Cambium Network Rescue · Runbook
Updated 2026-10-19 · Applies to cnMaestro On-Premises 6.0.0-r11
Update 2026-10-19: Univastu completed its purchase of Cambium’s ePMP and Enterprise businesses and cnMaestro on 2026-10-14, and Cambium now says cnMaestro Cloud “will continue to operate on a go-forward basis.” There is no published shutdown date, so this is no longer a race. On-Premises is still the way to put the management plane on hardware you control while the new owner’s service and support terms are unpublished; Cambium’s migration guidance (updated 2026-09-24) recommends it for Wi-Fi and switch accounts. cnMaestro is the dashboard you manage your Cambium Wi-Fi and switches from; the access points and switches keep working without it, but you lose the ability to see or change them. The move is easiest while the cloud is still up. This runbook follows Cambium’s own published guidance, step by step, and adds the problems operators have reported on the Cambium Community forum, each with its thread number. Eleven steps, the “Waiting for subscription” fix, how to re-point remote sites, and what does not migrate. Do it yourself from this page, or have us do it: migration at $325 an hour with a written estimate first, monitoring from $497 a month, or a $1,250 network audit if you only want the records saved. Prices are at the bottom of this page.
Independent. Ambio Edge Networks is an independent network engineering firm. We are not affiliated with, authorized by, or a partner of Cambium Networks, Airspan Networks, Univastu or the administrators (RSM UK). Product names are trademarks of their owners, used only to identify the equipment we work on.
Scope
cnPilot, XV, XE and other enterprise access points, and cnMatrix switches. These are the devices Cambium’s guidance tells you to move to On-Premises now.
Cambium recommends migrating only enterprise devices for now. If you move fixed-wireless devices too, put them on a separate On-Prem server. For Airspan-owned lines, follow Airspan’s instructions first.
Cambium: “NSE is not supported on cnMaestro On-premises.” Its NSE 2.5 beta (thread 108960, updated 2026-10-08) gives NSE 3000/4000 a full local web UI. Plan a replacement or local management, not a migration.
Cambium now says the cloud continues “on a go-forward basis” (2026-10-15). Exports and bulk re-pointing still need the cloud, so do the move while it is up, on your schedule.
Official sources
Get the image and the documentation from Cambium directly. We don’t host, mirror or redistribute the image.
Cambium’s guidance points to support.cambiumnetworks.com/files/cnmaestro/ for the On-Premises images, release notes and user guide. It needs a free Cambium support login. The 6.0.0 release was announced on 2026-07-15 (thread 108620) and ships as an OVA (a ready-made virtual machine file you import into your server software). Cambium says 6.0.0-r11 fixes onboarding through the Cloud Anchor and can be upgraded to from r5 in the UI.
The cnMaestro On-Premises User Guide is on cambiumnetworks.com. Its “cnMaestro features” table is Cambium’s full list of what On-Prem does and doesn’t do. Anchor account setup is in the cnMaestro 6.3 online help.
Cambium: “please do not clone VMs; create each one from scratch.” Cloned VMs share a synthetic serial number and overwrite each other in the Anchor. Community threads 108854, 108889 and 108979 describe running the image on other hypervisors and in Azure after a disk conversion. Those are operator reports, not Cambium support.
The sequence
Steps 01 to 04 change nothing on your network and are safe to do today; if you only have an hour, do those four. Steps 05 to 11 are the migration. Steps 05 to 08 depend on the Cloud Anchor answering. If you would rather hand steps 01 and 02 off, our network audit and documentation delivers the configuration export, the inventory with lifecycle dates and the port/VLAN map you need open for step 09.
Anchor warning. Cambium: if the Anchor is disconnected, “cnMaestro on-premises will continue to work, but you will not be able to add or delete any devices.” Operators reported the Anchor not answering licence and claim requests from about 2026-10-02 to about 2026-10-06 (thread 108849, posts #195–#222). If onboarding stalls, check the Anchor before you change anything else.
Export group configuration from Configuration > Wi-Fi Profiles and Switch Profiles. Export serial numbers (inventory) and subscriptions. On cnMaestro X you can also script exports through the API.
Why: the cloud is the only place this lives. Once it stops answering, there is nothing left to export.
Cambium: “If you have device overrides, note them from Device → Configuration → Device Configuration page for each device.” On cnMaestro X, Wi-Fi AP overrides can be bulk-exported from Site > Devices > Configuration > Bulk Config > Device Overrides > Export/Import. Cloud 6.3 switch port configuration is not supported on 6.0 On-Prem, so save each switch’s device config by hand.
Why: operators report that applying a switch group on On-Prem wipes per-port settings (thread 108849, posts #223–#225, 2026-10-08). Your saved config is how you put them back.
Current and one-back firmware for each AP and switch model, stored off-site, plus a record of which version each device runs today. Downloads are limited to 10 files every 20 minutes (thread 109026, 2026-09-30), so pace it. Details on Cambium firmware download and what to save.
