Providing stable wireless coverage in an office or large home often faces the problem of connection drops when the user moves. The typical scenario of a client device "latching" to a distant access point with a weak signal, ignoring a nearby one, is familiar to every system administrator. The solution to this problem is seamless roaming technology, which is used in the ecosystem. Mikrotik implemented via the CAPsMAN protocol.
Implementing centralized management allows you to transform a set of disparate routers into a single intelligent network. This isn't simply a matter of cloning settings, but rather creating an environment where the controller dictates connection rules. Seamless Wi-Fi ensures switching between access points faster than the video indicator can blink or the VoIP call can be interrupted.
Implementing this plan will require hardware that supports the necessary standards and proper configuration of the RouterOS software. It's important to understand that success depends not only on the controller configuration but also on the proper placement of access points. 802.11r/k/v These are the three pillars on which modern roaming is based, and their correct operation is critical for the end user.
Network architecture and equipment selection
Before beginning configuration, ensure your hardware meets the requirements. To build an effective CAPsMAN system, it's recommended to use devices from the same series or at least with identical wireless module chips. Inconsistent hardware can lead to unpredictable behavior when switching clients.
Any router can act as a controller Mikrotik with sufficient memory, for example, a series hEX or Cloud RouterAccess points (CAP) can be specialized models wAP, cAP Or regular routers in CAP mode. The main requirement is support for the 802.11ac (Wave 2) or ax standard for maximum performance.
⚠️ Please note: Using older models with a single 2.4 GHz band will not allow full, fast roaming. Clients will remain stuck on the same access point even if the signal becomes critically weak.
When planning access point placement, consider overlapping coverage areas. If access points are too far apart, roaming will simply fail due to the lack of an alternative signal. If they are too close, interference noise will occur, reducing overall network throughput.
Basic RouterOS Setup and Upgrade
The first step should always be to ensure all devices are up-to-date with the latest software. In RouterOS v7, the packet architecture has changed, and wireless interfaces now require separate packets. wifi or wifi-qcomMissing the required package will make configuration impossible.
It is better to update centrally if you already have a configured one Mikrotik as the default gateway. You can use the function /system package update to download the latest version. After rebooting, check that all required components are present in the list of installed packages.
☑️ Equipment preparation
It's important to note that CAPsMAN configuration is only possible on devices with a Level 4 license or higher. Low-cost entry-level models (Level 3) can only act as clients or simple access points without full controller support. Check your license level in the menu. /system license.
If you're upgrading from an older version of RouterOS v6, be prepared for a significant change in command syntax. Old scripts and configurations won't work in the new environment without extensive reworking. Now's the time to create a new, clean configuration from scratch.
Setting up the CAPsMAN controller
The central element of our system will be the controller. It stores configuration profiles and distributes them to access points. We begin by enabling the CAPsMAN service and specifying the interfaces through which management will take place. Typically, this is a local network or a dedicated VLAN.
Creating a Configuration Profile (configuration) is how access points will behave. This is where the SSID, security mode, channels, and frequencies are set. All parameters specified in the profile are automatically applied to connected CAPs.
/caps-man channeladd band=5ghz-n/ac/ax width=20/40/80mhz name="channel-5g"
add band=2ghz-n/ax width=20/40mhz name="channel-2g"
/caps-man security
add name="sec-wpa3" authentication-types=wpa3-psk passphrase="YourStrongPassword"
/caps-man configuration
add name="conf-main" ssid="Office_WiFi" mode=ap security=sec-wpa3 channel="channel-5g"
Pay special attention to frequency band settings. In densely populated areas, using an 80 MHz channel width in the 2.4 GHz band is unacceptable. For 2.4 GHz, use 20 MHz, and for 5 GHz, you can use 40 or 80 MHz, depending on the noise level in the air.
⚠️ Note: Software interfaces may vary depending on the installed RouterOS version and wireless module type (AT, Atheros, Qualcomm). Always consult the official documentation for your specific model.
After creating profiles, you need to add rules (datapath), which will determine where the traffic will be sent. You can configure traffic forwarding to the controller or leave it local to the access point. Local forwarding (local-forwarding=yes) reduces the load on the controller and improves network performance.
Implementation of Fast Roaming (802.11r/k/v)
The most important part of ensuring seamlessness is the inclusion of fast switching standards. Protocol 802.11r (Fast BSS Transition) allows the client to quickly reconnect to a new access point using pre-received encryption keys. This eliminates authorization delays.
