KitsNet Network:LAN:absolut:CAPsMAN Migration: Difference between revisions

Back to version history
← Older edit
VisualWikitext
Peter A. Smode (talk | contribs)
administrator, Bureaucrats, family, kitsnet_adm, Administrators
2,612 edits
No edit summary
Peter A. Smode (talk | contribs)
administrator, Bureaucrats, family, kitsnet_adm, Administrators
2,612 edits
 
(8 intermediate revisions by the same user not shown)
Line 3: Line 3:


This document describes the complete migration of CAPsMAN control from
This document describes the complete migration of CAPsMAN control from
'''courvoisier''' to the CHR instance '''absolut''' while keeping wireless client
'''courvoisier''' to the CHR instance '''absolut''' while preserving the existing
traffic off the CHR in the final state.
DHCP architecture and ensuring that wireless client traffic does not
traverse the CHR in the final design.


The migration is performed in two stages:
The migration is performed in two stages:


# '''Interim migration state''' – CAPsMAN moves to Absolut while Guest traffic temporarily traverses the CHR.
# '''Interim migration state''' – CAPsMAN moves to Absolut while Guest traffic may temporarily traverse the CHR.
# '''Final controller‑only state''' – client traffic no longer traverses Absolut.
# '''Final controller-only state''' – wireless client traffic no longer passes through Absolut.


----
----
== Supporting Configuration Patch Files ==


== Supporting Configuration Patch Files ==
* [[File:Courvoisier-final-post-migration-patch.rsc.txt]]
[[File:Courvoisier-final-post-migration-patch.rsc.txt]]
* [[File:Absolut-final-controller-only-patch.rsc.txt]]
[[File:Absolut-final-controller-only-patch.rsc.txt]]
* [[File:Courvoisier-interim-guest-transport-patch.rsc.txt]]
[[File:Courvoisier-interim-guest-transport-patch.rsc.txt]]
* [[File:Absolut-interim-migration-patch.rsc.txt]]
[[File:Absolut-interim-migration-patch.rsc.txt]]
----
----


== Architecture Context ==
== Architecture Context ==
Final architecture goals:


{| class="wikitable"
{| class="wikitable"
Line 34: Line 33:
|-
|-
| '''radix.kitsnet.us (192.168.15.1)'''
| '''radix.kitsnet.us (192.168.15.1)'''
| DHCP server for main and IoT WLAN
| DHCP server for main LAN and IoT network
|}
|}


Wireless data traffic must remain on the physical network and must not
Wireless data traffic should remain on the physical LAN through the CAP
traverse the CHR once the migration is complete.
devices and should not traverse the CHR once migration is complete.


----
----
Line 47: Line 46:
! SSID !! Purpose !! DHCP Source
! SSID !! Purpose !! DHCP Source
|-
|-
| KitsNet
| '''KitsNet'''
| trusted WLAN
| trusted WLAN
| radix.kitsnet.us
| radix.kitsnet.us
|-
|-
| KitsNetIN
| '''KitsNetIN'''
| IoT devices
| IoT network
| radix.kitsnet.us
| radix.kitsnet.us
|-
|-
| KitsNetGN
| '''KitsNetGN'''
| guest WLAN
| guest WLAN
| courvoisier
| courvoisier
Line 66: Line 65:
Before beginning the migration verify:
Before beginning the migration verify:


=== CAP state ===
=== CAP registration ===


On Courvoisier:
On '''courvoisier''':


<pre>
<pre>
Line 81: Line 80:
=== CAP configuration ===
=== CAP configuration ===


On Able and Baker:
On '''able''' and '''baker''':


<pre>
<pre>
Line 97: Line 96:
=== Guest DHCP ===
=== Guest DHCP ===


On Courvoisier:
On '''courvoisier''':


<pre>
<pre>
Line 103: Line 102:
</pre>
</pre>


Confirm DHCP server bound to bridge:
Confirm the DHCP server is bound to bridge:


<pre>
<pre>
Line 111: Line 110:
----
----


== Stage A – Interim Migration State ==
== CAPsMAN Certificate Migration ==
 
The CAPsMAN controller identity must be preserved during migration.
The active CAPsMAN certificate and CA must be copied from '''courvoisier'''
to '''absolut'''.
 
