TP3 📶 ✅ As-built finalisiert: 5 dirtyvader-SSIDs live, Kanal-Plan + Sonos-Diagnose
- ft=no auf sec-media (802.11r bricht Sonos), ft-over-ds=no - Kanal-Plan non-DFS/überlappungsfrei: ap1 ch36+ch1, ap2 ch149+ch11 (Auto-Channel hatte beide APs auf 5500-DFS/2437 = Co-Channel gelegt) - tp3-capsman.rsc: Channel-Frequenzen, ap1-Interface-Override, Verifikation 2026-06-18 - obsolete capsman-flat-asbuilt/ap1-manager/ap2-cap entfernt (von tp3-capsman.rsc ersetzt) - teilprojekte.md TP3 → ✅; Sonos-Split-Diagnose in tp7-mdns.md + sonos-inventar.md (7 WLAN-Sonos noch auf FB-WLAN/VLAN1 → "selektiv je Netz", kein mDNS-Defekt) Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
@@ -1,47 +0,0 @@
|
||||
# ===== ap1 (10.40.41.155) — CAPsMAN-Manager + AP + VLAN-Bridge =====
|
||||
# RouterOS 7.23.1. NUR PLAN — Syntax vor Apply gegen Gerät validieren.
|
||||
# Platzhalter <...> ersetzen. L3/Router-Teil (DHCP/DNS/NAT/CAKE) NICHT hier (separater Cutover).
|
||||
|
||||
# --- 1) Bridge-VLAN-Tabelle (Uplink ether2 = Trunk, native vlan1 = Mgmt) ---
|
||||
/interface bridge vlan
|
||||
add bridge=bridge vlan-ids=10,20,30,40,90,99,100 tagged=bridge,ether2
|
||||
add bridge=bridge vlan-ids=1 untagged=ether2,ether3,ether4,ether5 tagged=bridge
|
||||
/interface bridge port
|
||||
set [find interface=ether2] pvid=1 ;# native/untagged = vlan1 (Mgmt)
|
||||
|
||||
# --- 2) WLAN Security (Passphrasen vom User) ---
|
||||
# TEMP-Passphrase (Platzhalter) — User setzt echte später
|
||||
/interface wifi security
|
||||
add name=sec-main authentication-types=wpa3-psk passphrase="BFtest-2026-tmp" ;# WPA3-only (User)
|
||||
add name=sec-iot authentication-types=wpa2-psk,wpa3-psk passphrase="BFtest-2026-tmp"
|
||||
add name=sec-guest authentication-types=wpa2-psk,wpa3-psk passphrase="BFtest-2026-tmp"
|
||||
|
||||
# --- 3) Datapath = VLAN-Zuordnung (Bridge + vlan-id) ---
|
||||
/interface wifi datapath
|
||||
add name=dp-main bridge=bridge vlan-id=10
|
||||
add name=dp-iot bridge=bridge vlan-id=30
|
||||
add name=dp-guest bridge=bridge vlan-id=90
|
||||
|
||||
# --- 4) Configuration je SSID ---
|
||||
/interface wifi configuration
|
||||
add name=cfg-main ssid="BF-Main" security=sec-main datapath=dp-main country=Austria
|
||||
add name=cfg-iot ssid="BF-IoT" security=sec-iot datapath=dp-iot country=Austria
|
||||
add name=cfg-guest ssid="BF-Guest" security=sec-guest datapath=dp-guest country=Austria
|
||||
|
||||
# --- 5) CAPsMAN-Manager aktivieren (CA/Cert generiert RouterOS automatisch) ---
|
||||
/interface wifi capsman
|
||||
set enabled=yes interfaces=bridge ca-certificate=auto certificate=auto
|
||||
|
||||
# --- 6) Provisioning: pro Radio Master(BF-Main)+Slaves(IoT,Guest) dynamisch anlegen ---
|
||||
/interface wifi provisioning
|
||||
add action=create-dynamic-enabled supported-bands=2ghz-ax \
|
||||
master-configuration=cfg-main slave-configurations=cfg-iot,cfg-guest
|
||||
add action=create-dynamic-enabled supported-bands=5ghz-ax \
|
||||
master-configuration=cfg-main slave-configurations=cfg-iot,cfg-guest
|
||||
|
||||
# --- 7) SAFETY: Auto-Rollback, DANN vlan-filtering an ---
|
||||
/system scheduler
|
||||
add name=vlan-rollback interval=5m \
|
||||
on-event="/interface bridge set [find name=bridge] vlan-filtering=no; /system scheduler remove vlan-rollback"
