Yes, it is possible to configure CAPsMAN (Controlled Access Point system Manager) on a MikroTik device and remotely manage other CAPs (Controlled Access Points) on another site through an IPsec site-to-site tunnel.

This scenario allows wireless configuration management to be centralized and applied uniformly to devices in multiple locations, ensuring that wireless network settings are consistent and security policy is maintained across sites.

Configuring CAPsMAN through an IPsec Tunnel

To achieve this, follow the general steps below:

Step 1: Establish IPsec Connectivity

Make sure the IPsec tunnel between the two sites is properly configured and functional. This tunnel will ensure that communication between the CAPsMAN and the CAPs is secure and private.

Step 2: Configure CAPsMAN on the Main Site

On the MikroTik device that will act as CAPsMAN:

1. Enable CAPsMAN Service
   
   /caps-man manager set enabled=yes
   
2. Configure the Address Pool for CAPs
   
   /caps-man addresses add address=192.168.88.0/24
   
3. Create Configuration for CAPs
   
   /caps-man configuration
add name="config1" ssid="MiSSID" security=configuration-name="security1"
   
4. Set Security Settings
   
   /caps-man security
add name="security1" encryption=aes-ccm passphrase="MiPasswordSeguro"
   
5. Configure the Channel
   
   /caps-man channel
add name="channel1" band=2ghz-b/g/n frequency=2412 width=20mhz
   

Step 3: Configure the CAPs on the Remote Site

On each of the MikroTik access points at the remote site:

1. Enable CAP Mode
   
   /interface wireless cap
set enabled=yes discovery-interfaces=bridge-local interfaces=wlan1 caps-man-addresses=192.168.[IP_CapsMAN]
   
   Make sure to replace 192.168.[IP_CapsMAN] with the IP address of the CAPsMAN that must be reachable through the IPsec tunnel.

Step 4: Verify and Monitor the Connection

1. Verify Connection in CAPsMAN
   
   /caps-man manager print
   
   Verify that the CAPs are connected and managed correctly.
2. Monitor the Status of CAPs
   
   /caps-man remote-cap print
   

Additional considerations

• IPsec Tunnel Stability: Make sure that the IPsec tunnel is stable and reliable, since the management of the CAPs depends on this connection.
• Security: Verify that security settings such as WPA2 or WPA3 are correctly implemented to protect wireless communication.
• Testing: Perform extensive testing to ensure that wireless settings are applied correctly across the CAPs and that the network is functioning as expected.

Configuring CAPsMAN over an IPsec site-to-site tunnel is a great way to centralize wireless network management across multiple locations, ensuring consistency and ease of management across your network infrastructure.