Deep coredeployed deep

Enterprise Wireless & CAPsMAN

Nikita Tarikin centrally manages MikroTik enterprise Wi-Fi with CAPsMAN — the Controlled Access Point system Manager — across both controller stacks, the legacy wireless-package manager and the newer wifi-package manager, with 802.11r/k/v fast roaming and WPA3 — at a production depth that already runs ahead of the published MikroTik Certified Enterprise Wireless Engineer syllabus (MTCEWE), an exam not yet taken.

The central-management stack runs end to end; the enterprise-wireless certificate is the part that is pending here, not the competence. The leaf ledger below marks the two thin spots — one studied a step past where it is run, one run a step past its textbook.

4.9
Knowledge K̄: 4.9
Deployment Ē: 38
leaves mapped: 1
studied-ahead: 1
deployed-ahead

Verified by MTCNA 100%MTCWE 92%

The map

Every enterprise-wireless and CAPsMAN leaf in the official MikroTik curriculum, placed by what is known against what is run in production. Almost every mark gathers in the upper-right mastery corner — studied and deployed to the same depth — because the central-management stack is operated end to end, across both the legacy and the modern controller. Two marks sit off the diagonal: one studied a step ahead of deployment, one deployed a notch ahead of its own textbook.

Read left-to-right as knowledge, bottom-to-top as deployment. The dense block in the upper-right is the deployed CAPsMAN stack — the two controllers, provisioning and datapath, fast roaming, WPA3 and the regulatory surface — run in production, and the figure beside it counts them. The one short drop-line below it is the long-distance acknowledgement-timeout, held a tier deeper than it is run; the lone up-tick above the diagonal is a legacy cipher operated a notch ahead of where its textbook quirk is held.

The topography

The full leaf-level ledger, grouped by topic — modern roaming and WPA3, the new wifi-package controller, access-point and station setup, the wireless tool-set and monitoring, troubleshooting, wireless security, the regulatory domain in CAPsMAN, and the central controller itself. Each row carries its own two verdicts — what is known and what is deployed — and the field note that earned them, quoted verbatim from the assessment.

