Not every site needs centralised CAPsMAN — sometimes it's one AP in a shop or a villa, and you just want solid, modern Wi-Fi. This configures a standalone RouterOS AP with the wifiwave2 stack: WPA3, multiple SSIDs each on their own VLAN, guest isolation, and a clear line on when to graduate to a managed fleet. The counterpart to Cisco's autonomous-vs-lightweight split.
RouterOS wireless has two lineages, and using the wrong one dates you: the legacy /interface wireless package, and the modern wifiwave2 stack (on current 7.x, the menu is /interface wifi). Wifiwave2 is the one to use on any AC/AX hardware — it brings WPA3, 802.11ax, and a cleaner profile model. This post is the standalone case: a single AP configured on the box itself, the direct analogue of a Cisco autonomous AP. When you outgrow it, the fleet answer is CAPsMAN — the RouterOS equivalent of a Cisco WLC.
The model is three reusable profiles — security (auth + passphrase), configuration (SSID + mode), and channel (band/width) — attached to a radio, plus virtual APs for extra SSIDs. The security payoff, exactly as on wired and on Cisco, is one SSID per VLAN. (Menu note: on 7.13+ it's /interface wifi; earlier 7.x used /interface wifiwave2 — same concepts.)
01
Start with the primary SSID: a security profile with WPA2/WPA3 mixed (so old and new clients both connect), a configuration profile with the SSID, and enable the radio.
# Security: WPA2+WPA3 transitional so legacy clients still join. /interface wifi security add name=sec-corp authentication-types=wpa2-psk,wpa3-psk passphrase="S3cr3t-WiFi-Key" # Apply SSID + security to the radio and bring it up. /interface wifi set wifi1 configuration.ssid=CORP configuration.mode=ap \ security=sec-corp channel.band=5ghz-ax channel.width=20/40/80mhz disabled=no > /interface wifi print # running, clients can associate
WPA3 is the right target, but set authentication-types=wpa3-psk alone and every pre-2019 phone, printer, and IoT gadget silently fails to connect — with users just saying "wrong password." Use the transitional mode (wpa2-psk,wpa3-psk) so modern clients get WPA3 and legacy ones fall back to WPA2 on the same SSID. Only go WPA3-only when you control every client (a locked-down corporate SSID). This is the wireless version of "don't break the estate to chase the newest standard."
02
A guest network and an IoT network are extra virtual APs on the same radio, each tagging its traffic into a different VLAN via the datapath — the wireless half of segmentation.
# Guest security profile with client isolation on (guests can't see guests). /interface wifi security add name=sec-guest authentication-types=wpa2-psk,wpa3-psk passphrase="Guest-Pass" # A virtual AP on wifi1: its own SSID, and datapath VLAN 20. /interface wifi add name=wifi-guest master-interface=wifi1 configuration.ssid=GUEST \ security=sec-guest datapath.vlan-id=20 datapath.client-isolation=yes disabled=no # The bridge must have VLAN 20 tagged toward this radio and the DHCP/gateway # for VLAN 20 in place — see the VLANs post. IoT SSID = same pattern, VLAN 30.
On a guest SSID, datapath.client-isolation=yes stops one guest device from reaching another on the same radio — the wireless complement to bridge horizon on the wired side. Without it, a guest with malware can scan and attack every other guest, VLAN or no VLAN, because they share the radio's broadcast domain. Turn it on for any untrusted SSID. Guest isolation is a per-radio and per-VLAN setting, not something the Wi-Fi password does — the exact point the plain-language guest-Wi-Fi guide makes to owners.
03
The radio tags client traffic into VLANs; the bridge has to carry those VLANs. Then confirm the SSIDs are up and clients land on the right VLAN.
# Ensure the AP's VLANs exist on the bridge and are tagged toward the uplink. /interface bridge vlan add bridge=bridge vlan-ids=20 tagged=bridge,ether1 add bridge=bridge vlan-ids=30 tagged=bridge,ether1 # --- Verify --- > /interface wifi print # all SSIDs running > /interface wifi registration-table print # associated clients, signal, SSID > /interface wifi registration-table print stats # rates, retries
04
Standalone is perfect for one AP. The moment you have two or more, per-device config becomes the same trap as Cisco autonomous — and the answer is centralisation.
One AP: configure it standalone as above and move on. Two or more APs, or any site where clients roam between them: stop copying config by hand and move to CAPsMAN, which provisions every AP from one controller with one set of profiles — the RouterOS equivalent of the Cisco lightweight/WLC model. The decision point is exactly the same on both platforms: standalone for one, managed fleet for many. Don't build a five-AP hotel out of five hand-configured standalone radios.
Takeaways
/interface wifi), not the legacy wireless package, on modern hardware — it's the one with WPA3 and 802.11ax.datapath.vlan-id, and the bridge must carry those VLANs — segmentation is wireless too.client-isolation on guest SSIDs stops guest-to-guest attacks on the shared radio — the password doesn't do this.NOCTIS designs Wi-Fi on MikroTik and Cisco across Crete — standalone done properly with WPA3 and VLAN-segmented SSIDs, or a centrally-managed fleet with seamless roaming when you outgrow one radio.
Book a Discovery Call →