|
||||
/interface bridge set [find name=bridge] vlan-filtering=yes
|
||||
# Nach bestätigtem Zugriff: /system scheduler remove vlan-rollback
|
||||
@@ -1,21 +0,0 @@
|
||||
# ===== ap2 (10.40.41.156) — CAP (zieht Config von ap1) + VLAN-Bridge =====
|
||||
# RouterOS 7.23.1. NUR PLAN — Syntax vor Apply gegen Gerät validieren.
|
||||
|
||||
# --- 1) Bridge-VLAN-Tabelle (identisch zu ap1: Uplink ether2 Trunk, native vlan1 Mgmt) ---
|
||||
/interface bridge vlan
|
||||
add bridge=bridge vlan-ids=10,20,30,40,90,99,100 tagged=bridge,ether2
|
||||
add bridge=bridge vlan-ids=1 untagged=ether2,ether3,ether4,ether5 tagged=bridge
|
||||
/interface bridge port
|
||||
set [find interface=ether2] pvid=1
|
||||
|
||||
# --- 2) CAP aktivieren: Manager = ap1, Wireless slaves in die Bridge ---
|
||||
/interface wifi cap
|
||||
set enabled=yes discovery-interfaces=bridge caps-man-addresses=10.40.41.1 slaves-datapath=bridge
|
||||
# (ap2 zieht security/datapath/configuration/provisioning vom Manager → SSIDs erscheinen automatisch)
|
||||
|
||||
# --- 3) SAFETY: Auto-Rollback, DANN vlan-filtering an ---
|
||||
/system scheduler
|
||||
add name=vlan-rollback interval=5m \
|
||||
on-event="/interface bridge set [find name=bridge] vlan-filtering=no; /system scheduler remove vlan-rollback"
