CAPsMAN in MikroTik: Centralized Wireless Management

Centralized Wireless Management with CAPsMAN

CAPsMAN (Controlled Access Point System Manager) is MikroTik's solution for managing multiple wireless access points from a single central controller. Instead of configuring each AP individually, you configure everything on the controller and push settings to all APs automatically.

How CAPsMAN Works

CAPsMAN Controller — a MikroTik router or device running the CAPsMAN manager. This is where all wireless configuration lives.
CAP (Controlled Access Point) — a MikroTik wireless device that connects to the controller and receives its configuration. The CAP itself has no local wireless config.
Communication between CAP and controller uses the MNDP/discovery protocol over Layer 2 (same network) or can be tunneled over IP.

Benefits Over Standalone AP Configuration

Change SSID, password, or security settings once — all APs update automatically
Central visibility of all connected clients across all APs
Seamless roaming (clients can move between APs without reconnecting)
Easier firmware updates across all APs
Consistent configuration — no risk of misconfigured individual APs

Setting Up the CAPsMAN Controller

Run these commands on your main MikroTik router (the controller):

Step 1: Enable the CAPsMAN Package

On RouterOS v7, CAPsMAN is built in. Just enable it:

TEXT

/caps-man manager set enabled=yes

Verify it is running:

TEXT

/caps-man manager print

Step 2: Create a Security Profile

TEXT

/caps-man security add name=sec-wpa2   authentication-types=wpa2-psk   passphrase=YourWiFiPassword123

Step 3: Create a Channel Configuration

TEXT

/caps-man channel add name=ch-2g band=2ghz-b/g/n frequency=2437 width=20mhz

For 5GHz:

TEXT

/caps-man channel add name=ch-5g band=5ghz-a/n/ac frequency=5180 width=80mhz

Step 4: Create a Datapath

The datapath controls how wireless traffic is forwarded:

TEXT

/caps-man datapath add name=dp-local local-forwarding=yes

local-forwarding=yes means clients' traffic is forwarded locally on the CAP (better performance, no tunnel to controller needed).

Step 5: Create a Configuration Profile

TEXT

/caps-man configuration add name=cfg-home   ssid=MyHomeNetwork   security=sec-wpa2   channel=ch-2g   datapath=dp-local   mode=ap

Step 6: Create Provisioning Rules

Provisioning rules tell CAPsMAN which configuration to assign to each CAP when it connects:

TEXT

/caps-man provisioning add action=create-dynamic-enabled master-configuration=cfg-home

This applies cfg-home to any CAP that connects to this controller.

Step 7: View Connected CAPs

TEXT

/caps-man remote-cap print

Setting Up a CAP Device

Run these on each access point that will be managed by CAPsMAN:

Step 1: Enable CAP Mode

TEXT

/interface wireless cap set enabled=yes   interfaces=wlan1   discovery-interfaces=ether1   caps-man-addresses=192.168.88.1

Parameters:

interfaces — the wireless interface to put under CAPsMAN control
discovery-interfaces — which interface to use to find the controller
caps-man-addresses — IP of the controller (leave empty for auto-discovery on same L2)

Step 2: Verify the CAP is Connected

On the controller:

TEXT

/caps-man remote-cap print

You should see the CAP listed with status running.

Multiple SSIDs with CAPsMAN

Create multiple configuration profiles and use virtual interfaces:

TEXT

/caps-man configuration add name=cfg-guest   ssid=GuestNetwork   security=sec-guest   datapath=dp-guest   mode=ap

/caps-man provisioning add action=create-dynamic-enabled   master-configuration=cfg-home   slave-configurations=cfg-guest

This creates two SSIDs on each CAP — main network and guest network.

Viewing Connected Wireless Clients

On the controller, see all clients across all APs:

TEXT

/caps-man registration-table print

CAPsMAN vs Standalone — When to Use Which

Situation	Recommendation
Single AP at home	Standalone (simpler)
2-3 APs in a home	Either works, CAPsMAN helps with consistency
Office with 5+ APs	CAPsMAN strongly recommended
Different VLANs per SSID	CAPsMAN (easier to manage)
Seamless roaming needed	CAPsMAN required

Troubleshooting

If a CAP is not connecting to the controller:

Check that both are on the same Layer 2 network, or set caps-man-addresses explicitly
Verify the CAPsMAN manager is enabled: /caps-man manager print
Check for firewall rules blocking UDP 5246 (CAPsMAN control port)
Confirm the wireless package is installed on the CAP

Summary

CAPsMAN centralizes wireless management for multiple APs
Controller runs /caps-man manager set enabled=yes
Define security, channel, datapath, and configuration profiles on the controller
Provisioning rules auto-assign configurations to connecting CAPs
CAPs run /interface wireless cap set enabled=yes
View all APs and clients from the controller with /caps-man remote-cap print