KitsNet Network:LAN:absolut:CAPsMAN Migration: Difference between revisions

Back to version history
← Older edit
VisualWikitext
Peter A. Smode (talk | contribs)
administrator, Bureaucrats, family, kitsnet_adm, Administrators
2,612 edits
No edit summary
Peter A. Smode (talk | contribs)
administrator, Bureaucrats, family, kitsnet_adm, Administrators
2,612 edits
 
(10 intermediate revisions by the same user not shown)
Line 1: Line 1:


= CAPsMAN Migration Plan (Interim → Final) =
= CAPsMAN Migration: Courvoisier → Absolut =
Courvoisier → Absolut (CHR)


This revision reflects the updated priority:
This document describes the complete migration of CAPsMAN control from
'''courvoisier''' to the CHR instance '''absolut''' while preserving the existing
DHCP architecture and ensuring that wireless client traffic does not
traverse the CHR in the final design.


# Complete the CAPsMAN migration first
The migration is performed in two stages:
# Temporary Guest-path inefficiency during migration is acceptable
 
# By the final state, client traffic must stay off Absolut
# '''Interim migration state''' – CAPsMAN moves to Absolut while Guest traffic may temporarily traverse the CHR.
# Courvoisier must continue serving the KitsNetGN guest DHCP scope
# '''Final controller-only state''' – wireless client traffic no longer passes through Absolut.
# Main SSID DHCP continues to come from radix.kitsnet.us (192.168.15.1)
# Avoid mixing large redesign work into the controller cutover


----
----
== Supporting Configuration Patch Files ==


== Why this staged plan is needed ==
* [[File:Courvoisier-final-post-migration-patch.rsc.txt]]
* [[File:Absolut-final-controller-only-patch.rsc.txt]]
* [[File:Courvoisier-interim-guest-transport-patch.rsc.txt]]
* [[File:Absolut-interim-migration-patch.rsc.txt]]
----


The current configuration shows:
== Architecture Context ==


* Courvoisier central‑forwards Guest to BWF.KitsNetG and serves Guest DHCP there.
{| class="wikitable"
* Main SSID traffic lives on the main bridge where Radix provides DHCP.
! Component !! Role
* Absolut currently has datapaths configured for local forwarding and does not yet replicate the Guest bridge design.
|-
* Baker 2.4 GHz provisioning lacks the IoT SSID compared with Able.
| '''absolut'''
| CAPsMAN controller (control plane only)
|-
| '''courvoisier'''
| edge router and Guest DHCP server
|-
| '''radix.kitsnet.us (192.168.15.1)'''
| DHCP server for main LAN and IoT network
|}


Because of this the migration uses two stages:
Wireless data traffic should remain on the physical LAN through the CAP
devices and should not traverse the CHR once migration is complete.


* '''Interim state''' – Guest traffic temporarily traverses Absolut but is bridged back to Courvoisier so DHCP remains there.
----
* '''Final state''' – Guest traffic no longer traverses Absolut once an off‑CHR L2 path exists.
 
== SSID Design ==
 
{| class="wikitable"
! SSID !! Purpose !! DHCP Source
|-
| '''KitsNet'''
| trusted WLAN
| radix.kitsnet.us
|-
| '''KitsNetIN'''
| IoT network
| radix.kitsnet.us
|-
| '''KitsNetGN'''
| guest WLAN
| courvoisier
|}


----
----


== Stage A — Interim Migration State ==
== Preconditions ==


=== Design intent ===
Before beginning the migration verify:


* '''KitsNet''' – locally forwarded; DHCP from Radix on the LAN
=== CAP registration ===
* '''KitsNetIN''' – unchanged during migration
 
* '''KitsNetGN''' – temporarily central‑forwarded via Absolut then bridged back to Courvoisier
On '''courvoisier''':
 
<pre>
/caps-man remote-cap print detail
</pre>
 
Expected:
 
* able – Run
* baker – Run
 
=== CAP configuration ===
 
On '''able''' and '''baker''':
 
<pre>
/interface wireless cap print
</pre>


This keeps the network functional while moving CAPsMAN.
Verify:


=== Interim prerequisites ===
<pre>
enabled: yes
lock-to-caps-man: no
caps-man-addresses: 192.168.15.6
</pre>