|
||||
/interface bridge set [find name=bridge] vlan-filtering=yes
|
||||
# Nach bestätigtem Zugriff: /system scheduler remove vlan-rollback
|
||||
@@ -1,45 +0,0 @@
|
||||
# ===== AS-BUILT 2026-06-09: CAPsMAN BF-Main, FLACH (bridge/vlan1, KEIN VLAN) =====
|
||||
# Angewendet via MikroMCP (run_command). ap1=10.40.41.1 (Manager+AP), ap2=10.40.41.2 (CAP).
|
||||
# Verifiziert: beide APs, beide Bänder = SSID BF-Main, WPA3-only + FT, state=running, remote-cap Ok.
|
||||
# WICHTIGSTE LEKTION (kostete den Vorgänger den Erfolg):
|
||||
# - "bound=true" ist NORMAL (Master-IF mit Radio+Config), KEIN Fehler.
|
||||
# - Ein CAP wird nur provisioniert, wenn auf seinen Interfaces
|
||||
# configuration.manager=capsman-or-local gesetzt ist (default=local → kontaktiert CAPsMAN NIE).
|
||||
# Reset setzt es auf default zurück → nach reset neu setzen!
|
||||
# - Manager-eigene Radios kann CAPsMAN NICHT via configuration.manager=capsman managen
|
||||
# → lokal die Configuration-Profile direkt zuweisen (Doku).
|
||||
|
||||
# ---------- ap1 = MANAGER + AP ----------
|
||||
/interface/wifi/channel
|
||||
add name=ch-2g band=2ghz-ax width=20mhz
|
||||
add name=ch-5g band=5ghz-ax width=20/40/80mhz ;# 5560 (DFS) auto -> 1min CAC; ggf. non-DFS pinnen
|
||||
/interface/wifi/security
|
||||
add name=sec-main authentication-types=wpa3-psk passphrase="BFtest-2026-tmp" ft=yes ft-over-ds=yes
|
||||
/interface/wifi/datapath
|
||||
add name=dp-main bridge=bridge ;# FLACH: nur bridge, kein vlan-id (VLAN kommt nach Cutover)
|
||||
/interface/wifi/configuration
|
||||
add name=cfg-main-5g ssid=BF-Main mode=ap country=Austria security=sec-main datapath=dp-main channel=ch-5g
|
||||
add name=cfg-main-2g ssid=BF-Main mode=ap country=Austria security=sec-main datapath=dp-main channel=ch-2g
|
||||
/interface/wifi/capsman
|
||||
set enabled=yes ;# interfaces=bridge, ca/cert auto (waren vorhanden)
|
||||
/interface/wifi/provisioning
|
||||
add action=create-dynamic-enabled supported-bands=5ghz-ax master-configuration=cfg-main-5g
|
||||
add action=create-dynamic-enabled supported-bands=2ghz-ax master-configuration=cfg-main-2g
|
||||
# ap1 eigene Radios lokal zuweisen (Master kann sich nicht selbst per CAPsMAN managen):
|
||||
/interface/wifi
|
||||
reset wifi1 ; set wifi1 configuration=cfg-main-5g disabled=no
|
||||
reset wifi2 ; set wifi2 configuration=cfg-main-2g disabled=no
|
||||
|
||||
# ---------- ap2 = CAP ----------
|
||||
/interface/wifi
|
||||
reset wifi1 ; reset wifi2
|
||||
set wifi1,wifi2 configuration.manager=capsman-or-local ;# <-- DER SCHLÜSSEL, sonst keine Provisionierung
|
||||
enable wifi1,wifi2
|
||||
/interface/wifi/cap
|
||||
set enabled=yes discovery-interfaces=bridge caps-man-addresses=10.40.41.1
|
||||
|
||||
# ---------- Verifikation ----------
|
||||
# ap1: /interface/wifi/capsman remote-cap print -> ap2 STATE=Ok
|
||||
# ap1: /interface/wifi monitor wifi1,wifi2 once -> state=running, SSID BF-Main
|
||||
# ap2: /interface/wifi print detail -> "managed by CAPsMAN ...", BR (bound+running)
|
||||
# Backups vorher: pre-capsman-2026-06-09.backup auf beiden APs.
|
||||
@@ -22,16 +22,16 @@
|
||||
|
||||
# ================= ap1 = MANAGER + AP =================
|
||||
|
||||
# --- Channels (wiederverwendet aus Vorbestand) ---
|
||||
# --- Channels (non-DFS gepinnt; diese Frequenzen gelten fuer ap2 = CAP, ap1 wird unten lokal ueberschrieben) ---
|
||||
/interface/wifi/channel
|
||||
add name=ch-2g band=2ghz-ax width=20mhz
|
||||
add name=ch-5g band=5ghz-ax width=20/40/80mhz
|
||||
add name=ch-2g band=2ghz-ax width=20mhz frequency=2462 ;# ch11 (ap2)
|
||||
add name=ch-5g band=5ghz-ax width=20/40/80mhz frequency=5745 ;# ch149 non-DFS (ap2)
|
||||
|
||||
# --- Security je SSID (gemeinsames Temp-PW; FT nur main+media) ---
|
||||
/interface/wifi/security
|
||||
add name=sec-main authentication-types=wpa3-psk ft=yes ft-over-ds=yes passphrase="__TEMP_PSK__"
|
||||
add name=sec-iot authentication-types=wpa2-psk,wpa3-psk ft=no passphrase="__TEMP_PSK__"
|
||||
add name=sec-media authentication-types=wpa2-psk,wpa3-psk ft=yes ft-over-ds=yes passphrase="__TEMP_PSK__"
|
||||
add name=sec-media authentication-types=wpa2-psk,wpa3-psk ft=no passphrase="__TEMP_PSK__" ;# ft=no: 802.11r bricht Sonos
|
||||
add name=sec-untrusted authentication-types=wpa2-psk,wpa3-psk ft=no passphrase="__TEMP_PSK__"
|
||||
add name=sec-guest authentication-types=wpa2-psk,wpa3-psk ft=no passphrase="__TEMP_PSK__"
|
||||
|
||||
@@ -64,8 +64,8 @@ add action=create-dynamic-enabled supported-bands=5ghz-ax master-configuration=c
|
||||
|
||||
# --- ap1-EIGENE Radios LOKAL zuweisen (Manager provisioniert sich nicht selbst!) ---
|
||||
/interface/wifi
|
||||
set wifi1 configuration=cfg-main-5g configuration.manager=local disabled=no ;# wifi1 = 5 GHz
|
||||
set wifi2 configuration=cfg-main-2g configuration.manager=local disabled=no ;# wifi2 = 2,4 GHz
|
||||
set wifi1 configuration=cfg-main-5g configuration.manager=local disabled=no channel.frequency=5180 ;# wifi1 = 5 GHz, ch36 (override gg. ch-5g)
|
||||
set wifi2 configuration=cfg-main-2g configuration.manager=local disabled=no channel.frequency=2412 ;# wifi2 = 2,4 GHz, ch1 (override gg. ch-2g)
|
||||
# Statische Slaves je Band (5 GHz ohne iot):
|
||||
add master-interface=wifi1 configuration=cfg-media name=w5-media disabled=no
|
||||
add master-interface=wifi1 configuration=cfg-untrusted name=w5-untrusted disabled=no
|
||||
@@ -80,15 +80,18 @@ add master-interface=wifi2 configuration=cfg-guest name=w2-guest disable