This avoids CAP authentication failures or WPA handshake problems.
 
=== Step 1 – Identify certificates ===
 
On '''courvoisier''':
 
<pre>
[admin@Courvoisier] > /certificate print
Flags: K - PRIVATE-KEY; A - AUTHORITY; I - ISSUED; T - TRUSTED
Columns: NAME, COMMON-NAME, SKID
#      NAME                          COMMON-NAME                  SKID
0 KA T CAPsMAN-CA-488F5A87BE5A      CAPsMAN-CA-488F5A87BE5A      b96a4f946961524e913ad4703868303a0dd23c9b
1 K I  CAPsMAN-488F5A87BE5A          CAPsMAN-488F5A87BE5A          cf5b50d734e8ef10c1257577bb6783890c06b55c
2  I  CAP-08553163AC8E              CAP-08553163AC8E              71c4e6af7e09cf386dad50ec271c41f9e6a62e7a
3  I  CAP-08553163A40F              CAP-08553163A40F              d7123f8e1e7d616edbc4b7bda20a610ed5becd0b
4 KA T WiFi-CAPsMAN-CA-488F5A87BE5A  WiFi-CAPsMAN-CA-488F5A87BE5A  c65a58c80dd0ee06a84721ca46439882b5157fea
5 K I  WiFi-CAPsMAN-488F5A87BE5A    WiFi-CAPsMAN-488F5A87BE5A    caaa1c14fd8e0ee03458616e450cc81d85706cca
</pre>
 
Identify:
 
* CAPsMAN certificate
* CA certificate
 
TWe want:
 
<pre>
WiFi-CAPsMAN-CA-488F5A87BE5A
WiFi-CAPsMAN-488F5A87BE5A
</pre>
 
----
 
=== Step 2 – Export certificates ===
 
On '''courvoisier''':
 
<pre>
/certificate export-certificate WiFi-CAPsMAN-488F5A87BE5A export-passphrase=StrongPass
/certificate export-certificate WiFi-CAPsMAN-CA-488F5A87BE5A export-passphrase=StrongPass
</pre>
 
Generated files will appear in:
 
<pre>
[admin@Courvoisier] > /file print
# NAME                                                                                  TYPE            SIZE LAST-MODIFIED
0 cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.key                                          .key file        497 2026-03-14 13:23:47
1 cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.crt                                          .crt file        672 2026-03-14 13:23:47
2 cert_export_WiFi-CAPsMAN-488F5A87BE5A.key                                              .key file        497 2026-03-14 13:23:07
3 cert_export_WiFi-CAPsMAN-488F5A87BE5A.crt                                              .crt file        688 2026-03-14 13:23:07
4 flash                                                                                  disk                  2026-03-14 00:00:34
5 flash/Courvoisier-export.rsc                                                          script        29.7KiB 2026-03-14 00:00:34
6 flash/skins                                                                            directory            2106-02-07 02:28:42
7 flash/auto-before-reset.backup                                                        backup        18.7KiB 2106-02-07 02:28:48
8 flash/pub                                                                              directory            2020-09-11 01:10:52
9 flash/Courvoisier-daily.backup                                                        backup      114.3KiB 2026-03-14 00:00:01
</pre>
 
Exported files:
 
* cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.key
* cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.crt
* cert_export_WiFi-CAPsMAN-488F5A87BE5A.key
* cert_export_WiFi-CAPsMAN-488F5A87BE5A.crt
 
----
 
=== Step 3 – Transfer certificates to Absolut ===
 
Copy the files to '''absolut''' using:
 
* WinBox file transfer
* SCP
* FTP
 
Example using SCP:
 