# Import Courvoisier CAPsMAN certificate and CA into Absolut
=== Guest DHCP ===
# Enable CAPsMAN on Absolut
# Create temporary Guest EoIP link between Absolut and Courvoisier
# Set DP.KitsNetG to central forwarding during migration
# Keep DP.KitsNet locally forwarded
# Correct Baker 2.4 GHz provisioning symmetry


=== Interim cutover sequence ===
On '''courvoisier''':


# Prepare Guest EoIP bridge on both routers
<pre>
# Verify Absolut CAPsMAN configuration
/ip dhcp-server print detail
# Move Able to Absolut
</pre>
# Validate Able
# Move Baker to Absolut
# Validate Baker
# Disable CAPsMAN on Courvoisier
# Re‑lock CAPs


=== Interim success criteria ===
Confirm the DHCP server is bound to bridge:


* Able and Baker show '''Run''' on Absolut
<pre>
* KitsNet clients obtain DHCP from Radix
BWF.KitsNetG
* KitsNetGN clients obtain DHCP from Courvoisier
</pre>
* IoT devices remain functional
* Only Guest traffic temporarily traverses Absolut


----
----


== Stage B — Final Controller‑Only State ==
== CAPsMAN Certificate Migration ==
 
The CAPsMAN controller identity must be preserved during migration.
The active CAPsMAN certificate and CA must be copied from '''courvoisier'''
to '''absolut'''.
 
This avoids CAP authentication failures or WPA handshake problems.
 
=== Step 1 – Identify certificates ===
 
On '''courvoisier''':
 
<pre>
[admin@Courvoisier] > /certificate print
Flags: K - PRIVATE-KEY; A - AUTHORITY; I - ISSUED; T - TRUSTED
Columns: NAME, COMMON-NAME, SKID
#      NAME                          COMMON-NAME                  SKID
0 KA T CAPsMAN-CA-488F5A87BE5A      CAPsMAN-CA-488F5A87BE5A      b96a4f946961524e913ad4703868303a0dd23c9b
1 K I  CAPsMAN-488F5A87BE5A          CAPsMAN-488F5A87BE5A          cf5b50d734e8ef10c1257577bb6783890c06b55c
2  I  CAP-08553163AC8E              CAP-08553163AC8E              71c4e6af7e09cf386dad50ec271c41f9e6a62e7a
3  I  CAP-08553163A40F              CAP-08553163A40F              d7123f8e1e7d616edbc4b7bda20a610ed5becd0b
4 KA T WiFi-CAPsMAN-CA-488F5A87BE5A  WiFi-CAPsMAN-CA-488F5A87BE5A  c65a58c80dd0ee06a84721ca46439882b5157fea
5 K I  WiFi-CAPsMAN-488F5A87BE5A    WiFi-CAPsMAN-488F5A87BE5A    caaa1c14fd8e0ee03458616e450cc81d85706cca
</pre>


=== Design intent ===
Identify:


By the end state, Absolut acts only as the CAPsMAN controller.
* CAPsMAN certificate
* CA certificate


Requirements:
TWe want:


* DP.KitsNetG changed back to '''local‑forwarding=yes'''
<pre>
* Temporary EoIP bridge removed
WiFi-CAPsMAN-CA-488F5A87BE5A
* Guest L2 path provided elsewhere on the wired network
WiFi-CAPsMAN-488F5A87BE5A
</pre>


=== Final transition sequence ===
----


# Prepare off‑CHR Guest L2 transport
=== Step 2 – Export certificates ===
# Change DP.KitsNetG back to local forwarding
# Remove temporary EoIP bridge on Absolut
# Remove EoIP on Courvoisier
# Validate Guest DHCP and isolation


=== Final success criteria ===
On '''courvoisier''':


* CAPs remain attached to Absolut
<pre>
* Main SSID DHCP still provided by Radix
/certificate export-certificate WiFi-CAPsMAN-488F5A87BE5A export-passphrase=StrongPass
* Guest DHCP still provided by Courvoisier
/certificate export-certificate WiFi-CAPsMAN-CA-488F5A87BE5A export-passphrase=StrongPass
* No client traffic passes through Absolut
</pre>
* Temporary EoIP removed
 
Generated files will appear in:
 
