wAP ax

The wAP ax (product code wAPG-5HaxD2HaxD) is an access point for one cable and one job: putting Wi-Fi where you managed to get a cable. It is small, it is powered over that same cable, and there is nothing else on board to think about. That is its strength and its limit in the same sentence.

The port

There is exactly one: ether1, gigabit, with PoE-in. Data and power arrive over the same cable, and your VLANs arrive tagged on that same port. There is no PoE-out, so you cannot power a second device behind it.

One port has two practical consequences. First: you need a PoE switch or an injector at the other end, because there is no second cable for power. Second: any role that wants a WAN port and a LAN port cannot work here. More on that below.

Wi-Fi

The catalogue lists two radios:

• wifi1 — 5 GHz, the fast band.
• wifi2 — 2.4 GHz, for reach and older equipment.

The Wi-Fi package for this model is wifi, the newer package in RouterOS v7. The configurator therefore writes the configuration under /interface wifi. You do not have to choose that; the tool takes it from the catalogue record. What you do fill in is the country, the SSIDs and the security. See Wi-Fi settings, and Channels if you are hanging several access points near each other.

What is inside

From the catalogue: a 32-bit ARM processor, 256 MB of RAM and a level 4 RouterOS licence. No switch chip is listed, which makes sense with a single port: there is nothing to switch. The data has been checked against real hardware.

256 MB is enough for what this device does and too little for side trips. Containers, a large routing table or a heavy firewall do not belong here. Level 4 caps the number of tunnels among other things; see RouterOS licences.

What it is good at, and where it runs out

Good at: putting an SSID, or a handful of SSIDs, at the end of a cable, with VLANs tagged over that cable. And as the far end of a wireless link between two buildings.

Where it runs out:

• One wired port. The tool blocks Office router with VLANs, Router + CAPsMAN and Hotspot with "Needs at least 3 wired ports".
• Home router is a poor idea here too. The role is available, but ether1 then becomes your WAN port and no wired LAN port is left. Your whole network would hang off the Wi-Fi.
• No PoE-out. You cannot chain a next device off it.
• No LTE and no SFP.

Which roles fit

• Access point — what this device was built for. Everything bridged, SSIDs optionally per VLAN, management address by DHCP or static, no DHCP server and no NAT.
• CAP (managed by CAPsMAN) — the same thing, but SSIDs and security come from a controller. Worth it as soon as you have more than three. See CAPsMAN.
• Wi-Fi repeater / extender — for the spot where the cable never arrived. With two radios the uplink radio does not have to rebroadcast, but expect far less throughput than on a cable.
• Wireless CPE / point-to-point — as station or as access point on one end of a wireless link between two locations.
• Harden only — for a wAP already in place that you only want to lock down.

The quickest route to a working configuration

On its own: pick the model, pick the Access point role and walk through the wizard. Four steps: Wi-Fi, management address, management access, name and password. Leave the management address on DHCP if your router hands out addresses, or give it a static one if you want to find it again easily.

If there are several of them, or a router with VLANs, use Multiple devices: shared SSIDs and passwords for roaming, one script per device, and checks across the site. For the wireless planning around it there is Wi-Fi plan.

What trips people up

• No PoE at the other end. There is only one port, so there is no second route to power. An ordinary switch plus a small power brick is not an option here: it has to be PoE, or an injector.
• The management VLAN not tagged over the cable. Then the device is gone the moment you paste. Check on the switch side that the port is a trunk with the management VLAN in it.
• Trying to use it as a router. See above: one port, so no wired LAN.
• Different Wi-Fi settings per access point. Name, security and passphrase have to match, or roaming does not work.
• Putting in a repeater where a cable would have fitted. A repeater always gives you less than half. A cable is boring and wins.