Leaf	Knowledge	Deployment	Field note
Modern Roaming Management (802.11r FT · 802.11k/v · BTM steering)		K̄ 5.0 · Ē 5.0 · 1 leaf
Modern Roaming Management (802.11r FT · 802.11k/v · BTM steering)	5Teach	5Teach	802.11r FT + 802.11k/v + sticky-client/BTM — all Teach
WPA3-SAE / OWE Security		K̄ 5.0 · Ē 5.0 · 1 leaf
WPA3-SAE / OWE Security	5Teach	5Teach	WPA3-Personal SAE = PAKE resisting offline dictionary attack on the captured handshake; OWE = per-client encryption for OPEN networks. Security lens extends to wireless crypto
RouterOS v3 wifi Package (/interface/wifi)		K̄ 5.0 · Ē 5.0 · 3 leaves
v3 config model (profiles, provisioning, CAP/CAPsMAN roles)	5Teach	5Teach	/interface/wifi/cap (CAP role) + /interface/wifi/capsman (manager) + configuration profiles/provisioning rules + reusable named objects (configuration/security/channel/datapath)
v3 datapath evolution (local-only → on-capsman, ROS 7.21)	5Teach	5Teach	v3 wifi processes traffic LOCALLY at the CAP by default; central forwarding (datapath.traffic-processing=on-capsman) was ADDED in ROS 7.21 -- for years v3 was local-only. VERIFIED vs 7.21 changelog; tracks ROS wifi dev at changelog level
v3 band steering (2g-probe-delay)	5Teach	5Teach	/interface/wifi/steering 2g-probe-delay=yes delays 2.4GHz probe responses to make 5GHz preferable (PREFERENCE not enforcement -- client still decides). VERIFIED real (~7.18+, enhanced 7.21). EXCEEDED the question framing
AP & Station Configuration		K̄ 5.0 · Ē 5.0 · 4 leaves
Basic AP & station setup	5Teach	5Teach	mode=ap-bridge + band/frequency/SSID + security-profile.
Virtual AP (additional SSIDs)	5Teach	5Teach	VAPs share the master radio's channel/power/airtime; only SSID/security/VLAN differ per VAP.
Country regulation & TX-power	5Teach	5Teach	`country=` enforces allowed freqs, per-band EIRP, DFS/indoor rules + gates which channels are even selectable.
Advanced settings — HW-retries, adaptive-noise-immunity	5Teach	5Teach	adaptive-noise-immunity tunes the RX immunity thresholds to reject interference at a small sensitivity cost.
Wireless Tools & Monitoring		K̄ 5.0 · Ē 5.0 · 5 leaves
Scan & frequency usage	5Teach	5Teach	`frequency-usage` samples each channel for actual airtime occupancy % (vs `scan` listing APs). Added correct nuance: availability depends on the wireless chipset — exceeds the question.
Spectral scan & history	5Teach	5Teach	spectral-scan/history shows raw non-802.11 RF energy (microwave, radar, analog video, jammers). Confirms v1 Teach at leaf.
Snooper & sniffer	5Teach	5Teach	snooper/spectral-scan give per-freq utilization + noise floor; knows the operational caveat that they take the radio offline and drop associated clients
Align tool	5Teach	5Teach	align tool = special mode with a beeper whose pitch tracks signal, usable even before the link associates.
Registration table	5Teach	5Teach	tx/rx-ccq reveals interference/retries despite strong signal.
Wireless Troubleshooting		K̄ 5.0 · Ē 4.5 · 4 leaves · 1 split
ACK-timeout & distancestudied ahead	5Teach	3Confident	THE edge -- 4th knowledge-vs-experience split, the cleanest. Reasoned distance=ACK-timeout-vs-propagation correct but disclosed 'never fully understood, too abstract': all real links are sub-1km where it doesn't bite. Missed it in a PtP-troubleshooting frame (reflexively reached for NV2; trap = hidden-node needs >=3 nodes). Understood-but-never-deployed.
CCQ, TX/RX signal & signal-to-noise ratio	5Teach	5Teach	Low CCQ at strong RSSI = frames running below the link's theoretical rate from retransmits/interference.
Frames, HW-frames, HW-retries & data rates	5Teach	5Teach	hw-frames >> frames = heavy PHY-level retransmission/fragmentation, a poor-link signal.
Client troubleshooting & system log	5Teach	5Teach	Deauth reason code 3 = 'station leaving' → the CLIENT initiates the disconnect (roaming/power-save/driver), not the AP.
Wireless Security		K̄ 4.8 · Ē 5.0 · 6 leaves · 1 split
Authentication — open, shared; WPA-PSK / WPA2-PSK	5Teach	5Teach	PMF/802.11w protects mgmt frames vs deauth/disassoc spoofing. Security lens.
Encryption — WEP, WPA-TKIP, WPA2-AES & performancedeployed ahead	4Fluent	5Teach	Teach on the ciphers he deploys (WPA2-AES / WPA3 — cf. radius-eap Teach + MTCEWE WPA3). Honest don't-know on the TKIP-caps-HT-rates quirk — a cipher he deliberately PROHIBITS as a security engineer. The miss is a security-first signal, not a competence gap.
Access-list & connect-list	5Teach	5Teach	AP-side access-list gates association (default-authenticate=no), NOT station-side connect-list; default-forward=no isolates clients at L2; per-entry forwarding=yes exempts a pair
RADIUS & EAP (802.1X)	5Teach	5Teach	WPA2-Enterprise = per-user RADIUS creds, revoke one without re-keying all. MTCUME tie-in.
Management frame protection	5Teach	5Teach	802.11w PMF authenticates deauth/disassoc management frames so a forged disconnect is rejected. Modern, current (cf. MTCEWE currency).
Known-vulnerability mitigation	5Teach	5Teach	KRACK = nonce-reuse / key-reinstallation flaw in the 4-way handshake; mitigation = patch both client + AP. Security-engineer lens on wireless.
Country / Regulatory Domain in CAPsMAN		K̄ 5.0 · Ē 5.0 · 2 leaves
Antenna gain, max EIRP & CAP antenna gain	5Teach	5Teach	country sets per-freq max EIRP + DFS/indoor flags; RouterOS caps tx-power so tx-power+antenna-gain <= EIRP limit; DFS channels need radar CAC first
Country code & DFS / radar detect	5Teach	5Teach	radar event -> AP must vacate channel + re-run CAC elsewhere -> every CPE drops and re-converges = full sector outage; design lesson: avoid DFS for critical PtMP or engineer for re-convergence
CAPsMAN v2		K̄ 4.8 · Ē 4.8 · 12 leaves
CAPsMAN v2 features & CAP hardware/software requirements	5Teach	5Teach	CAP runs `/interface wireless cap` → points at the manager → provisioning overrides its local config. Not a co-controller.
L2 vs L3 communication & DHCP option 138	5Teach	5Teach	L3 CAP discovery via DHCP option 138 (CAPWAP AC address) or a configured caps-man-addresses list.
CAP configuration	5Teach	5Teach	Under management the manager's config/provisioning rules are authoritative; the CAP's local wireless settings are ignored.
CAP discovery & controller selection	5Teach	5Teach	default discovery is L2 broadcast/multicast; caps-man-addresses on the CAP enables L3 unicast to a distributed manager
SSL certificate authentication & locking	5Teach	5Teach	certificates TLS-authenticate the CAP<->manager control channel (prevents rogue manager/CAP); manager can auto-issue certs or use a CA. Security lens
Auto-upgrading & config security	5Teach	5Teach	CAP↔manager secured by certificate DTLS (require-peer-certificate); manager can push matching RouterOS to CAPs.
CAPsMAN channel, datapath, security & data-rate settings	5Teach	5Teach	Datapath = bridging/VLAN/forwarding; local-forwarding=yes bridges+tags at the CAP, =no tunnels to the manager. v1 LOCAL-forwarding datapath edge CLOSED.
CAP interface provisioning — single & dual band	5Teach	5Teach	provisioning rule matches the CAP (identity/common-name/radio-mac/hw) -> master-configuration + slaves -> action creates dynamic radio interfaces
Datapath & local forwarding	3Confident	3Confident	EDGE (the one miss): thought VLAN is always applied at the manager; actually LOCAL forwarding tags at the CAP (datapath vlan-id, CAP uplink trunks it) while only MANAGER/central forwarding applies it centrally. Likely his v2 prod uses central forwarding; deep v3 currency (local-at-CAP norm) didn't map to v2's local-VLAN nuance
Dynamic vs static CAP interfaces	5Teach	5Teach	Static CAP interfaces = stable named handles for firewall/bridge/VLAN refs that survive reconnection (dynamic ones re-enumerate).
Static slave interfaces with VLANs	5Teach	5Teach	Per-SSID datapath vlan-mode=use-tag + vlan-id + local-forwarding → each SSID tags its VLAN onto the CAP's trunk. Closes the v1 per-SSID-VLAN miss.
CAPsMAN access-list features	5Teach	5Teach	CAPsMAN access-list = central, fleet-wide admission policy at the manager (MAC/signal/interface match) vs the per-AP standalone list.