<pre>
[admin@Courvoisier] > /file print
# NAME                                                                                  TYPE            SIZE LAST-MODIFIED
0 cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.key                                          .key file        497 2026-03-14 13:23:47
1 cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.crt                                          .crt file        672 2026-03-14 13:23:47
2 cert_export_WiFi-CAPsMAN-488F5A87BE5A.key                                              .key file        497 2026-03-14 13:23:07
3 cert_export_WiFi-CAPsMAN-488F5A87BE5A.crt                                              .crt file        688 2026-03-14 13:23:07
4 flash                                                                                  disk                  2026-03-14 00:00:34
5 flash/Courvoisier-export.rsc                                                          script        29.7KiB 2026-03-14 00:00:34
6 flash/skins                                                                            directory            2106-02-07 02:28:42
7 flash/auto-before-reset.backup                                                        backup        18.7KiB 2106-02-07 02:28:48
8 flash/pub                                                                              directory            2020-09-11 01:10:52
9 flash/Courvoisier-daily.backup                                                        backup      114.3KiB 2026-03-14 00:00:01
</pre>
 
Exported files:
 
* cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.key
* cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.crt
* cert_export_WiFi-CAPsMAN-488F5A87BE5A.key
* cert_export_WiFi-CAPsMAN-488F5A87BE5A.crt


----
----


== Detailed Execution ==
=== Step 3 – Transfer certificates to Absolut ===
 
Copy the files to '''absolut''' using:
 
* WinBox file transfer
* SCP
* FTP
 
Example using SCP:
 
<pre>
scp *.crt admin@absolut:/
scp *.key admin@absolut:/
</pre>''This had to be done using a Linux system as a waystation because RouterOS had no scp client.''
----


=== Phase 0 — Pre‑checks ===
=== Step 4 – Import certificates on Absolut ===


On Courvoisier:
On '''absolut''':


<pre>
<pre>
/caps-man remote-cap print detail
/certificate import file-name=cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.crt passphrase=StrongPass
/caps-man datapath print detail
/certificate import file-name=cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.key passphrase=StrongPass
/ip dhcp-server print detail
 
/ip address print
/certificate import file-name=cert_export_WiFi-CAPsMAN-488F5A87BE5A.crt passphrase=StrongPass
/certificate import file-name=cert_export_WiFi-CAPsMAN-488F5A87BE5A.key passphrase=StrongPass
</pre>
</pre>


Confirm both CAPs connected and Guest DHCP bound to BWF.KitsNetG.
Verify:
 
<pre>
[admin@Absolut] > /certificate print
Flags: K - PRIVATE-KEY; A - AUTHORITY; T - TRUSTED
Columns: NAME, COMMON-NAME, SKID
#    NAME                                            COMMON-NAME                  SKID
0 KAT cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.crt_0  WiFi-CAPsMAN-CA-488F5A87BE5A  c65a58c80dd0ee06a84721ca46439882b5157fea
1 K T cert_export_WiFi-CAPsMAN-488F5A87BE5A.crt_0    WiFi-CAPsMAN-488F5A87BE5A    caaa1c14fd8e0ee03458616e450cc81d85706cca
</pre>Note that the SKIDs on '''absolut''' match those on '''courvoisier'''.


On Able and Baker:
''There were some crap autogenerated certificates from prior to migration, but i elected to remove those now.''
----
 
=== Step 5 – Assign certificates to CAPsMAN ===
 
On '''absolut''':


<pre>
<pre>
/interface wireless cap print
/caps-man manager set \
certificate=cert_export_WiFi-CAPsMAN-488F5A87BE5A.crt_0 \
ca-certificate=cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.crt_0 \
enabled=yes
</pre>
</pre>


Line 124: Line 240:


<pre>
<pre>
enabled: yes
[admin@Absolut] > /caps-man manager print
lock-to-caps-man: no
                  enabled: yes
caps-man-addresses: 192.168.15.6
              certificate: cert_export_WiFi-CAPsMAN-488F5A87BE5A.crt_0
            ca-certificate: cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.crt_0
              package-path:
            upgrade-policy: none
  require-peer-certificate: no
    generated-certificate: *2
  generated-ca-certificate: *1
</pre>The *1 and *2 references are the autogenerated certs that i removed. they are not used and this is supposed to be harmless.  
----
 
== Stage A – Interim Migration State ==
 
During migration Guest traffic may temporarily traverse Absolut in order
to maintain connectivity with the Guest DHCP server on courvoisier.
 
