Establishing stable wireless coverage in a large home or office often faces the problem of connection drops when users move between access points. The standard approach, where each device operates as an independent router with a single network name, doesn't automatically switch clients to a stronger signal. As a result, a smartphone or laptop clings to a moving access point until the connection is lost, causing lag in video calls and buffering in streaming video. The solution to this problem is the implementation of wireless technology. seamless roaming.
In the ecosystem Mikrotik technology is responsible for this function CAPsMAN (Controlled Access Point System Manager). It allows for centralized management of multiple access points, unified security settings, and, most importantly, coordinated client handoffs. Proper configuration of CAPsMAN transforms disparate routers into a single, intelligent system where transitions between coverage zones are seamless to the user. This is especially critical for IP telephony, video surveillance, and online gaming systems.
Before setting things up, it's important to understand that implementing full-fledged roaming requires more than just creating CAPsMAN. Client devices (smartphones, tablets, laptops) must also support the standards. 802.11r, 802.11k And 802.11vWithout support for these protocols on the device's end, the router won't be able to effectively manage its movements, and the device will continue to operate as before. However, even without full client support, proper server configuration will significantly improve the network situation.
Network architecture and equipment selection
The foundation of any scalable network is the correct choice of hardware. To implement CAPsMAN, you will need at least one device acting as a controller (Master) and one or more devices operating as access points (CAPs). Any router can act as a controller. Mikrotik with support for RouterOS version 6 or 7, although for larger networks it is preferable to use models of the RouterOS series hAP ac3, Rb4011 or CCR because of their computing power.
Access points can be either specialized models (series wAP, LHG, SXT), and regular routers configured in CAP mode. It's critical that all devices are in the same broadcast domain (L2), meaning they're connected by a switch or directly by cables, without complex routing between them, unless you plan to configure CAPsMAN over IP (tunnel mode). For home and small office use, the most effective setup is one in which the controller distributes settings over the local network.
When designing a physical topology, consider channel bandwidth. If you plan to deliver gigabit speeds over Wi-Fi, ensure that the cabling infrastructure (patch cords, outlets, switches) supports the standard. Gigabit EthernetUsing older Fast Ethernet (100 Mbps) equipment will become a bottleneck that will negate all the benefits of modern wireless standards.
⚠️ Attention: When using devices of different generations (for example, mixing older AC models with newer AX/Wi-Fi 6 models), ensure that the RouterOS versions on all devices are compatible. In RouterOS v7, the wireless packet architecture was changed, which may require firmware updates on all network nodes.
Infrastructure preparation and software updates
The first step before implementing CAPsMAN is to bring the entire network into line with a common denominator. This means updating RouterOS And firmware (bootloader) on all devices to the latest stable versions. Inconsistencies in software versions often result in the controller simply not seeing access points or being unable to apply configurations to them.
It's best to perform the update process centrally if you already have a master router configured, or by connecting to each device one by one. In the menu System → Packages press the button Check for Updates, and then Download & InstallAfter rebooting, be sure to check the bootloader version in the menu System → RouterBOARD and press Upgrade, if a new version is available, then reboot your device again.
An important aspect of preparation is IP addressing. The CAPsMAN controller and all access points require static IP addresses or reserved addresses via DHCP. Dynamically changing an access point's IP address during operation can lead to the management tunnel being broken and communication with the controller being lost. It is recommended to allocate a separate subnet or address pool for infrastructure equipment.
| Network component | Recommended role | Criticality of the update | Connection type |
|---|---|---|---|
| Master Router | CAPsMAN Controller | High (core control) | Wire / WAN |
| Access Point | CAP (Slave) | High (protocol compatibility) | Wire (LAN) |
| Switch | L2 switching | Medium (VLAN tagging) | Wire |
| Client | User device | Low (depending on drivers) | Wireless |
Setting up the CAPsMAN controller
The setup starts with the device that will manage the network. In the menu Wireless (or Wifi in version 7) you need to enable the package CAPsMANAfter activating the package, a new section will appear in the menu. CAPsMANFirst of all, go to the tab Interfaces and add an interface through which the controller will communicate with access points. This is usually bridge-local or a specific LAN port.
Next you need to create ConfigurationThis is a settings template that will be automatically applied to all connected access points. In this section, you set the network name (SSID), security mode, encryption type, and channels. The key here is creating a Security Profile, which specifies passwords and authentication methods (WPA2/WPA3). Don't forget to select the checkbox enabled in the configuration.
☑️ Controller setup checklist
To ensure seamless operation, you need to enable roaming protocols in the configuration. In the configuration settings, find the section responsible for 802.11r (Fast Transition). Turn on the option ft-enabled and select the authentication method (usually FT over DS or FT over Air). It is also recommended to enable access-listto control which devices are allowed to connect, although for home use this can be left open.
