e688b37b60
- docs/teilprojekte.md: kanonisches Projektsteuerungsdokument (TP1–TP13 + TP-R) - docs/research/: RouterOS-Capabilities-Sweep (TP-R) + VPN-Vergleich (TP10) - mcp/: MikroMCP + Portainer-MCP Docker-Compose, routers.yaml, READMEs, .gitignore - routeros/: ap1-manager.rsc, ap2-cap.rsc, CAPsMAN-Flat-Asbuilt, WLAN-Handover - switch/cli/03-trunk-ap-ports.cli + switch/ui-guides/01-trunk-ap-ports.md: AP-Trunk-Konfiguration - docs/allnet-ge8-trunk-klickanleitung.md: GE8 Hybrid→Trunk Schritt-für-Schritt - inventory/bf-core-ports: gi1/gi2 als TRUNK zu ap1/ap2 eingetragen (gesetzt 2026-06-09) Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
48 lines
2.4 KiB
Plaintext
48 lines
2.4 KiB
Plaintext
# ===== ap1 (10.40.41.155) — CAPsMAN-Manager + AP + VLAN-Bridge =====
|
|
# RouterOS 7.23.1. NUR PLAN — Syntax vor Apply gegen Gerät validieren.
|
|
# Platzhalter <...> ersetzen. L3/Router-Teil (DHCP/DNS/NAT/CAKE) NICHT hier (separater Cutover).
|
|
|
|
# --- 1) Bridge-VLAN-Tabelle (Uplink ether2 = Trunk, native vlan1 = Mgmt) ---
|
|
/interface bridge vlan
|
|
add bridge=bridge vlan-ids=10,20,30,40,90,99,100 tagged=bridge,ether2
|
|
add bridge=bridge vlan-ids=1 untagged=ether2,ether3,ether4,ether5 tagged=bridge
|
|
/interface bridge port
|
|
set [find interface=ether2] pvid=1 ;# native/untagged = vlan1 (Mgmt)
|
|
|
|
# --- 2) WLAN Security (Passphrasen vom User) ---
|
|
# TEMP-Passphrase (Platzhalter) — User setzt echte später
|
|
/interface wifi security
|
|
add name=sec-main authentication-types=wpa3-psk passphrase="BFtest-2026-tmp" ;# WPA3-only (User)
|
|
add name=sec-iot authentication-types=wpa2-psk,wpa3-psk passphrase="BFtest-2026-tmp"
|
|
add name=sec-guest authentication-types=wpa2-psk,wpa3-psk passphrase="BFtest-2026-tmp"
|
|
|
|
# --- 3) Datapath = VLAN-Zuordnung (Bridge + vlan-id) ---
|
|
/interface wifi datapath
|
|
add name=dp-main bridge=bridge vlan-id=10
|
|
add name=dp-iot bridge=bridge vlan-id=30
|
|
add name=dp-guest bridge=bridge vlan-id=90
|
|
|
|
# --- 4) Configuration je SSID ---
|
|
/interface wifi configuration
|
|
add name=cfg-main ssid="BF-Main" security=sec-main datapath=dp-main country=Austria
|
|
add name=cfg-iot ssid="BF-IoT" security=sec-iot datapath=dp-iot country=Austria
|
|
add name=cfg-guest ssid="BF-Guest" security=sec-guest datapath=dp-guest country=Austria
|
|
|
|
# --- 5) CAPsMAN-Manager aktivieren (CA/Cert generiert RouterOS automatisch) ---
|
|
/interface wifi capsman
|
|
set enabled=yes interfaces=bridge ca-certificate=auto certificate=auto
|
|
|
|
# --- 6) Provisioning: pro Radio Master(BF-Main)+Slaves(IoT,Guest) dynamisch anlegen ---
|
|
/interface wifi provisioning
|
|
add action=create-dynamic-enabled supported-bands=2ghz-ax \
|
|
master-configuration=cfg-main slave-configurations=cfg-iot,cfg-guest
|
|
add action=create-dynamic-enabled supported-bands=5ghz-ax \
|
|
master-configuration=cfg-main slave-configurations=cfg-iot,cfg-guest
|
|
|
|
# --- 7) SAFETY: Auto-Rollback, DANN vlan-filtering an ---
|
|
/system scheduler
|
|
add name=vlan-rollback interval=5m \
|
|
on-event="/interface bridge set [find name=bridge] vlan-filtering=no; /system scheduler remove vlan-rollback"
|
|
/interface bridge set [find name=bridge] vlan-filtering=yes
|
|
# Nach bestätigtem Zugriff: /system scheduler remove vlan-rollback
|