=== Prepare Absolut ===
 
Create temporary Guest bridge:
 
<pre>
/interface bridge add name=BWF.KitsNetG
</pre>
</pre>


On Absolut:
Create EoIP tunnel to courvoisier:


<pre>
<pre>
/caps-man manager print
/interface eoip add name=EOIP.KitsNetG.to.Courvoisier \
/caps-man datapath print detail
local-address=192.168.15.10 \
/caps-man provisioning print detail
remote-address=192.168.15.6 \
tunnel-id=120
</pre>
</pre>


----
Attach the tunnel to the bridge:


=== Phase 1 — Prepare Absolut ===
<pre>
/interface bridge port add bridge=BWF.KitsNetG interface=EOIP.KitsNetG.to.Courvoisier
</pre>


Apply the interim Absolut migration patch which:
Update the Guest datapath:


* enables CAPsMAN
<pre>
* creates temporary Guest bridge
/caps-man datapath set [find name="DP.KitsNetG"] local-forwarding=no bridge=BWF.KitsNetG
* creates EoIP tunnel
</pre>
* sets Guest datapath to central forwarding
* fixes Baker provisioning


----
----


=== Phase 2 — Prepare Courvoisier ===
=== Prepare Courvoisier ===
 
Create the matching EoIP interface:
 
<pre>
/interface eoip add name=EOIP.KitsNetG.to.Absolut \
local-address=192.168.15.6 \
remote-address=192.168.15.10 \
tunnel-id=120
</pre>


Apply the interim Guest transport patch.
Attach to Guest bridge:


This creates the matching EoIP interface and adds it to BWF.KitsNetG.
<pre>
/interface bridge port add bridge=BWF.KitsNetG interface=EOIP.KitsNetG.to.Absolut
</pre>


----
----


=== Phase 3 — Migrate Able ===
== Migration Procedure ==
 
=== Step 1 – Move Able ===
 
On '''able''':


<pre>
<pre>
/interface wireless cap set caps-man-addresses=&lt;ABSOLUT_IP&gt;
/interface wireless cap set caps-man-addresses=192.168.15.10
</pre>
</pre>


Validate on Absolut:
Verify on Absolut:


<pre>
<pre>
/caps-man remote-cap print
/caps-man remote-cap print
/caps-man interface print
/caps-man interface print
/caps-man registration-table print
</pre>
</pre>


Rollback if necessary:
Test:
 
* KitsNet connectivity
* Guest DHCP
* IoT connectivity
 
Rollback if needed:


<pre>
<pre>
Line 181: Line 338:
----
----


=== Phase 4 — Migrate Baker ===
=== Step 2 – Move Baker ===


Repeat the same command on Baker.
On '''baker''':
 
<pre>
/interface wireless cap set caps-man-addresses=192.168.15.10
</pre>
 
Verify both CAPs:
 
<pre>
/caps-man remote-cap print
</pre>


----
----


=== Phase 5 — Retire Courvoisier CAPsMAN ===
=== Step 3 – Disable CAPsMAN on Courvoisier ===
 
Once both CAPs are stable:


<pre>
<pre>
Line 193: Line 362:
</pre>
</pre>


Then re‑lock the CAPs.
Lock CAPs:


<pre>
/interface wireless cap set lock-to-caps-man=yes
</pre>'''''We cannot lock to caps yet becuase we don't have certificate locking working. I tried this now and Able would not associate with CAPsMAN at all. this has to wait for a post-migration activity.'''''
----
----


=== Phase 6 — Final cleanup later ===
== Validation ==


After the off‑CHR Guest path exists:
On '''absolut''':


# Apply Absolut final controller patch
<pre>
# Apply Courvoisier cleanup patch
/caps-man registration-table print
# Verify DHCP and isolation
</pre>
 
On '''courvoisier''':
 
<pre>
/ip dhcp-server lease print
</pre>
 
Verify:
 
* clients on KitsNet obtain DHCP from Radix
* guest clients obtain DHCP from Courvoisier
* CAPs remain connected to Absolut


----
----


== Scope notes ==
== Rollback ==
 
If migration fails revert CAPs to Courvoisier.


