# ===== ap2 (10.40.41.156) — CAP (zieht Config von ap1) + VLAN-Bridge =====
# RouterOS 7.23.1. NUR PLAN — Syntax vor Apply gegen Gerät validieren.

# --- 1) Bridge-VLAN-Tabelle (identisch zu ap1: Uplink ether2 Trunk, native vlan1 Mgmt) ---
/interface bridge vlan
add bridge=bridge vlan-ids=10,20,30,40,90,99,100 tagged=bridge,ether2
add bridge=bridge vlan-ids=1 untagged=ether2,ether3,ether4,ether5 tagged=bridge
/interface bridge port
set [find interface=ether2] pvid=1

# --- 2) CAP aktivieren: Manager = ap1, Wireless slaves in die Bridge ---
/interface wifi cap
set enabled=yes discovery-interfaces=bridge caps-man-addresses=10.40.41.1 slaves-datapath=bridge
# (ap2 zieht security/datapath/configuration/provisioning vom Manager → SSIDs erscheinen automatisch)

# --- 3) SAFETY: Auto-Rollback, DANN vlan-filtering an ---
/system scheduler
add name=vlan-rollback interval=5m \
  on-event="/interface bridge set [find name=bridge] vlan-filtering=no; /system scheduler remove vlan-rollback"
/interface bridge set [find name=bridge] vlan-filtering=yes
# Nach bestätigtem Zugriff:  /system scheduler remove vlan-rollback