The edges

The daylight here runs in both directions, and narrows to a single leaf each way. On the studied-ahead side is the long-distance acknowledgement-timeout: reasoned correctly, but never deployed at the range where it actually bites, because the deployed links sit inside the sub-kilometre profile. The rarer direction runs the other way — one legacy cipher graded a tier below where it is deployed, because it is a cipher kept off the network by deliberate choice as a security engineer rather than a competence gap. Each note below is quoted exactly as the assessment recorded it.

Knowledge ahead of deployment

Known deeper than it currently runs — named, not rounded over.

ACK-timeout & distanceknow 5 Teach→run 3 Confident
THE edge -- 4th knowledge-vs-experience split, the cleanest. Reasoned distance=ACK-timeout-vs-propagation correct but disclosed 'never fully understood, too abstract': all real links are sub-1km where it doesn't bite. Missed it in a PtP-troubleshooting frame (reflexively reached for NV2; trap = hidden-node needs >=3 nodes). Understood-but-never-deployed.
Known
ack-timeout/distance mechanism reasoned correct
Run
never deployed (all real links <1 km)

Deployed ahead of the textbook

Run in production a notch beyond the studied internals — the rarer direction.

Encryption — WEP, WPA-TKIP, WPA2-AES & performanceknow 4 Fluent→run 5 Teach
Teach on the ciphers he deploys (WPA2-AES / WPA3 — cf. radius-eap Teach + MTCEWE WPA3). Honest don't-know on the TKIP-caps-HT-rates quirk — a cipher he deliberately PROHIBITS as a security engineer. The miss is a security-first signal, not a competence gap.

The warrant

Third-party verification of the wireless foundation beneath this stack — the network-associate and wireless-engineer exams stand behind it as amplifiers, never substitutes. The enterprise-wireless exam, the one specific to this page, is recorded as not yet taken: the CAPsMAN command above already runs past its published syllabus, so what is pending here is the sitting, not the work.