Why: On-Prem upgrades use files you upload yourself.
Cambium recommends an exact replica of each cloud account on On-Prem, and migrating only enterprise devices for now. Fixed-wireless devices go to a separate On-Prem server if you move them at all. For Airspan-owned lines, Cambium recommends keeping them together in one account or instance.
Why: Airspan now owns some lines and Univastu others. Airspan says it will support only the lines it bought, and Univastu hasn’t published terms; Cambium says you may later have to split products onto separate instances anyway.
Save the Onboarding Key and Cambium ID. New Anchor accounts since 2026-09-17 include a 90-day cnMaestro X trial. When the trial ends, Cambium says On-Prem “will degrade to Essentials.” Operators reported an “Ownership Conflict” error on brand-new Anchor accounts on 2026-10-01 (thread 108849, post #186).
Why: On-Prem 6.0 can’t add devices without the Anchor.
One fresh VM per instance, never a clone. Size it for your device count using the user guide. Snapshot the VM before first boot and again after each milestone.
Why: snapshots are your rollback if an import or upgrade goes wrong.
Link the instance with the Cambium ID and Onboarding Key. One operator’s working playbook enables claiming by Cambium ID in the On-Prem onboarding settings and loads every WLAN and AP profile and site before any device arrives (thread 108849, post #48). Then import the profiles you exported in step 01.
Why: devices that arrive before their profiles exist are the ones operators report getting stuck.
Cambium’s order: set the On-Prem server on each device (community article 63164 gives the CLI; syntax differs by product), delete the group’s devices from the cloud, then approve them in the On-Prem onboarding queue. Wait a few minutes for subscription slots to come through. Operators add: wait until the device shows online in the queue before deleting it from the cloud, and don’t approve it until it is deleted.
Why: change the server first. One operator deleted a cnWave 60 GHz radio from the cloud before re-pointing it; it became unreachable and had to be onboarded again (thread 108849, post #42).
Onboard each switch, then add back the port lines you saved in step 02 before you apply any switch group. Check PoE on every AP port afterwards.
Why: if per-port settings go, every AP behind that switch can go dark.
Captive portals can fail on the appliance’s self-signed certificate. Cambium staff point to the Certificate Management section of the 6.0 user guide (thread 108959, 2026-09-23). UPSK and the Google, Azure and social logins in EasyPass are not available on On-Prem, so plan another path for those SSIDs.
Why: test from a phone before you tell anyone the cutover is done.
Where you control the site’s DHCP server, send options 15, 43 and 60 so factory-reset devices find On-Prem on their own (community article 45792). Confirm every device is online and configured. Take a VM-level backup and store it off the host. If you test a restore, do it on an isolated network where the copy can’t reach the Cloud Anchor, then destroy the copy. Put SNMP monitoring on the devices themselves, or have us run it: Continuity Monitoring for Cambium equipment from $497/month.
Why: a migration you can’t restore is a liability. Monitoring that doesn’t depend on any Cambium cloud keeps you from being blind again.
Troubleshooting
This is the problem operators report again and again. Operators describe it in thread 108849 as “Waiting for Subscription” (posts #34 and #36, 2026-09-18), stuck “getting a license” (#74, 2026-09-21) and “Device could not acquire subscription slot” (#177, 2026-09-30). If a batch is stuck and the clock is running, we can take it from here at $325 an hour, estimate first: Schedule a conversation.
The cause operators report first. The device reached On-Prem but its subscription is still held by the cloud account. One operator’s summary: if it gets stuck waiting on subscription, you forgot to remove it from the original tenant (post #48). Delete it from the cloud, wait a minute or two, then approve it on On-Prem.
Approving before the cloud delete has gone through can leave a device in a permanent wait (post #48). Another operator got stuck devices through by re-approving them with only a site, or the default, and no configuration, then moving them once onboarded (post #89). The device keeps its running config meanwhile.
Cambium says every device must acquire a subscription slot, “even for Essentials,” and adding devices depends on the Anchor. Check the instance is linked to the Anchor account and the X trial is active. If many devices stall at once, suspect the Anchor itself (see the outage note above).
An NSE 3000 reported “could not acquire subscription slot” (post #177). Cambium staff confirmed NSE is not supported on On-Premises at all (post #179). No fix exists for that one.
Remote sites
Every device has to learn the new server address. A truck roll means sending a person to the site; these four methods avoid one. Which works depends on what reaches the site today.
While the cloud answers, you can re-claim devices to On-Prem by serial number instead of touching each one (thread 108849, post #48). Change the management server before deleting anything from the cloud.
Article 63164 gives the CLI to set the remote management server. If you can SSH to devices over a VPN or management network, push that change in a loop, one group at a time. Syntax differs between products, so test one device of each model first.
