devices may stop connecting to the network if compatibility mode isn't configured correctly.
For guest access, it is recommended to create a separate configuration with client-to-client forwarding disabled. This will prevent random users from sharing files in a cafe or office, increasing overall network security.
Radio resource and channel management
One of the main functions CAPsMAN is the automatic distribution of frequency channels. Manually selecting channels for dozens of points in a multi-story building is a labor-intensive and often ineffective task due to the changing radio environment. channel Allows you to set a list of acceptable channels and bandwidth.
In the channel settings you need to specify frequency or band, and also widthFor the 5 GHz band in Russia and the CIS, the optimal bandwidth is 20/40/80 MHz. However, in dense urban areas, using 80 MHz bandwidth can lead to interference with neighbors, so it's often wiser to limit the bandwidth to 40 MHz for stability.
| Parameter | Description | Recommended value |
|---|---|---|
| Channel Width | Bandwidth | 20/40/80eC (for 5 GHz) |
| Frequency | Operating frequency | Auto or list 5180-5700 |
| Band | Frequency range | 5GHz-only-ac or ax |
| Secondary Frequency | Additional frequency | Disabled (for 20/40 MHz) |
Automatic channel selection mechanism (channel.reselect-interval) allows the system to periodically scan the airwaves and switch to less congested frequencies. This is especially important for office buildings, where neighbors may constantly change their network configurations, creating interference.
Why not use 160 MHz width?
Using the maximum channel width of 160 MHz in the 5 GHz band often results in only one channel remaining in the air. This dramatically increases the likelihood of collisions with radars and neighboring networks, leading to constant frequency hopping and reduced speed.
Fine-tuning roaming and transitions
The most critical step is configuring client device behavior during migration. As mentioned earlier, the client must initiate the migration, but the infrastructure can prompt or even force it to do so. Parameters are used for this. access-list and interface settings.
A key parameter is the signal threshold. If the signal level from the current access point drops below a certain value (e.g., -75 dBm), and a neighboring access point offers a better signal (e.g., -65 dBm), the server can send a reconnection command to the client. Mikrotik This is implemented by setting a parameter signal-range in the access rules.
/caps-man access-list
add signal-range=-100..-75 action=reject comment="Reject clients with poor signal"
It is also important to adjust the intervals for polling clients. Reducing the interval keepalive-frames Allows for faster detection of devices that have physically moved out of range but have not yet formally disconnected. This frees up airtime for active users.
For devices supporting the 802.11k/v/r standard, the corresponding options must be enabled in the security profile. The 802.11v protocol allows the access point to transmit a list of neighboring access points (Neighbor Report) to the client, speeding up the search for an alternative. The 802.11r protocol simplifies the reauthorization process, which is critical for VoIP telephony.
Monitoring and diagnosing problems
After the system is implemented, its condition must be constantly monitored. Mikrotik there is a powerful tool for this Wireless -> Registration TableHere you can see the actual status of all connected clients, signal strength (RSSI), connection speed (Tx/Rx Rate), and uptime.
For a deep analysis of the radio environment, a built-in frequency scanner is used (Scan). It allows you to see not only your own access points but also all neighboring networks, their channels, and noise levels. Regularly conducting such measurements helps anticipate problems before users start complaining.
☑️ Diagnosing WiFi problems
Event logging also plays an important role. Configuring logs to be sent to a remote server or stored in memory allows for retrospective analysis of the causes of connection interruptions. Client deauthentication messages deserve special attention.
If you notice that a specific access point is constantly rebooting or losing connection to the server, check the cabling and connector quality. Physical layer (L1) issues often appear as software errors in wireless network logs.
Why won't my phone switch to the nearest point?
This is the most common problem. Client devices (especially iOS and some Android devices) aggressively hold on to their current access point until the last possible moment to avoid unnecessary handoffs. Even if a neighboring access point is stronger, the phone may not switch until the current access point's signal drops below a critical threshold, which is hardcoded into the device driver. The only solution is to correctly configure the min-signal threshold on the server side to "kick" the client, or to use Fast Roaming (802.11r), if supported.
Do I need to purchase a license for CAPsMAN?
No, CAPsMAN functionality is built into RouterOS for free and does not require additional licenses (Level 4, 5, or 6). A license is only required for the access point (CAP) itself if you are using Mikrotik devices. However, most Mikrotik devices already have the necessary license to operate in access point mode out of the box. The only limitation may be the number of simultaneous connections, which depends on the device's license level.
Is it possible to combine points of different models into one network?
Yes, CAPsMAN allows you to manage a diverse fleet of equipment. You can mix and match models. cAP ac, wAP R And hAP ax2 in a single system. It's important that the RouterOS versions on the control server and access points are compatible. It's recommended to keep the firmware on all devices up to date, preferably at the same major version (e.g., all on v7.x), to avoid errors in the data exchange protocol.