admin/bf-infra
1
0
Fork 0
Code Issues 21 Pull Requests Actions Packages Projects Releases Wiki Activity

TP3 📶 ✅ As-built finalisiert: 5 dirtyvader-SSIDs live, Kanal-Plan + Sonos-Diagnose

Browse Source 
- ft=no auf sec-media (802.11r bricht Sonos), ft-over-ds=no
- Kanal-Plan non-DFS/überlappungsfrei: ap1 ch36+ch1, ap2 ch149+ch11
  (Auto-Channel hatte beide APs auf 5500-DFS/2437 = Co-Channel gelegt)
- tp3-capsman.rsc: Channel-Frequenzen, ap1-Interface-Override, Verifikation 2026-06-18
- obsolete capsman-flat-asbuilt/ap1-manager/ap2-cap entfernt (von tp3-capsman.rsc ersetzt)
- teilprojekte.md TP3 → ✅; Sonos-Split-Diagnose in tp7-mdns.md + sonos-inventar.md
  (7 WLAN-Sonos noch auf FB-WLAN/VLAN1 → "selektiv je Netz", kein mDNS-Defekt)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Christoph Emsenhuber
2026-06-18 01:11:41 +02:00
parent 6bcef5862f
commit 03f328f043
7 changed files with 52 additions and 133 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
routeros/tp3-capsman.rsc
View File

@@ -22,16 +22,16 @@
# ================= ap1 = MANAGER + AP =================
# --- Channels (wiederverwendet aus Vorbestand) ---
# --- Channels (non-DFS gepinnt; diese Frequenzen gelten fuer ap2 = CAP, ap1 wird unten lokal ueberschrieben) ---
/interface/wifi/channel
add name=ch-2g band=2ghz-ax width=20mhz
add name=ch-5g band=5ghz-ax width=20/40/80mhz
add name=ch-2g band=2ghz-ax width=20mhz frequency=2462 ;# ch11 (ap2)
add name=ch-5g band=5ghz-ax width=20/40/80mhz frequency=5745 ;# ch149 non-DFS (ap2)
# --- Security je SSID (gemeinsames Temp-PW; FT nur main+media) ---
/interface/wifi/security
add name=sec-main authentication-types=wpa3-psk ft=yes ft-over-ds=yes passphrase="__TEMP_PSK__"
add name=sec-iot authentication-types=wpa2-psk,wpa3-psk ft=no passphrase="__TEMP_PSK__"
add name=sec-media authentication-types=wpa2-psk,wpa3-psk ft=yes ft-over-ds=yes passphrase="__TEMP_PSK__"
add name=sec-media authentication-types=wpa2-psk,wpa3-psk ft=no passphrase="__TEMP_PSK__" ;# ft=no: 802.11r bricht Sonos
add name=sec-untrusted authentication-types=wpa2-psk,wpa3-psk ft=no passphrase="__TEMP_PSK__"
add name=sec-guest authentication-types=wpa2-psk,wpa3-psk ft=no passphrase="__TEMP_PSK__"
@@ -64,8 +64,8 @@ add action=create-dynamic-enabled supported-bands=5ghz-ax master-configuration=c
# --- ap1-EIGENE Radios LOKAL zuweisen (Manager provisioniert sich nicht selbst!) ---
/interface/wifi
set wifi1 configuration=cfg-main-5g configuration.manager=local disabled=no ;# wifi1 = 5 GHz
set wifi2 configuration=cfg-main-2g configuration.manager=local disabled=no ;# wifi2 = 2,4 GHz
set wifi1 configuration=cfg-main-5g configuration.manager=local disabled=no channel.frequency=5180 ;# wifi1 = 5 GHz, ch36 (override gg. ch-5g)
set wifi2 configuration=cfg-main-2g configuration.manager=local disabled=no channel.frequency=2412 ;# wifi2 = 2,4 GHz, ch1 (override gg. ch-2g)
# Statische Slaves je Band (5 GHz ohne iot):
add master-interface=wifi1 configuration=cfg-media name=w5-media disabled=no
add master-interface=wifi1 configuration=cfg-untrusted name=w5-untrusted disabled=no
@@ -80,15 +80,18 @@ add master-interface=wifi2 configuration=cfg-guest name=w2-guest disable
# erscheinen dynamisch: wifi1(5G)=main + media/untrusted/guest ; wifi2(2,4G)=main + iot/media/untrusted/guest.
# Falls je noetig: /interface/wifi/capsman/remote-cap provision [find]
# ================= VERIFIKATION (durchgefuehrt) =================
# ap1: /interface/wifi monitor wifi1,wifi2 once -> state=running (wifi1 nach 1min DFS-CAC auf 5500)
# ap2: /interface/wifi print brief -> 9 IFs alle DBR/MBR running, "managed by CAPsMAN 10.40.41.1"
# ================= VERIFIKATION (durchgefuehrt 2026-06-18) =================
# ap1: monitor wifi1,wifi2 -> running, ch36/5180 (5G) + ch1/2412 (2,4G), tx-power ~18-25/15 dBm, 2 Clients FT-WPA3 VLAN10
# ap2: print brief -> 9 IFs MBR/DBR running, ch149/5745 (5G) + ch11/2462 (2,4G), "managed by CAPsMAN 10.40.41.1"
# ap1: /interface/wifi/capsman/remote-cap print -> ap2 STATE=Ok
# Kanaele distinkt + non-DFS auf beiden Baendern (Co-Channel beseitigt). KANAL-AENDERUNG an ap2 braucht
# manuellen Push: /interface/wifi/capsman/remote-cap provision [find]
# Offen (User-Geraetetest): Client je SSID -> DHCP aus 10.40.{10,30,40,50,90}.x, list_wifi_clients vlan-id.
# ================= OFFENE PUNKTE / TUNING =================
# - Echte Passphrasen pro security-Profil setzen (Temp ersetzen).
# - 5 GHz: beide APs auto -> aktuell beide auf DFS-5500. Empfehlung: non-DFS pinnen & distinct
# (z.B. ap1=ch36/5180, ap2=ch149/5745) gegen Co-Channel + Radar-Unterbrechung. (channel.frequency)
# - Echte Passphrasen pro security-Profil setzen (Temp ersetzen). User macht das selbst.
# - Kanal-Plan erledigt: ap1 ch36/ch1, ap2 ch149/ch11 (alle non-DFS, ueberlappungsfrei).
# - hidden dirtyvader-infra(20)/-mgmt(99) bei Bedarf nachziehen (sec WPA3-only, configuration.hide-ssid=yes).
# - Sonos-Migration (TP7-Anschluss): 7 WLAN-Sonos noch auf FB-WLAN (VLAN1) -> auf dirtyvader-media (VLAN40)
# holen, dann ist der Household geschlossen und mDNS-Repeater vlan10<->vlan40 liefert MAIN volle Discovery.
# - TP8: eine 802.1X-SSID (dirtyvader-secure) mit FreeRADIUS-Dynamic-VLAN -> dann PSK-main/infra retiren.