<pre>
scp *.crt admin@absolut:/
scp *.key admin@absolut:/
</pre>''This had to be done using a Linux system as a waystation because RouterOS had no scp client.''
----
 
=== Step 4 – Import certificates on Absolut ===
 
On '''absolut''':
 
<pre>
/certificate import file-name=cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.crt passphrase=StrongPass
/certificate import file-name=cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.key passphrase=StrongPass


During migration Guest traffic may temporarily traverse Absolut.
/certificate import file-name=cert_export_WiFi-CAPsMAN-488F5A87BE5A.crt passphrase=StrongPass
This allows the CAPsMAN controller to move while keeping Guest DHCP
/certificate import file-name=cert_export_WiFi-CAPsMAN-488F5A87BE5A.key passphrase=StrongPass
hosted on Courvoisier.
</pre>


=== Design ===
Verify:


* KitsNet → local forwarding → Radix DHCP
<pre>
* KitsNetIN → unchanged during migration
[admin@Absolut] > /certificate print
* KitsNetGN → temporarily central forwarded to Absolut and bridged back to Courvoisier
Flags: K - PRIVATE-KEY; A - AUTHORITY; T - TRUSTED
Columns: NAME, COMMON-NAME, SKID
#    NAME                                            COMMON-NAME                  SKID
0 KAT cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.crt_0  WiFi-CAPsMAN-CA-488F5A87BE5A  c65a58c80dd0ee06a84721ca46439882b5157fea
1 K T cert_export_WiFi-CAPsMAN-488F5A87BE5A.crt_0    WiFi-CAPsMAN-488F5A87BE5A    caaa1c14fd8e0ee03458616e450cc81d85706cca
</pre>Note that the SKIDs on '''absolut''' match those on '''courvoisier'''.


''There were some crap autogenerated certificates from prior to migration, but i elected to remove those now.''
----
----


== Prepare Absolut ==
=== Step 5 – Assign certificates to CAPsMAN ===


On Absolut:
On '''absolut''':


<pre>
<pre>
/caps-man manager set enabled=yes
/caps-man manager set \
certificate=cert_export_WiFi-CAPsMAN-488F5A87BE5A.crt_0 \
ca-certificate=cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.crt_0 \
enabled=yes
</pre>
</pre>


Import CAPsMAN certificates copied from Courvoisier.
Verify:
 
<pre>
[admin@Absolut] > /caps-man manager print
                  enabled: yes
              certificate: cert_export_WiFi-CAPsMAN-488F5A87BE5A.crt_0
            ca-certificate: cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.crt_0
              package-path:
            upgrade-policy: none
  require-peer-certificate: no
    generated-certificate: *2
  generated-ca-certificate: *1
</pre>The *1 and *2 references are the autogenerated certs that i removed. they are not used and this is supposed to be harmless.
----
 
== Stage A – Interim Migration State ==
 
During migration Guest traffic may temporarily traverse Absolut in order
to maintain connectivity with the Guest DHCP server on courvoisier.
 
=== Prepare Absolut ===


Create temporary Guest bridge:
Create temporary Guest bridge:
Line 141: Line 265:
</pre>
</pre>


Create EoIP transport to Courvoisier:
Create EoIP tunnel to courvoisier:


<pre>
<pre>
/interface eoip add name=EOIP.KitsNetG.to.Courvoisier \
/interface eoip add name=EOIP.KitsNetG.to.Courvoisier \
  local-address=&lt;ABSOLUT_IP&gt; \
  local-address=192.168.15.10 \
  remote-address=192.168.15.6 \
  remote-address=192.168.15.6 \
  tunnel-id=120
  tunnel-id=120
</pre>
</pre>


Attach EoIP to bridge:
Attach the tunnel to the bridge:


<pre>
<pre>
Line 156: Line 280:
</pre>
</pre>


Change Guest datapath:
Update the Guest datapath:


