CAPsMAN

CAPsMAN is the Wi-Fi controller in RouterOS. One device, usually your router, keeps the SSIDs, passphrases, VLANs and channels. The access points (CAPs) hold almost no Wi-Fi configuration of their own: they report in to the controller and get their radio settings from there.

When it helps and when it does not

With two access points a controller is mostly extra machinery to understand. From roughly three upwards, and certainly when the number is still growing, it pays for itself: changing a passphrase or adding an SSID is one edit instead of one per device.

There are reasons not to. The controller can fail; if it goes away the CAPs usually keep running on what they have, but you can no longer change anything. And if you want one access point to differ from the rest, you are working against the model. Standalone access points with the same SSIDs and passphrase roam just as well: roaming depends on matching settings, not on CAPsMAN. See Recipe: Wi-Fi that keeps working as you walk.

Where it sits in the tool

The wizard has a Router + CAPsMAN role: an office router with VLANs that also manages the Wi-Fi. In advanced you switch on the CAPsMAN (wifi controller) section on a device that routes. It is off by default.

There are two ways to turn an access point into a CAP: paste the CAP script the controller produces, or configure that device in the configurator with the Wi-Fi role Managed by CAPsMAN. The second asks for the controller's address, the interface to look for it on, and optionally locking to this controller and requesting a certificate.

The settings that matter

Type of access points: the wifi package (ax and be, and ac models running wifi-qcom-ac) or the old wireless package (cAP ac, wAP ac and older). This is about the access points, not about the router.
SSIDs: up to eight, each with security, passphrase, the bands it should appear on, a VLAN and client isolation. This is the list that goes to every CAP.
Channel width per band, as for a standalone access point. See Channels, width and power.
802.11r fast roaming: on by default here, and only with the wifi package.
Local forwarding: only with the old package, on by default. Without it all Wi-Fi traffic runs through the controller in a CAPWAP tunnel, which is rarely what you want.
Only CAPs whose identity matches: a regular expression, for example ^cap-. Empty means every device that reports in gets provisioned.
Interface on which CAPs find the controller: your management VLAN if you have one, otherwise the bridge.
Also manage this router's own radios: on when the router has radios of its own, so it joins in as an ordinary access point.

Two things the SSID table has here that differ from the Wi-Fi section: there is no hidden-SSID toggle, and the band list is fixed at 2.4 and 5 GHz rather than taken from a model, because the controller does not yet know which devices will report in.

What the configurator generates

You get two scripts. The first is the ordinary script for the router, with the controller in it:

/interface wifi capsman enabled on the chosen interface, or /caps-man manager with a manager interface on the old package;
a security profile per SSID, a datapath per network (bridge, VLAN tag, isolation) and a channel per band;
a configuration per SSID per band;
a provisioning rule per band, which sets up arriving CAPs automatically with the first SSID as master and the rest as slaves, filtered by the identity regexp if you gave one;
if the router has radios of its own: those radios report in to the controller at 127.0.0.1.

The second script is called Script for the CAP devices and sits with the extra output. You paste it on every access point. It builds a bridge with the ethernet ports, picks up a management address over DHCP, sets the radios to be managed by the controller and gives the device an identity. Watch two lines in it: a device with one port does not need the second bridge port, and the identity has to match the regexp on the controller. As an alternative, a factory-fresh device goes into CAP mode by holding its reset button for about ten seconds.

On the controller, check afterwards with /interface wifi capsman remote-cap print whether the CAPs reported in, and with /interface wifi registration-table print who is connected. On the old package those are /caps-man remote-cap print and /caps-man registration-table print.

The difference between the two packages

This is the trap that costs the most evenings: each Wi-Fi package has its own CAPsMAN, and the two do not talk to each other. The old /caps-man manages only access points running the wireless package. Access points on the wifi package report in to /interface wifi capsman. So one controller manages one of the two kinds, and a mixed set of access points means part of them will not join.

Pick the type from your access points, then, not from your router. The old CAPsMAN also has no WPA3: set WPA3 or WPA2 + WPA3 there and the SSIDs become WPA2-PSK, with the configurator saying so.

A controller and standalone access points together

If your site holds a device in the CAPsMAN role alongside devices in the Access point role, the site check reports that those access points are set up as standalone. They get their own SSIDs from their own script and fetch nothing from the controller. That is not an error, but it is usually a mistake.

Fix it in one of two ways. Either turn them into CAPs: paste the controller's CAP script, or set their Wi-Fi role to Managed by CAPsMAN. Or leave them standalone on purpose, and then make sure the SSID, security and passphrase are identical everywhere.

Things to check

The port towards a CAP has to be a trunk with every Wi-Fi VLAN tagged, plus the network the CAP itself is managed on. Without that, an SSID on a VLAN gets no address. The configurator warns about it as soon as you put SSIDs on VLANs.
No address for the CAP itself. The CAP script picks up an address over DHCP on its bridge; with no DHCP server on that network the device goes nowhere.
A CAP that does not report in is usually not in the same layer-2 network as the discovery interface, or its identity does not match the regexp.
Names that are all the same. The identity is what the controller recognises CAPs by, so give them different names.

See Setting up Wi-Fi for the SSID settings themselves, Multiple devices for the site and its checks, and VLANs for the trunks.