KitsNet Network:LAN:absolut:CAPsMAN Migration

1 CAPsMAN Migration Plan (Interim → Final)

Courvoisier → Absolut (CHR)

This revision reflects the updated priority:

1. Complete the CAPsMAN migration first
2. Temporary Guest-path inefficiency during migration is acceptable
3. By the final state, client traffic must stay off Absolut
4. Courvoisier must continue serving the KitsNetGN guest DHCP scope
5. Main SSID DHCP continues to come from radix.kitsnet.us (192.168.15.1)
6. Avoid mixing large redesign work into the controller cutover

---

1.1 Why this staged plan is needed

The current configuration shows:

• Courvoisier central‑forwards Guest to BWF.KitsNetG and serves Guest DHCP there.
• Main SSID traffic lives on the main bridge where Radix provides DHCP.
• Absolut currently has datapaths configured for local forwarding and does not yet replicate the Guest bridge design.
• Baker 2.4 GHz provisioning lacks the IoT SSID compared with Able.

Because of this the migration uses two stages:

• Interim state – Guest traffic temporarily traverses Absolut but is bridged back to Courvoisier so DHCP remains there.
• Final state – Guest traffic no longer traverses Absolut once an off‑CHR L2 path exists.

---

1.2 Stage A — Interim Migration State

1.2.1 Design intent

• KitsNet – locally forwarded; DHCP from Radix on the LAN
• KitsNetIN – unchanged during migration
• KitsNetGN – temporarily central‑forwarded via Absolut then bridged back to Courvoisier

This keeps the network functional while moving CAPsMAN.

1.2.2 Interim prerequisites

1. Import Courvoisier CAPsMAN certificate and CA into Absolut
2. Enable CAPsMAN on Absolut
3. Create temporary Guest EoIP link between Absolut and Courvoisier
4. Set DP.KitsNetG to central forwarding during migration
5. Keep DP.KitsNet locally forwarded
6. Correct Baker 2.4 GHz provisioning symmetry

1.2.3 Interim cutover sequence

1. Prepare Guest EoIP bridge on both routers
2. Verify Absolut CAPsMAN configuration
3. Move Able to Absolut
4. Validate Able
5. Move Baker to Absolut
6. Validate Baker
7. Disable CAPsMAN on Courvoisier
8. Re‑lock CAPs

1.2.4 Interim success criteria

• Able and Baker show Run on Absolut
• KitsNet clients obtain DHCP from Radix
• KitsNetGN clients obtain DHCP from Courvoisier
• IoT devices remain functional
• Only Guest traffic temporarily traverses Absolut

---

1.3 Stage B — Final Controller‑Only State

1.3.1 Design intent

By the end state, Absolut acts only as the CAPsMAN controller.

Requirements:

• DP.KitsNetG changed back to local‑forwarding=yes
• Temporary EoIP bridge removed
• Guest L2 path provided elsewhere on the wired network

1.3.2 Final transition sequence

1. Prepare off‑CHR Guest L2 transport
2. Change DP.KitsNetG back to local forwarding
3. Remove temporary EoIP bridge on Absolut
4. Remove EoIP on Courvoisier
5. Validate Guest DHCP and isolation

1.3.3 Final success criteria

• CAPs remain attached to Absolut
• Main SSID DHCP still provided by Radix
• Guest DHCP still provided by Courvoisier
• No client traffic passes through Absolut
• Temporary EoIP removed

---

1.4 Detailed Execution

1.4.1 Phase 0 — Pre‑checks

On Courvoisier:

/caps-man remote-cap print detail
/caps-man datapath print detail
/ip dhcp-server print detail
/ip address print

Confirm both CAPs connected and Guest DHCP bound to BWF.KitsNetG.

On Able and Baker:

/interface wireless cap print

Verify:

enabled: yes
lock-to-caps-man: no
caps-man-addresses: 192.168.15.6

On Absolut:

/caps-man manager print
/caps-man datapath print detail
/caps-man provisioning print detail

---

1.4.2 Phase 1 — Prepare Absolut

Apply the interim Absolut migration patch which:

• enables CAPsMAN
• creates temporary Guest bridge
• creates EoIP tunnel
• sets Guest datapath to central forwarding
• fixes Baker provisioning

---

1.4.3 Phase 2 — Prepare Courvoisier

Apply the interim Guest transport patch.

This creates the matching EoIP interface and adds it to BWF.KitsNetG.

---

1.4.4 Phase 3 — Migrate Able

/interface wireless cap set caps-man-addresses=<ABSOLUT_IP>

Validate on Absolut:

/caps-man remote-cap print
/caps-man interface print
/caps-man registration-table print

Rollback if necessary:

/interface wireless cap set caps-man-addresses=192.168.15.6

---

1.4.5 Phase 4 — Migrate Baker

Repeat the same command on Baker.

---

1.4.6 Phase 5 — Retire Courvoisier CAPsMAN

/caps-man manager set enabled=no

Then re‑lock the CAPs.

---

1.4.7 Phase 6 — Final cleanup later

After the off‑CHR Guest path exists:

1. Apply Absolut final controller patch
2. Apply Courvoisier cleanup patch
3. Verify DHCP and isolation

---

1.5 Scope notes

Included:

• CAPsMAN migration
• Temporary Guest bridge
• Baker provisioning fix

Deferred:

• VLAN redesign
• IoT policy redesign
• channel plan changes