OmniTIK 5 PoE ac

The OmniTIK 5 PoE ac (product code RBOmniTikPG-5HacD) is an access point with a small switch underneath it. Five gigabit ports, four of which can supply power, and one radio on 5 GHz. That makes it a distribution point: where the cable arrives it broadcasts Wi-Fi and feeds a few devices nearby at the same time, cameras for instance, or a next access point. The catalogue lists it with the default configuration ap, with ether1 as the WAN port should you want to use it as a router after all.

The ports

• ether1: 1 Gbit, with PoE-in. This is the cable to your switch or router: data and power at once. This is where your VLANs arrive tagged.
• ether2 to ether5: 1 Gbit, all four with PoE-out. You can hang devices off these and power them at once.

PoE-out is switched on per port in advanced. Before you switch all four on, read PoE-out per port: this device is itself powered over ether1, so everything it passes on has to be supplied at the far end of that one cable. Feeding four devices from a single injector often does not quite work out. Which ports end up in the bridge is covered in Bridge and ports.

VLANs and the switch chip: read this first

The catalogue records hw_vlan: switch-menu for this model. That means the switch chip keeps its VLAN table in /interface ethernet switch, not in the bridge. Switch VLANs on and the tool writes bridge VLAN filtering, with a note attached: that works, but it turns hardware offload off. VLAN traffic is then forwarded by the processor instead of the switch chip.

In practice: for an access point with a few SSIDs on different VLANs you will not notice, because that traffic has to pass the radio anyway. If you use the four ports as a switch with a lot of wired traffic between them, it does cost throughput. You only get that back by configuring the switch chip by hand, which the configurator does not write. See VLANs.

Wi-Fi

One radio, wlan1, on 5 GHz. No 2.4 GHz. That is a deliberate shape: 5 GHz is where the speed comes from and where it is quieter. It does mean that devices which only know 2.4 GHz, such as much IoT equipment and older printers, will never join here. If you need that band, a second access point has to come along. The country you pick decides which channels and what power are allowed on 5 GHz, including where DFS applies. See Channels, width and power.

The Wi-Fi package for this model is wireless, the older of the two in RouterOS v7, so the configurator writes the wireless side as /interface wireless. One consequence shows up immediately: that package has no WPA3. Pick WPA2/WPA3 or WPA3 and the tool sets the SSID up as WPA2-PSK with AES, and says so. See Setting up Wi-Fi.

What is inside

From the catalogue: a MIPSBE processor and 128 MB of memory. Comfortable for the roles this device gets, and above the point where the configurator warns about tight memory. The licence level and the type of switch chip are not recorded for this model, so this page does not quote them.

What it is good at, and where it runs out

Good at: putting out 5 GHz Wi-Fi where a single cable arrives, and powering a few devices from that same spot. It also works as one end of a wireless link between two buildings, with the Wireless CPE role.

Where it runs out:

• No 2.4 GHz. Anything that needs that band will not get on.
• VLANs cost hardware offload here. See the section above.
• QoS in software. Set up a queue tree and FastTrack goes off. Enter a line above 200 Mbit and the tool warns that the processor becomes the bottleneck and the priorities stop holding. Fair share per host with CAKE or fq_codel is then almost always better. See QoS and bandwidth.
• The old Wi-Fi package. No WPA3, and station-bridge only works towards another MikroTik that also runs wireless.

Which roles fit

• Access point: the default role here. Everything bridged, SSIDs optionally per VLAN, management address by DHCP or static.
• CAP (managed by CAPsMAN): when SSIDs and security are set centrally. See CAPsMAN.
• Wireless CPE / point-to-point: as the station or the AP end of a wireless link. The question "What is at the other end?" decides the station mode, see Receiving Wi-Fi instead of broadcasting it.
• Home router and Office router with VLANs: with five ports they are offered. Read the section about the switch chip first.
• Wi-Fi repeater / extender: with one radio the same board rebroadcasts on the same band, so expect well under half the throughput.

The quickest route to a working configuration

1. Pick One device and search for OmniTik.
2. Pick Access point, or Wireless CPE for a link between two places.
3. Walk through the wizard: country, SSID, security, management address, password.
4. If you want PoE-out, switch it on per port in advanced.
5. Reset the device and paste the script. See Using the script.

If there are several access points, use Multiple devices in one site so the SSID, security and passphrase are identical everywhere. For a camera network on the PoE ports, see Recipe: a camera network.

What trips people up

• Switching PoE-out on four times from one injector. Work out what comes in before counting what goes out.
• Expecting full throughput with VLANs on. Bridge VLAN filtering turns hardware offload off here. The tool says so; read it.
• Looking for 2.4 GHz. There is one radio, on 5 GHz. Devices that only know 2.4 GHz never show up here.
• Forgetting the management VLAN. If it does not arrive tagged on ether1, the device is unreachable once you paste.