⚠️ Attention: When enabling 802.11r, some older devices (such as older printers or IoT gadgets) may lose visibility or be unable to connect to the network. If you have critical legacy equipment, create a separate SSID without 802.11r support for it.
Configuration of Access Points (CAP)
After setting up the controller, we move on to the access points. Their job is to act as "dumb" agents, awaiting commands from above. To do this, you need to enable CAP mode on the access point device. This is done through the menu. System → CAPsMAN (or Wireless → CAP). Turn on the option Enabled and specify the controller's address. If the controller is on the same subnet, simply select discovery mode. layer2.
A crucial step is resetting the local wireless configuration on the access point. While the access point has its own wireless interface with its own settings active, CAPsMAN will not be able to apply its profile. In the menu Wireless remove or disable local wlan interfaces. Once the access point finds the controller, it will automatically reboot the wireless module and apply the settings received from the central control center.
What to do if the hotspot does not connect?
Make sure that STP/RSTP with long convergence times is not enabled on the switch port to which the access point is connected, or use an edge port. Also, verify that VLANs, if used, are trunked to the controller.
The visual indicator of successful configuration is the status of the point in the list. CAPsMAN → CAP Interfaces on the controller. The status should change to connected, and the name of the applied profile will appear in the configuration column. From this point on, any changes to the profile on the controller (password, channel, or power) will be automatically and instantly applied to all points.
Fine-tuning roaming and channels
CAPsMAN itself doesn't force a device to switch. It merely creates conditions under which the switch occurs quickly and without packet loss. This is accomplished using a mechanism 802.11k (Neighbors), which allows the AP to report to the client a list of neighboring APs with better signals. In the Configuration settings on the controller, make sure this option is enabled. generate-stats and parameters related to the neighbor report.
The second mechanism is 802.11v, which allows the access point to request the client to move to another frequency or access point if the signal weakens. In Mikrotik, this is often configured through the settings. installation and signal thresholds. You can set a minimum signal level below which the access point will actively "disassociate" the client, forcing it to search for a better access point. However, you need to be careful with this to avoid creating "gaps" in coverage.
Channel planning deserves special attention. In the 2.4 GHz band, use only channels 1, 6, and 11 to avoid overlapping. In the 5 GHz band, wider channels (40 or 80 MHz) can be used, but it's important to ensure that adjacent access points don't operate on the same frequencies at high power. CAPsMAN can automatically select a channel (auto-frequency), but for stationary objects, it's better to manually assign frequencies for predictability.
Diagnosing and troubleshooting
Even after careful setup, situations may arise where roaming doesn't work perfectly. The first diagnostic tool is the built-in log. In the menu Log filter messages by topic capsman or wirelessYou'll see authentication processes, associations, and reasons for client disconnections. Search keywords: disassociated, deauth, ft-failure.
A common problem is client "sticking." The device sees the primary access point's signal at -75 dBm, even though there's a nearby access point at -50 dBm, but doesn't switch. This is a limitation of the Wi-Fi driver in the client itself (especially common on Apple devices and some Android devices). In this case, a setting can help. Disconnect Threshold on the CAPsMAN side, which forcibly disconnects the client when the signal drops below a specified level, stimulating the search for a new point.
It's also worth checking the channel load. Use the built-in scanner. Wireless → Scan Or use third-party smartphone apps (Wi-Fi Analyzer) to see if your environment is noisy. If your neighbors are taking up all the airwaves, no amount of roaming settings will help—you'll need to switch to 5 GHz or change channels. Mikrotik has a feature frequency-usage, which shows the frequency loading in real time.
Why won't my iPhone switch between dots?
Apple devices are known for their conservative roaming algorithms. They prefer to hold on to their current access point until the very end. To improve this, ensure 802.11r (Fast Transition) is enabled and the Security Profile is configured with the correct keys. Also, try reducing the transmit power (TX-power) on your access points to prevent excessive overlap in coverage areas, which can lead to switching.
Is it possible to combine routers of different models in CAPsMAN?
Yes, you can. CAPsMAN supports heterogeneous networks. You can manage access points of the hAP, mAP, wAP series, and even older models from a single controller. The main requirement is that all devices run a compatible version of RouterOS. However, functionality may be limited by the capabilities of the weakest device in the chain (for example, the lack of Wi-Fi 6 support on older models).
Does CAPsMAN require internet access?
No, the local CAPsMAN does not require an internet connection. All management traffic is handled within your local network (LAN). Internet access is only required for the initial firmware update and, optionally, for using Mikrotik cloud services (Cloud), if you plan to manage your network remotely over the internet.