<pre>
<pre>
Line 164: Line 288:
----
----


== Prepare Courvoisier ==
=== Prepare Courvoisier ===


Create matching EoIP interface:
Create the matching EoIP interface:


<pre>
<pre>
/interface eoip add name=EOIP.KitsNetG.to.Absolut \
/interface eoip add name=EOIP.KitsNetG.to.Absolut \
  local-address=192.168.15.6 \
  local-address=192.168.15.6 \
  remote-address=&lt;ABSOLUT_IP&gt; \
  remote-address=192.168.15.10 \
  tunnel-id=120
  tunnel-id=120
</pre>
</pre>
Line 187: Line 311:
=== Step 1 – Move Able ===
=== Step 1 – Move Able ===


On Able:
On '''able''':


<pre>
<pre>
/interface wireless cap set caps-man-addresses=&lt;ABSOLUT_IP&gt;
/interface wireless cap set caps-man-addresses=192.168.15.10
</pre>
</pre>


Line 203: Line 327:


* KitsNet connectivity
* KitsNet connectivity
* KitsNetGN guest DHCP
* Guest DHCP
* IoT connectivity
* IoT connectivity
Rollback if needed:
<pre>
/interface wireless cap set caps-man-addresses=192.168.15.6
</pre>


----
----
Line 210: Line 340:
=== Step 2 – Move Baker ===
=== Step 2 – Move Baker ===


On Baker:
On '''baker''':


<pre>
<pre>
/interface wireless cap set caps-man-addresses=&lt;ABSOLUT_IP&gt;
/interface wireless cap set caps-man-addresses=192.168.15.10
</pre>
</pre>


Verify both CAPs on Absolut:
Verify both CAPs:


<pre>
<pre>
Line 224: Line 354:
----
----


=== Step 3 – Disable Courvoisier CAPsMAN ===
=== Step 3 – Disable CAPsMAN on Courvoisier ===


Once both CAPs are stable:
Once both CAPs are stable:
Line 236: Line 366:
<pre>
<pre>
/interface wireless cap set lock-to-caps-man=yes
/interface wireless cap set lock-to-caps-man=yes
</pre>
</pre>'''''We cannot lock to caps yet becuase we don't have certificate locking working. I tried this now and Able would not associate with CAPsMAN at all. this has to wait for a post-migration activity.'''''
 
----
----


== Validation ==
== Validation ==


On Absolut:
On '''absolut''':


<pre>
<pre>
Line 248: Line 377:
</pre>
</pre>


On Courvoisier:
On '''courvoisier''':


<pre>
<pre>
Line 254: Line 383:
</pre>
</pre>


Confirm:
Verify:


* clients on KitsNet obtain DHCP from Radix
* clients on KitsNet obtain DHCP from Radix
* guest clients obtain DHCP from Courvoisier
* guest clients obtain DHCP from Courvoisier
* both CAPs remain connected to Absolut
* CAPs remain connected to Absolut


----
----
Line 272: Line 401:
</pre>
</pre>


Re-enable CAPsMAN on Courvoisier if necessary:
Re-enable CAPsMAN:


<pre>
<pre>
Line 280: Line 409:
----
----


== Stage B – Final Controller‑Only State ==
== Stage B – Final Controller-Only State ==


After a permanent Guest L2 path exists outside the CHR:
After a permanent Guest L2 path exists outside the CHR:


On Absolut:
On '''absolut''':


<pre>
<pre>
Line 298: Line 427:
</pre>
</pre>


On Courvoisier:
On '''courvoisier''':


<pre>
<pre>
Line 310: Line 439:


* Absolut runs CAPsMAN only
* Absolut runs CAPsMAN only
* Courvoisier serves Guest DHCP
* Courvoisier continues Guest DHCP
* Radix serves LAN DHCP
* Radix provides LAN DHCP
* CAPs locally forward all client traffic
* CAPs locally forward client traffic
* no wireless data traffic transits the CHR
* No wireless data traffic traverses the CHR

Latest revision as of 15:05, 14 March 2026

1 CAPsMAN Migration: Courvoisier → Absolut[edit | edit source]

This document describes the complete migration of CAPsMAN control from courvoisier to the CHR instance absolut while preserving the existing DHCP architecture and ensuring that wireless client traffic does not traverse the CHR in the final design.

