hAP ax³

The hAP ax³ (part number C53UiG+5HPaxD2HPaxD) is the largest of the hAP family: one box that routes, switches and broadcasts Wi-Fi. It suits a house or a small office where the ISP router has to go, especially when your line is faster than a gigabit. If you need more wired ports or an SFP cage, look at an RB5009 or an L009 instead.

This model's data has been checked against real hardware, so the port names and radios in your script match what is printed on the case.

The ports

• ether1, 2.5 Gbit: the WAN port by default. Your ISP's cable goes here.
• ether2 to ether4, 1 Gbit: ordinary LAN ports.
• ether5, 1 Gbit, with PoE-out: the port for a ceiling access point or a camera, with no power socket next to it.

There is no SFP port, and you get 2.5 Gbit exactly once. That is a decision you make up front: either ether1 carries your internet connection, or it is the uplink to a fast switch. Not both. Put a switch behind it and the rest of your network runs at gigabit.

PoE-out is off by default. You turn it on per port in the Ports section, and the script writes /interface ethernet set ether5 poe-out=auto-on. See PoE-out per port for the modes and what to watch.

Wi-Fi

There are two radios: wifi1 on 5 GHz and wifi2 on 2.4 GHz. RouterOS v7 drives this model with the new wifi package, not the old wireless one. That has three practical consequences.

• Your Wi-Fi lives under /interface wifi and is called wifi1 and wifi2. An example from the internet that starts with /interface wireless and wlan1 belongs to a different kind of device and will not work here.
• Central management goes through /interface wifi capsman. The older /caps-man does not control these radios. See CAPsMAN.
• The configurator writes the Wi-Fi in the right form on its own, so there is nothing for you to pick here.

One SSID across both bands is usually the practical choice at home. Per SSID you can name a VLAN if guests or IoT should sit apart. The settings that actually matter are in Wi-Fi settings and Channels and width.

What it is good at, and where it runs out

A 64-bit ARM processor, 1 GB of memory and an IPQ-6010 switch chip. That memory is generous for a router this size: firewall rules, VLANs, DHCP leases and a DNS cache will not fill it in a hurry, and RouterOS licence level 6 means you will not meet a licence limit either.

The ceiling is not the memory but the CPU, and you meet it the moment traffic is no longer allowed through the hardware. As long as the firewall uses FastTrack, most traffic is steered around the CPU and the box keeps up with its ports. Switch QoS on with a queue tree and FastTrack goes off, so everything runs through the CPU; the configurator warns you about this when you do. The same holds for a VPN: WireGuard is encrypted in software here, so a tunnel carries considerably less than your internet connection does. If you want hard numbers, measure them on your own device. We do not print benchmark figures we did not measure ourselves.

Which roles fit

• Home router: what it was built for. Internet, one network, Wi-Fi, firewall, IPv6.
• Office router with VLANs: fine, it has ports enough for a WAN, a few desks and a trunk.
• VPN gateway: works, with the speed caveat above.
• Access point or CAP: when there is already a router. Everything bridged, a management address, and the Wi-Fi either its own or from a controller.
• Wi-Fi repeater: possible, but expect at most half the throughput; a cable is always better.

The LTE / 5G router role does not appear: there is no modem in this device.

The quickest route to a working script

1. Choose One device, search for ax3 and pick the Home router role.
2. Fill in your internet connection: DHCP or PPPoE, optionally through a provider preset.
3. Fill in SSID, passphrase and country, and an administrator password.
4. Reset the device, paste the script over a cable and log back in.

The whole route, including the traps, is written out in Example: replacing the ISP router. Pasting itself is covered in Using the script.

What trips people up

• An example for the wrong Wi-Fi package. Anything using /interface wireless or wlan1 does not belong to this model. Coming from an older MikroTik? Read From v6 to v7.
• Pasting the script over Wi-Fi. The radios are reconfigured during the import; use a cable.
• 2.5 Gbit that turns out to be 1 Gbit. Both ends have to support 2.5 Gbit and the cable has to carry it. Check what was actually negotiated with /interface ethernet monitor ether1 once.
• Forgetting to switch PoE-out on. The access point on ether5 stays dark until you enable that port in the configuration.