Included:
On CAP:


* CAPsMAN migration
<pre>
* Temporary Guest bridge
/interface wireless cap set caps-man-addresses=192.168.15.6
* Baker provisioning fix
</pre>
 
Re-enable CAPsMAN:
 
<pre>
/caps-man manager set enabled=yes
</pre>
 
----
 
== Stage B – Final Controller-Only State ==
 
After a permanent Guest L2 path exists outside the CHR:
 
On '''absolut''':
 
<pre>
/caps-man datapath set [find name="DP.KitsNetG"] local-forwarding=yes
</pre>
 
Remove temporary EoIP:
 
<pre>
/interface bridge port remove [find interface="EOIP.KitsNetG.to.Courvoisier"]
/interface eoip remove EOIP.KitsNetG.to.Courvoisier
/interface bridge remove BWF.KitsNetG
</pre>
 
On '''courvoisier''':
 
<pre>
/interface bridge port remove [find interface="EOIP.KitsNetG.to.Absolut"]
/interface eoip remove EOIP.KitsNetG.to.Absolut
</pre>
 
----


Deferred:
== Final State ==


* VLAN redesign
* Absolut runs CAPsMAN only
* IoT policy redesign
* Courvoisier continues Guest DHCP
* channel plan changes
* Radix provides LAN DHCP
* CAPs locally forward client traffic
* No wireless data traffic traverses the CHR

Latest revision as of 15:05, 14 March 2026

1 CAPsMAN Migration: Courvoisier → Absolut[edit | edit source]

This document describes the complete migration of CAPsMAN control from courvoisier to the CHR instance absolut while preserving the existing DHCP architecture and ensuring that wireless client traffic does not traverse the CHR in the final design.

The migration is performed in two stages:

  1. Interim migration state – CAPsMAN moves to Absolut while Guest traffic may temporarily traverse the CHR.
  2. Final controller-only state – wireless client traffic no longer passes through Absolut.

1.1 Supporting Configuration Patch Files[edit | edit source]

1.2 Architecture Context[edit | edit source]

Component Role
absolut CAPsMAN controller (control plane only)
courvoisier edge router and Guest DHCP server
radix.kitsnet.us (192.168.15.1) DHCP server for main LAN and IoT network

Wireless data traffic should remain on the physical LAN through the CAP devices and should not traverse the CHR once migration is complete.

1.3 SSID Design[edit | edit source]

SSID Purpose DHCP Source
KitsNet trusted WLAN radix.kitsnet.us
KitsNetIN IoT network radix.kitsnet.us
KitsNetGN guest WLAN courvoisier

1.4 Preconditions[edit | edit source]

Before beginning the migration verify:

1.4.1 CAP registration[edit | edit source]

On courvoisier: 

/caps-man remote-cap print detail

Expected:

  • able – Run
  • baker – Run

1.4.2 CAP configuration[edit | edit source]

On able and baker: 

/interface wireless cap print

Verify: 

enabled: yes
lock-to-caps-man: no
caps-man-addresses: 192.168.15.6

1.4.3 Guest DHCP[edit | edit source]

On courvoisier: 

/ip dhcp-server print detail

Confirm the DHCP server is bound to bridge: 

BWF.KitsNetG

1.5 CAPsMAN Certificate Migration[edit | edit source]

The CAPsMAN controller identity must be preserved during migration. The active CAPsMAN certificate and CA must be copied from courvoisier to absolut.

This avoids CAP authentication failures or WPA handshake problems.

1.5.1 Step 1 – Identify certificates[edit | edit source]

On courvoisier: 

[admin@Courvoisier] > /certificate print
Flags: K - PRIVATE-KEY; A - AUTHORITY; I - ISSUED; T - TRUSTED
Columns: NAME, COMMON-NAME, SKID
#      NAME                          COMMON-NAME                   SKID
0 KA T CAPsMAN-CA-488F5A87BE5A       CAPsMAN-CA-488F5A87BE5A       b96a4f946961524e913ad4703868303a0dd23c9b
1 K I  CAPsMAN-488F5A87BE5A          CAPsMAN-488F5A87BE5A          cf5b50d734e8ef10c1257577bb6783890c06b55c
2   I  CAP-08553163AC8E              CAP-08553163AC8E              71c4e6af7e09cf386dad50ec271c41f9e6a62e7a
3   I  CAP-08553163A40F              CAP-08553163A40F              d7123f8e1e7d616edbc4b7bda20a610ed5becd0b
4 KA T WiFi-CAPsMAN-CA-488F5A87BE5A  WiFi-CAPsMAN-CA-488F5A87BE5A  c65a58c80dd0ee06a84721ca46439882b5157fea
5 K I  WiFi-CAPsMAN-488F5A87BE5A     WiFi-CAPsMAN-488F5A87BE5A     caaa1c14fd8e0ee03458616e450cc81d85706cca