The migration is performed in two stages:

  1. Interim migration state – CAPsMAN moves to Absolut while Guest traffic may temporarily traverse the CHR.
  2. Final controller-only state – wireless client traffic no longer passes through Absolut.

1.1 Supporting Configuration Patch Files[edit | edit source]

1.2 Architecture Context[edit | edit source]

Component Role
absolut CAPsMAN controller (control plane only)
courvoisier edge router and Guest DHCP server
radix.kitsnet.us (192.168.15.1) DHCP server for main LAN and IoT network

Wireless data traffic should remain on the physical LAN through the CAP devices and should not traverse the CHR once migration is complete.

1.3 SSID Design[edit | edit source]

SSID Purpose DHCP Source
KitsNet trusted WLAN radix.kitsnet.us
KitsNetIN IoT network radix.kitsnet.us
KitsNetGN guest WLAN courvoisier

1.4 Preconditions[edit | edit source]

Before beginning the migration verify:

1.4.1 CAP registration[edit | edit source]

On courvoisier: 

/caps-man remote-cap print detail

Expected:

  • able – Run
  • baker – Run

1.4.2 CAP configuration[edit | edit source]

On able and baker: 

/interface wireless cap print

Verify: 

enabled: yes
lock-to-caps-man: no
caps-man-addresses: 192.168.15.6

1.4.3 Guest DHCP[edit | edit source]

On courvoisier: 

/ip dhcp-server print detail

Confirm the DHCP server is bound to bridge: 

BWF.KitsNetG

1.5 CAPsMAN Certificate Migration[edit | edit source]

The CAPsMAN controller identity must be preserved during migration. The active CAPsMAN certificate and CA must be copied from courvoisier to absolut.

This avoids CAP authentication failures or WPA handshake problems.

1.5.1 Step 1 – Identify certificates[edit | edit source]

On courvoisier: 

[admin@Courvoisier] > /certificate print
Flags: K - PRIVATE-KEY; A - AUTHORITY; I - ISSUED; T - TRUSTED
Columns: NAME, COMMON-NAME, SKID
#      NAME                          COMMON-NAME                   SKID
0 KA T CAPsMAN-CA-488F5A87BE5A       CAPsMAN-CA-488F5A87BE5A       b96a4f946961524e913ad4703868303a0dd23c9b
1 K I  CAPsMAN-488F5A87BE5A          CAPsMAN-488F5A87BE5A          cf5b50d734e8ef10c1257577bb6783890c06b55c
2   I  CAP-08553163AC8E              CAP-08553163AC8E              71c4e6af7e09cf386dad50ec271c41f9e6a62e7a
3   I  CAP-08553163A40F              CAP-08553163A40F              d7123f8e1e7d616edbc4b7bda20a610ed5becd0b
4 KA T WiFi-CAPsMAN-CA-488F5A87BE5A  WiFi-CAPsMAN-CA-488F5A87BE5A  c65a58c80dd0ee06a84721ca46439882b5157fea
5 K I  WiFi-CAPsMAN-488F5A87BE5A     WiFi-CAPsMAN-488F5A87BE5A     caaa1c14fd8e0ee03458616e450cc81d85706cca

Identify:

  • CAPsMAN certificate
  • CA certificate

TWe want: 

WiFi-CAPsMAN-CA-488F5A87BE5A
WiFi-CAPsMAN-488F5A87BE5A

1.5.2 Step 2 – Export certificates[edit | edit source]

On courvoisier: 