|
||||
# erscheinen dynamisch: wifi1(5G)=main + media/untrusted/guest ; wifi2(2,4G)=main + iot/media/untrusted/guest.
|
||||
# Falls je noetig: /interface/wifi/capsman/remote-cap provision [find]
|
||||
|
||||
# ================= VERIFIKATION (durchgefuehrt) =================
|
||||
# ap1: /interface/wifi monitor wifi1,wifi2 once -> state=running (wifi1 nach 1min DFS-CAC auf 5500)
|
||||
# ap2: /interface/wifi print brief -> 9 IFs alle DBR/MBR running, "managed by CAPsMAN 10.40.41.1"
|
||||
# ================= VERIFIKATION (durchgefuehrt 2026-06-18) =================
|
||||
# ap1: monitor wifi1,wifi2 -> running, ch36/5180 (5G) + ch1/2412 (2,4G), tx-power ~18-25/15 dBm, 2 Clients FT-WPA3 VLAN10
|
||||
# ap2: print brief -> 9 IFs MBR/DBR running, ch149/5745 (5G) + ch11/2462 (2,4G), "managed by CAPsMAN 10.40.41.1"
|
||||
# ap1: /interface/wifi/capsman/remote-cap print -> ap2 STATE=Ok
|
||||
# Kanaele distinkt + non-DFS auf beiden Baendern (Co-Channel beseitigt). KANAL-AENDERUNG an ap2 braucht
|
||||
# manuellen Push: /interface/wifi/capsman/remote-cap provision [find]
|
||||
# Offen (User-Geraetetest): Client je SSID -> DHCP aus 10.40.{10,30,40,50,90}.x, list_wifi_clients vlan-id.
|
||||
|
||||
# ================= OFFENE PUNKTE / TUNING =================
|
||||
# - Echte Passphrasen pro security-Profil setzen (Temp ersetzen).
|
||||
# - 5 GHz: beide APs auto -> aktuell beide auf DFS-5500. Empfehlung: non-DFS pinnen & distinct
|
||||
# (z.B. ap1=ch36/5180, ap2=ch149/5745) gegen Co-Channel + Radar-Unterbrechung. (channel.frequency)
|
||||
# - Echte Passphrasen pro security-Profil setzen (Temp ersetzen). User macht das selbst.
|
||||
# - Kanal-Plan erledigt: ap1 ch36/ch1, ap2 ch149/ch11 (alle non-DFS, ueberlappungsfrei).
|
||||
# - hidden dirtyvader-infra(20)/-mgmt(99) bei Bedarf nachziehen (sec WPA3-only, configuration.hide-ssid=yes).
|
||||
# - Sonos-Migration (TP7-Anschluss): 7 WLAN-Sonos noch auf FB-WLAN (VLAN1) -> auf dirtyvader-media (VLAN40)
|
||||
# holen, dann ist der Household geschlossen und mDNS-Repeater vlan10<->vlan40 liefert MAIN volle Discovery.
|
||||
# - TP8: eine 802.1X-SSID (dirtyvader-secure) mit FreeRADIUS-Dynamic-VLAN -> dann PSK-main/infra retiren.
|
||||
|
||||
Reference in New Issue
Block a user