Identify:

  • CAPsMAN certificate
  • CA certificate

TWe want: 

WiFi-CAPsMAN-CA-488F5A87BE5A
WiFi-CAPsMAN-488F5A87BE5A

1.5.2 Step 2 – Export certificates[edit | edit source]

On courvoisier: 

/certificate export-certificate WiFi-CAPsMAN-488F5A87BE5A export-passphrase=StrongPass
/certificate export-certificate WiFi-CAPsMAN-CA-488F5A87BE5A export-passphrase=StrongPass

Generated files will appear in: 

[admin@Courvoisier] > /file print
 # NAME                                                                                   TYPE             SIZE LAST-MODIFIED
 0 cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.key                                           .key file         497 2026-03-14 13:23:47
 1 cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.crt                                           .crt file         672 2026-03-14 13:23:47
 2 cert_export_WiFi-CAPsMAN-488F5A87BE5A.key                                              .key file         497 2026-03-14 13:23:07
 3 cert_export_WiFi-CAPsMAN-488F5A87BE5A.crt                                              .crt file         688 2026-03-14 13:23:07
 4 flash                                                                                  disk                  2026-03-14 00:00:34
 5 flash/Courvoisier-export.rsc                                                           script        29.7KiB 2026-03-14 00:00:34
 6 flash/skins                                                                            directory             2106-02-07 02:28:42
 7 flash/auto-before-reset.backup                                                         backup        18.7KiB 2106-02-07 02:28:48
 8 flash/pub                                                                              directory             2020-09-11 01:10:52
 9 flash/Courvoisier-daily.backup                                                         backup       114.3KiB 2026-03-14 00:00:01

Exported files:

  • cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.key
  • cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.crt
  • cert_export_WiFi-CAPsMAN-488F5A87BE5A.key
  • cert_export_WiFi-CAPsMAN-488F5A87BE5A.crt

1.5.3 Step 3 – Transfer certificates to Absolut[edit | edit source]

Copy the files to absolut using:

  • WinBox file transfer
  • SCP
  • FTP

Example using SCP: 

scp *.crt admin@absolut:/
scp *.key admin@absolut:/

This had to be done using a Linux system as a waystation because RouterOS had no scp client.

1.5.4 Step 4 – Import certificates on Absolut[edit | edit source]

On absolut: 

/certificate import file-name=cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.crt passphrase=StrongPass
/certificate import file-name=cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.key passphrase=StrongPass

/certificate import file-name=cert_export_WiFi-CAPsMAN-488F5A87BE5A.crt passphrase=StrongPass
/certificate import file-name=cert_export_WiFi-CAPsMAN-488F5A87BE5A.key passphrase=StrongPass

Verify: 

[admin@Absolut] > /certificate print
Flags: K - PRIVATE-KEY; A - AUTHORITY; T - TRUSTED
Columns: NAME, COMMON-NAME, SKID
#     NAME                                            COMMON-NAME                   SKID
0 KAT cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.crt_0  WiFi-CAPsMAN-CA-488F5A87BE5A  c65a58c80dd0ee06a84721ca46439882b5157fea
1 K T cert_export_WiFi-CAPsMAN-488F5A87BE5A.crt_0     WiFi-CAPsMAN-488F5A87BE5A     caaa1c14fd8e0ee03458616e450cc81d85706cca

Note that the SKIDs on absolut match those on courvoisier.

There were some crap autogenerated certificates from prior to migration, but i elected to remove those now.

1.5.5 Step 5 – Assign certificates to CAPsMAN[edit | edit source]

On absolut: 

/caps-man manager set \
certificate=cert_export_WiFi-CAPsMAN-488F5A87BE5A.crt_0 \
ca-certificate=cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.crt_0 \
enabled=yes

Verify: 

[admin@Absolut] > /caps-man manager print
                   enabled: yes
               certificate: cert_export_WiFi-CAPsMAN-488F5A87BE5A.crt_0
            ca-certificate: cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.crt_0
              package-path:
            upgrade-policy: none
  require-peer-certificate: no
     generated-certificate: *2
  generated-ca-certificate: *1

The *1 and *2 references are the autogenerated certs that i removed. they are not used and this is supposed to be harmless.

