hAP ac (RB962UiGS-5HacT2HnT)

The hAP ac (product code RB962UiGS-5HacT2HnT) was for years MikroTik's complete box for a home or a small office: five gigabit ports, an SFP cage, PoE-out and radios on both bands. It is no longer the newest, but there are a lot of them out there, and for a gigabit line with Wi-Fi in the same room it still does the job.

The confusion this model causes is in the name. The hAP ac, the hAP ac² and the hAP ac lite are three different devices with three different port layouts. Search the configurator by product code, not by name.

The ports

• ether1 through ether5: five gigabit ports. ether1 is the default WAN port; the rest go into the bridge.
• sfp1: one 1 Gbit SFP cage. Meant for fibre, for instance a media converter you can skip or a short hop to a switch. Without a module that port never comes up.

ether5 has PoE-out. It is the only powering port on this model, so the PoE-out per port field only offers that one port. See PoE-out for what you can hang off it.

You can use the SFP cage as a second WAN: add it in the WAN section and it is kept out of the bridge automatically. See Internet connection and Multiple WAN connections.

The Wi-Fi

Two radios: wlan1 on 2.4 GHz and wlan2 on 5 GHz. That is what sets this model apart from the small hAP variants, and the reason it is still usable as the only box in a living room.

The catalogue puts this model on the old Wi-Fi package, wireless. A lot hangs off that. The script writes /interface wireless lines, and the settings that only the new wifi package knows do not appear on screen: no band steering, no 802.11r fast roaming, no choice of management frame protection. Roaming between several access points here means the same SSID on every device and nothing more. See Wi-Fi settings and, for channel choice and width, Wi-Fi channels.

With two radios the repeater role does make sense: one radio connects to the existing router, the other rebroadcasts. Still expect a serious loss of throughput, and note that station-bridge only works when the upstream end is also a MikroTik running the old wireless package.

Memory, architecture and VLANs

The catalogue records 128 MB of memory and the MIPSBE architecture. At 128 MB this model falls outside the small-board note the configurator gives at 64 MB and below: there is room enough for an ordinary configuration. The licence level and the switch chip are not in our catalogue for this model, so this page does not state them.

It is listed with hw_vlan: switch-menu. Its switch chip keeps the VLAN table under /interface ethernet switch. The configurator writes bridge VLAN filtering, which works, but hardware offload goes off with it and VLAN traffic is forwarded by the CPU. You see that note when you generate. On a gigabit model that is a real limit: with VLANs on you no longer get what the ports could carry. If all five ports are busy with traffic between VLANs, put a switch behind this router and let the VLAN table live there. See VLANs and Speed checks.

What it is good at, and where it runs out

Good at: a gigabit line with NAT, firewall, DHCP, a DNS cache and IPv6, plus Wi-Fi on two bands from the same box. As long as FastTrack is on in the firewall, most traffic goes around the CPU.

It runs out as soon as traffic has to go through the CPU: with a queue tree for QoS, with VPN tunnels, which are encrypted in software here, and with VLANs, for the reason above. We do not quote throughput figures; they depend on your rules and your traffic. Measure it on your own device.

Which roles fit

• Home router: the classic ISP-router replacement, with Wi-Fi on two bands.
• Office router with VLANs: five ports plus SFP is enough, with the switch-chip caveat above.
• Access point or CAP: everything bridged behind another router. As a CAP the Wi-Fi comes from a CAPsMAN controller.
• Router + CAPsMAN: this router routes and manages the Wi-Fi of separate access points at the same time.
• VPN gateway, Hotspot, Wi-Fi repeater and Wireless CPE: all available.

Only LTE / 5G router is greyed out, with the message that there is no LTE modem. Switch and Core router are still offered, but they are not meant for this device.

The quickest route to a working configuration

1. Pick One device and search for RB962, so you are certain you have the hAP ac and not the ac lite or the ac².
2. Pick Home router for one network, or Office router with VLANs if you want guests and desks apart.
3. Fill in your internet connection, optionally through a provider preset.
4. At the Wi-Fi step: set your country and choose per SSID which bands it broadcasts on.
5. Set an admin password, reset the device and paste the script. See Using the script.

If the hAP ac sits in a network with more devices, Multiple devices is faster: you draw the cables on the network board and the cabling decides which ports become trunks.

What trips people up

• Picking the wrong hAP. Three devices have almost the same name and different ports and speeds. The product code is the only reliable search term.
• Switching VLANs on and then complaining about the speed. That is the switch chip, not your script. Read the paragraph above.
• Expecting roaming this package does not have. No 802.11r on the old wireless package. The same SSID and a sensibly chosen transmit power do most of the work.
• An empty SFP cage. Without a matching module sfp1 never comes up.
• An old ISP router that keeps routing. Put it in bridge mode. See Coming from an ISP router.