MTCEWEEnterprise Wireless Engineer — in progress / not yet taken
MTCNAVerified — 100%, Network Associate
MTCWEVerified — 92%, Wireless Engineer

Enterprise Wi-Fi shares its radio with the outdoor link. Where it connects:

The questions

Do you run CAPsMAN in production — and which controller?

Both, and that is the point of this page: I centrally manage MikroTik Wi-Fi fleets with CAPsMAN (Controlled Access Point system Manager) on both controller stacks at teaching depth, ahead of the MTCEWE exam I have not yet sat. The public mechanism — and the first thing a fleet design turns on — is that MikroTik ships CAPsMAN as two separate, non-interchangeable systems, one per wireless package. The legacy controller lives under /caps-man, with CAPs enabled through /interface wireless cap (the same legacy wireless driver that carries my outdoor links — see the wireless RF page); the modern controller lives under /interface/wifi/capsman, with CAPs enabled through /interface/wifi/cap. A WiFi CAP can only join a WiFi CAPsMAN, and a legacy CAP only a legacy CAPsMAN — and since RouterOS 7.13 both managers can run on a single device, but only if the legacy wireless package is also installed. Knowing which stack a given access point’s chipset forces you onto is half the deployment.

How do you do seamless roaming — 802.11r/k/v — on RouterOS?

Deployed and graded at teaching depth. The mechanism, publicly: in the wifi package fast roaming is 802.11r Fast BSS Transition (FT), and the detail that trips most people is that it is configured on the security profile, not the configuration profile — /interface/wifi/security with ft=yes and ft-over-ds=yes (both default to no). ft-over-ds exchanges the roaming keys across the wired distribution system rather than over the air. CAPsMAN places every access point that shares a security profile into the same mobility domain (ft-mobility-domain, default 44484), so a client pre-authenticates with the target AP before it roams — collapsing the handoff from the couple-hundred-millisecond full reauthentication down to a few-to-a-few-tens of milliseconds. 802.11k feeds clients neighbour reports so they know where to roam, and 802.11v lets the controller steer a client toward a better AP. Two caveats I account for, both from MikroTik’s own documentation: the 802.11r properties apply only to AP-mode interfaces, and 802.11r does not work over OWE (open) networks.

Why is there no “verified by MTCEWE” stamp if you run all this?

Because the exam is not yet taken — and this is the one place on the map where the deployment runs ahead of the credential rather than behind it. The wireless foundation is verified: MTCNA and MTCWE both stand on the warrant above. The enterprise-specific exam, MTCEWE (MikroTik Certified Enterprise Wireless Engineer), I simply have not sat, while what I run already reaches past its published outline — WPA3-SAE, 802.11w management-frame protection, and the modern wifi-package controller. The public mechanism behind those: WPA3-Personal on RouterOS is SAE (Simultaneous Authentication of Equals), set with authentication-types=wpa3-psk, and turning on management-protection=required forces 802.11w protected management frames, so a forged deauthentication is rejected; encryption moves to CCMP or GCMP and the SAE password element is derived per sae-pwe (hash-to-element). I lab an exam’s corners before I claim them, and I will sit MTCEWE — the running stack is just the evidence that arrives first.

How do the two CAPsMAN controllers differ in forwarding client traffic?

This is the design decision that bites in a multi-VLAN deployment, and one I keep current across both stacks. Publicly: the legacy wireless-package controller carries an explicit switch on the datapath — local-forwarding=yes bridges and tags traffic at the CAP, while local-forwarding=no tunnels it back to the manager for central forwarding. In the newer wifi-package controller that switch is gone: the datapath object has no local-forwarding parameter, so CAPs always forward locally through the bridge named in the datapath profile, and VLANs are applied by vlan-id on the datapath together with each CAP’s own bridge VLAN table. Same goal — per-SSID VLAN segmentation — reached two different ways, which is exactly the kind of cross-stack detail a fleet migration turns on, and the one nuance I will check against the live config rather than assume.

Bring the wireless fleet.

If it is centrally managed Wi-Fi on RouterOS — CAPsMAN provisioning across either package, fast roaming, WPA3, or per-SSID VLAN segmentation — that is ground I run in production. The enterprise-wireless certificate is still ahead of me, not the work; either way you hear where my line sits before the engagement starts, not after.

Start the conversation