/certificate export-certificate WiFi-CAPsMAN-488F5A87BE5A export-passphrase=StrongPass
/certificate export-certificate WiFi-CAPsMAN-CA-488F5A87BE5A export-passphrase=StrongPass

Generated files will appear in: 

[admin@Courvoisier] > /file print
 # NAME                                                                                   TYPE             SIZE LAST-MODIFIED
 0 cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.key                                           .key file         497 2026-03-14 13:23:47
 1 cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.crt                                           .crt file         672 2026-03-14 13:23:47
 2 cert_export_WiFi-CAPsMAN-488F5A87BE5A.key                                              .key file         497 2026-03-14 13:23:07
 3 cert_export_WiFi-CAPsMAN-488F5A87BE5A.crt                                              .crt file         688 2026-03-14 13:23:07
 4 flash                                                                                  disk                  2026-03-14 00:00:34
 5 flash/Courvoisier-export.rsc                                                           script        29.7KiB 2026-03-14 00:00:34
 6 flash/skins                                                                            directory             2106-02-07 02:28:42
 7 flash/auto-before-reset.backup                                                         backup        18.7KiB 2106-02-07 02:28:48
 8 flash/pub                                                                              directory             2020-09-11 01:10:52
 9 flash/Courvoisier-daily.backup                                                         backup       114.3KiB 2026-03-14 00:00:01

Exported files:

  • cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.key
  • cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.crt
  • cert_export_WiFi-CAPsMAN-488F5A87BE5A.key
  • cert_export_WiFi-CAPsMAN-488F5A87BE5A.crt

1.5.3 Step 3 – Transfer certificates to Absolut[edit | edit source]

Copy the files to absolut using:

  • WinBox file transfer
  • SCP
  • FTP

Example using SCP: 

scp *.crt admin@absolut:/
scp *.key admin@absolut:/

This had to be done using a Linux system as a waystation because RouterOS had no scp client.

1.5.4 Step 4 – Import certificates on Absolut[edit | edit source]

On absolut: 

/certificate import file-name=cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.crt passphrase=StrongPass
/certificate import file-name=cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.key passphrase=StrongPass

/certificate import file-name=cert_export_WiFi-CAPsMAN-488F5A87BE5A.crt passphrase=StrongPass
/certificate import file-name=cert_export_WiFi-CAPsMAN-488F5A87BE5A.key passphrase=StrongPass

Verify: 

[admin@Absolut] > /certificate print
Flags: K - PRIVATE-KEY; A - AUTHORITY; T - TRUSTED
Columns: NAME, COMMON-NAME, SKID
#     NAME                                            COMMON-NAME                   SKID
0 KAT cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.crt_0  WiFi-CAPsMAN-CA-488F5A87BE5A  c65a58c80dd0ee06a84721ca46439882b5157fea
1 K T cert_export_WiFi-CAPsMAN-488F5A87BE5A.crt_0     WiFi-CAPsMAN-488F5A87BE5A     caaa1c14fd8e0ee03458616e450cc81d85706cca

Note that the SKIDs on absolut match those on courvoisier.

There were some crap autogenerated certificates from prior to migration, but i elected to remove those now.

1.5.5 Step 5 – Assign certificates to CAPsMAN[edit | edit source]

On absolut: 

/caps-man manager set \
certificate=cert_export_WiFi-CAPsMAN-488F5A87BE5A.crt_0 \
ca-certificate=cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.crt_0 \
enabled=yes

Verify: 

[admin@Absolut] > /caps-man manager print
                   enabled: yes
               certificate: cert_export_WiFi-CAPsMAN-488F5A87BE5A.crt_0
            ca-certificate: cert_export_WiFi-CAPsMAN-CA-488F5A87BE5A.crt_0
              package-path:
            upgrade-policy: none
  require-peer-certificate: no
     generated-certificate: *2
  generated-ca-certificate: *1

The *1 and *2 references are the autogenerated certs that i removed. they are not used and this is supposed to be harmless.

