The cAP lite (product code RBcAPL-2nD) is a flat disc for a ceiling or a wall, fed over the network cable. It does one thing: broadcast Wi-Fi somewhere a cable already runs. The router, the firewall and the DHCP server live elsewhere. That is not a limitation but the point: an access point belongs where the people are.
It is the little brother of the cAP ax. Where that one has two radios and two gigabit ports, the cAP lite has one radio on 2.4 GHz and one 100 Mbit port. For a corridor, a hotel room or an IoT corner that is enough. For a room full of people who want to stream, it is not.
The port
One ethernet port, ether1, 100 Mbit, with PoE-in. That is the cable to your switch or router: data and power over the same pairs. It is also the port where your VLANs arrive tagged, so your management VLAN and your Wi-Fi VLANs all have to pass along it. See VLANs.
There is no PoE-out: the PoE-out per port field does not appear here, so you cannot hang a second device off it. See PoE-out per port for the models that can.
One port has consequences for the roles the tool offers, because a WAN, a LAN and a trunk do not fit side by side. More on that below.
Wi-Fi
One radio, wlan1, on 2.4 GHz. No 5 GHz. That makes it suitable for reach and for devices that know nothing else: sensors, thermostats, old laptops, printers. For speed, take a model with a 5 GHz radio.
On 2.4 GHz you win with a narrow channel and a quiet neighbourhood, not with a wide one. There is simply no room in that band. See Channels, width and power; the country you pick decides which channels and power levels are allowed.
The Wi-Fi package for this model is wireless, the older of the two Wi-Fi packages in RouterOS v7, so the configurator writes the wireless side as /interface wireless. The tool reads that from the catalogue record. It matters as soon as this device has to talk to another MikroTik as a station: station-bridge only works between two devices on the same driver. See Setting up Wi-Fi.
What is inside
From the catalogue: a MIPSBE processor and 64 MB of memory. That is enough for an access point, but it is not much, and the configurator says so: at 64 MB or less it adds a note that RouterOS v7 runs on it but does not have much room. Keep the configuration small, do not install packages you are not using, and check what is left after applying it with /system resource print. See Packages. The switch chip and the licence level are not recorded for this model, so this page does not quote them.
What it is good at, and where it runs out
Good at: putting out a clean 2.4 GHz signal where a cable already runs, broadcasting several SSIDs on different VLANs, without needing a power socket nearby.
Where it runs out:
- One wired port. Roles that need at least three wired ports, such as Office router with VLANs, Router + CAPsMAN and Hotspot, are blocked by the tool with "Needs at least 3 wired ports". That is not fussiness: a WAN, a LAN and a trunk do not fit here side by side.
- 100 Mbit on that port. Everything the access point broadcasts goes through the same 100 Mbit. With a single 2.4 GHz radio you rarely reach that, but it is the ceiling.
- One band. No 5 GHz means every client sits in the same crowded band.
- An access point is not a router. The Home router role is offered, but then
ether1is your WAN and no LAN port is left.
Which roles fit
- Access point: the normal choice. Everything bridged, SSIDs optionally per VLAN, management address by DHCP or static. No DHCP server, no NAT.
- CAP (managed by CAPsMAN): when you want SSIDs and security set centrally instead of on every device separately. See CAPsMAN.
- Wi-Fi repeater / extender: for a spot without a cable. With one radio the same board rebroadcasts on the same band, so expect well under half the throughput.
- Wireless CPE / point-to-point: as the connecting end. The question "What is at the other end?" decides the station mode, see Receiving Wi-Fi instead of broadcasting it.
- Harden only (baseline): for a cAP lite already running.
The quickest route to a working configuration
If it hangs on its own, pick the model, pick the Access point role and walk through the wizard: country, SSID, security, management address, password. Done.
If there are several, with a router and VLANs above them, use Multiple devices in one site instead. Every access point then gets the same SSID, security and passphrase, which is the condition for roaming, and the site checks tell you whether the management VLAN reaches each device. Worked cases are in Example: an office with VLANs, a switch and access points and Recipe: Wi-Fi that keeps working as you walk.
What trips people up
- Forgetting the management VLAN. Put the access point on a management VLAN that does not arrive tagged over the trunk and it is unreachable the moment you paste. In a site with several devices the checks catch this.
- Expecting 5 GHz. There is one radio, on 2.4 GHz. If you need a fast band, this is the wrong model.
- Different Wi-Fi settings per access point. For roaming the name, security and passphrase have to match. That is why they live in the site's shared settings.
- Wanting a wide channel on 2.4 GHz. There is no room for it; narrow and quiet wins.
- Forgetting where the power comes from. This device has PoE-in: the switch or injector at the other end of the cable has to feed it.