1.6 Stage A – Interim Migration State[edit | edit source]

During migration Guest traffic may temporarily traverse Absolut in order to maintain connectivity with the Guest DHCP server on courvoisier.

1.6.1 Prepare Absolut[edit | edit source]

Create temporary Guest bridge: 

/interface bridge add name=BWF.KitsNetG

Create EoIP tunnel to courvoisier: 

/interface eoip add name=EOIP.KitsNetG.to.Courvoisier \
 local-address=192.168.15.10 \
 remote-address=192.168.15.6 \
 tunnel-id=120

Attach the tunnel to the bridge: 

/interface bridge port add bridge=BWF.KitsNetG interface=EOIP.KitsNetG.to.Courvoisier

Update the Guest datapath: 

/caps-man datapath set [find name="DP.KitsNetG"] local-forwarding=no bridge=BWF.KitsNetG

1.6.2 Prepare Courvoisier[edit | edit source]

Create the matching EoIP interface: 

/interface eoip add name=EOIP.KitsNetG.to.Absolut \
 local-address=192.168.15.6 \
 remote-address=192.168.15.10 \
 tunnel-id=120

Attach to Guest bridge: 

/interface bridge port add bridge=BWF.KitsNetG interface=EOIP.KitsNetG.to.Absolut

1.7 Migration Procedure[edit | edit source]

1.7.1 Step 1 – Move Able[edit | edit source]

On able: 

/interface wireless cap set caps-man-addresses=192.168.15.10

Verify on Absolut: 

/caps-man remote-cap print
/caps-man interface print

Test:

  • KitsNet connectivity
  • Guest DHCP
  • IoT connectivity

Rollback if needed: 

/interface wireless cap set caps-man-addresses=192.168.15.6

1.7.2 Step 2 – Move Baker[edit | edit source]

On baker: 

/interface wireless cap set caps-man-addresses=192.168.15.10

Verify both CAPs: 

/caps-man remote-cap print

1.7.3 Step 3 – Disable CAPsMAN on Courvoisier[edit | edit source]

Once both CAPs are stable: 

/caps-man manager set enabled=no

Lock CAPs: 

/interface wireless cap set lock-to-caps-man=yes

We cannot lock to caps yet becuase we don't have certificate locking working. I tried this now and Able would not associate with CAPsMAN at all. this has to wait for a post-migration activity.

1.8 Validation[edit | edit source]

On absolut: 

/caps-man registration-table print

On courvoisier: 

/ip dhcp-server lease print

Verify:

  • clients on KitsNet obtain DHCP from Radix
  • guest clients obtain DHCP from Courvoisier
  • CAPs remain connected to Absolut

1.9 Rollback[edit | edit source]

If migration fails revert CAPs to Courvoisier.

On CAP: 

/interface wireless cap set caps-man-addresses=192.168.15.6

Re-enable CAPsMAN: 

/caps-man manager set enabled=yes

1.10 Stage B – Final Controller-Only State[edit | edit source]

After a permanent Guest L2 path exists outside the CHR:

On absolut: 

/caps-man datapath set [find name="DP.KitsNetG"] local-forwarding=yes

Remove temporary EoIP: 

/interface bridge port remove [find interface="EOIP.KitsNetG.to.Courvoisier"]
/interface eoip remove EOIP.KitsNetG.to.Courvoisier
/interface bridge remove BWF.KitsNetG

On courvoisier: 

/interface bridge port remove [find interface="EOIP.KitsNetG.to.Absolut"]
/interface eoip remove EOIP.KitsNetG.to.Absolut

1.11 Final State[edit | edit source]

  • Absolut runs CAPsMAN only
  • Courvoisier continues Guest DHCP
  • Radix provides LAN DHCP
  • CAPs locally forward client traffic
  • No wireless data traffic traverses the CHR
Retrieved from "https://wiki.kitsnet.us/w/index.php?title=KitsNet_Network:LAN:absolut:CAPsMAN_Migration&oldid=2086"