1.6 Stage A – Interim Migration State[edit | edit source]

During migration Guest traffic may temporarily traverse Absolut in order to maintain connectivity with the Guest DHCP server on courvoisier.

1.6.1 Prepare Absolut[edit | edit source]

Create temporary Guest bridge: 

/interface bridge add name=BWF.KitsNetG

Create EoIP tunnel to courvoisier: 

/interface eoip add name=EOIP.KitsNetG.to.Courvoisier \
 local-address=192.168.15.10 \
 remote-address=192.168.15.6 \
 tunnel-id=120

Attach the tunnel to the bridge: 

/interface bridge port add bridge=BWF.KitsNetG interface=EOIP.KitsNetG.to.Courvoisier

Update the Guest datapath: 

/caps-man datapath set [find name="DP.KitsNetG"] local-forwarding=no bridge=BWF.KitsNetG

1.6.2 Prepare Courvoisier[edit | edit source]

Create the matching EoIP interface: 

/interface eoip add name=EOIP.KitsNetG.to.Absolut \
 local-address=192.168.15.6 \
 remote-address=192.168.15.10 \
 tunnel-id=120

Attach to Guest bridge: 

/interface bridge port add bridge=BWF.KitsNetG interface=EOIP.KitsNetG.to.Absolut

1.7 Migration Procedure[edit | edit source]

1.7.1 Step 1 – Move Able[edit | edit source]

On able: 

/interface wireless cap set caps-man-addresses=192.168.15.10

Verify on Absolut: 

/caps-man remote-cap print
/caps-man interface print

Test:

  • KitsNet connectivity
  • Guest DHCP
  • IoT connectivity

Rollback if needed: 

/interface wireless cap set caps-man-addresses=192.168.15.6

1.7.2 Step 2 – Move Baker[edit | edit source]

On baker: 

/interface wireless cap set caps-man-addresses=192.168.15.10

Verify both CAPs: 

/caps-man remote-cap print

1.7.3 Step 3 – Disable CAPsMAN on Courvoisier[edit | edit source]

Once both CAPs are stable: 

/caps-man manager set enabled=no

Lock CAPs: 

/interface wireless cap set lock-to-caps-man=yes

We cannot lock to caps yet becuase we don't have certificate locking working. I tried this now and Able would not associate with CAPsMAN at all. this has to wait for a post-migration activity.

1.8 Validation[edit | edit source]

On absolut: 

/caps-man registration-table print

On courvoisier: 

/ip dhcp-server lease print

Verify:

  • clients on KitsNet obtain DHCP from Radix
  • guest clients obtain DHCP from Courvoisier
  • CAPs remain connected to Absolut

1.9 Rollback[edit | edit source]

If migration fails revert CAPs to Courvoisier.

On CAP: 

/interface wireless cap set caps-man-addresses=192.168.15.6

Re-enable CAPsMAN: 

/caps-man manager set enabled=yes

1.10 Stage B – Final Controller-Only State[edit | edit source]

After a permanent Guest L2 path exists outside the CHR:

On absolut: 

/caps-man datapath set [find name="DP.KitsNetG"] local-forwarding=yes

Remove temporary EoIP: 

/interface bridge port remove [find interface="EOIP.KitsNetG.to.Courvoisier"]
/interface eoip remove EOIP.KitsNetG.to.Courvoisier
/interface bridge remove BWF.KitsNetG

On courvoisier: 

/interface bridge port remove [find interface="EOIP.KitsNetG.to.Absolut"]
/interface eoip remove EOIP.KitsNetG.to.Absolut

1.11 Final State[edit | edit source]

  • Absolut runs CAPsMAN only
  • Courvoisier continues Guest DHCP
  • Radix provides LAN DHCP
  • CAPs locally forward client traffic
  • No wireless data traffic traverses the CHR
Retrieved from "https://wiki.kitsnet.us/w/index.php?title=KitsNet_Network:LAN:absolut:CAPsMAN_Migration&oldid=2086"