Set the DHCP options from article 45792 at each site. New and factory-reset devices will find On-Prem without a visit. Cambium also says devices need a trusted network path to On-Prem: “avoid public networks.”
Put an out-of-band jump host or site VPN in place, then use one of the methods above. One community recipe ran Tailscale on the On-Prem server and on a remote NSE 3000 in a single test (thread 109074, 2026-10-08). It is an operator recipe, not Cambium guidance.
Known clean-up issues: operators can’t delete PMP 450m APs from On-Prem after unclaiming them from the cloud, with no confirmed fix (thread 109077, 2026-10-09), and there is no bulk delete in the cloud (thread 108849, post #226). Sites with no remote access at all need someone on site. We cover Sacramento and the Bay Area in person; the same engineer runs our Sacramento Fortinet MSP and Fortinet MSP in San Francisco plans.
FAQ
Partly. The cloud is needed to export configuration and to re-point devices in bulk. Adding devices to On-Prem depends on the Cloud Anchor, which is a separate service. Without the cloud, devices can still be re-pointed one at a time by CLI or DHCP options, as long as the Anchor still answers. As of 2026-10-19 Cambium says the cloud will continue on a go-forward basis, with no end date published.
Yes, as of 6.0.0-r11. New Anchor accounts since 2026-09-17 include a 90-day cnMaestro X trial; when it ends, On-Prem degrades to Essentials. If the Anchor is disconnected, On-Prem keeps working but you cannot add or delete devices. Cambium says it plans a Wi-Fi and switch image with no Anchor dependency before the Anchor shuts down, but has given no date.
In operator reports, the usual cause is that the device is still claimed in the cloud account, or was approved on On-Prem before the cloud delete went through. Delete it from the cloud, wait a minute or two, then approve it. If many devices stall at once, check the Anchor link and the trial. NSE devices never get a slot because NSE is not supported on On-Prem.
Yes. Cambium’s method changes the management server on the running device by CLI, then you delete it from the cloud and approve it on On-Prem. Operators report the device keeps its existing configuration until On-Prem applies a group to it. DHCP options 15, 43 and 60 are for devices that get factory reset later.
Per Cambium: Network Assurance, some EasyPass features (Google, Azure and social logins, UPSK), MarketApps, some 6 GHz features, and support for NSE and RV22. Cloud 6.3 switch port configuration must be saved and re-entered by hand. Device overrides must be noted by hand, or bulk-exported on cnMaestro X for Wi-Fi APs.
Cambium ships the 6.0 image as an OVA through its support portal. Community threads describe running it on other hypervisors and in Azure after a disk conversion; those are operator reports. Cambium says to build each instance fresh and never clone a VM, because clones share a serial number in the Anchor.
Time and materials at $325 an hour, with a written estimate before any job over two hours. The On-Prem server runs on your existing hypervisor or on a mini PC we source at cost + 15%; the server, the backups and the data are yours. A network audit ($1,250 per site) gives you the configuration export, inventory and port/VLAN map if you only want the groundwork done.
Sources
All accessed 2026-10-11, except the 2026-10-15 Cambium announcement (accessed 2026-10-19). Forum posts are operator and staff reports, not official documentation.
Done for you
cnMaestro On-Prem stand-up and migration: time and materials at $325/hr, with a written estimate before any job over 2 hours. It runs on your existing hypervisor (your server software), or on a mini PC you own that we source at cost + 15%. You get the On-Prem server stood up, every supported device re-pointed, your overrides and switch port settings put back, and a VM backup taken before handover. You own the server and the data.
Network audit and documentation: $1,250 per site. The as-built map (what is actually installed), a device inventory with lifecycle dates, a configuration export and a port/VLAN map: the groundwork for steps 01 and 02 of this runbook, done and handed to you. What the audit includes.
Network Risk Assessment: findings and a 30-60-90 plan on top of the audit, from $3,500 for a single small site (one firewall, up to three switch groups (a stack counts as one), 100 connected devices and 6 access points); larger estates and WISP networks are priced by size on the assessment pricing page. It is yours to keep. See a sample report (PDF).
Continuity Monitoring for Cambium equipment: from $497/month; scope and onboarding quoted after an inventory. Monitoring only: alerts route to your team, with no included changes and no engineer response target. Any work is billed hourly: $225/hr for routine changes, $325/hr for migration engineering, with a written estimate before any job over 2 hours. The monitoring does not depend on any Cambium cloud, so the alerts keep coming if the cloud becomes unavailable.
Ambio Edge Networks is an independent network engineering firm. We are not affiliated with, authorized by, or a partner of Cambium Networks, Airspan Networks, Univastu or the administrators (RSM UK). Product names are trademarks of their owners, used only to identify the equipment we work on. Questions about creditor claims go to the administrators at Cambium.restructuring@rsmuk.com; we don’t give legal or creditor advice.