Standard 802.11k Helps devices find the best access points nearby by providing a list of neighboring APs and their channels. This eliminates the need for the client adapter to scan the entire airwaves, wasting time and battery life. 802.11v Allows the network to gently suger the client to move to another access point or frequency.
Technical details of 802.11r
The protocol uses two transition methods: Over-the-Air and Over-the-DS. In the Mikrotik environment, Over-the-Air is more commonly used, as it doesn't require a wired infrastructure to transfer keys between points, although Over-the-DS is considered more secure in corporate environments with a separate domain controller.
To enable these features, you must explicitly specify the corresponding parameters in the security profile. Please note that not all client devices (especially older smartphones and IoT devices) support these standards. However, the presence of these flags does not prevent non-compliant devices from working; they will simply ignore the extensions.
/caps-man securityset [find name="sec-wpa3"] ft=yes ft-preserve-connection=yes
/caps-man configuration
set [find name="conf-main"] multicast-helper=full
Parameter multicast-helper=full Often underestimated, it's critical for the stability of video streams and multicast traffic when roaming. It converts broadcast packets into unicast ones, improving the reliability of data delivery over the air.
Spectrum Management and Band Steering
One common problem is clients "sticking" to the congested 2.4 GHz band when 5 GHz is available nearby. Band Steering technology allows the controller to gently nudge dual-band devices into the clearer 5 GHz band. Mikrotik This is achieved by setting the same SSID for both bands and adjusting priorities.
Automatic frequency selection (install-metrics) allows access points to automatically select the least noisy channel upon startup. This is especially useful in office buildings, where the environment can change: neighbors turn on new routers, Bluetooth devices, or microwave ovens appear.
| Parameter | 2.4 GHz band | 5 GHz band | 6 GHz band (Wi-Fi 6E) |
|---|---|---|---|
| Channel width | 20 MHz | 40-80 MHz | 160 MHz |
| Non-overlapping channels | 3 (1, 6, 11) | Up to 25+ | Up to 60+ |
| Penetration ability | High | Average | Low |
| Maximum speed | Low | High | Extreme |
Usage dynamic frequency selection Allows the network to adapt to changes in the radio environment in real time, switching access points to clearer channels without disrupting client connections. This is only possible with centralized management via CAPsMAN.
When setting up Band Steering, be careful with the thresholds. If you make the transition to 5 GHz too aggressive, devices at the edge of the coverage area may lose connection entirely, as the 5 GHz signal attenuates faster. A balance is needed between performance and coverage.
Network monitoring and debugging
After deploying the network, you need to make sure that roaming is working correctly. To do this, Mikrotik There are powerful monitoring tools. The team /caps-man registration-table print will show which point a specific client is currently connected to and what signal level (RSSI) it is.
For deep diagnostics, you can use a packet sniffer (torch or packet sniffer) to see the 802.11 control frame exchange process. We're interested in Reassociation Request/Response frames. If there are a large number of them, but no switching occurs, it means the client is being stubborn.
System logs can also tell a lot. Enable CAPsMAN event logging (/system logging) to monitor device connections and disconnections. Authentication errors or frequent reconnections of the same device may indicate password issues or incompatible security settings.
Regular network audits help identify "dead zones" or points of congestion. Airtime statistics will show how efficiently the wireless resource is being used. If channel utilization exceeds 70-80%, it's time to consider adding new access points or reducing transmission power.
Frequently Asked Questions (FAQ)
Do I need a separate server to run CAPsMAN?
No, a separate server is not required. One of the devices performs the controller function. Mikrotik on your network. This could be the most powerful router already installed on the gateway, or a dedicated, inexpensive model (such as hAP lite) that will handle only Wi-Fi management.
Will roaming work with iPhone and Android?
Yes, modern Apple and Android smartphones fully support the 802.11r/k/v standards. However, client behavior always depends on its drivers and OS version. Some devices may be more responsive and switch later than expected, but basic compatibility is ensured.
Is it possible to combine access points of different models into one network?
Technically, this is possible if they support the same Wi-Fi standards and are controlled by the same CAPsMAN controller. However, for stable operation, it is recommended to use equipment from the same series or with the same chips to avoid driver and feature incompatibility issues.
What to do if the client does not switch to the nearest point?
The decision to switch is always made by the client device, not the access point. You can encourage this process by reducing the transmit power at the access points to better define each one's coverage area. Enabling 802.11v to "nudge" clients also helps.