Cambium Network Rescue · Runbook
Updated 2026-10-11 · Applies to cnMaestro On-Premises 6.0.0-r11
Cambium says cnMaestro Cloud “may not support Enterprise devices post the end of October, 2026” and recommends moving Wi-Fi and switch accounts to cnMaestro On-Premises. The move is easiest while the cloud is still up. This runbook follows Cambium’s own published guidance, step by step, and adds the problems operators have reported on the Cambium Community forum, each with its thread number. Eleven steps, the “Waiting for subscription” fix, how to re-point remote sites, and what does not migrate.
Independent. Ambio Edge Networks is an independent network engineering firm. We are not affiliated with, authorized by, or a partner of Cambium Networks, Airspan Networks, Univastu or the administrators (RSM UK). Product names are trademarks of their owners, used only to identify the equipment we work on.
Scope
cnPilot, XV, XE and other enterprise access points, and cnMatrix switches. These are the devices Cambium’s guidance tells you to move to On-Premises now.
Cambium recommends migrating only enterprise devices for now. If you move fixed-wireless devices too, put them on a separate On-Prem server. For Airspan-owned lines, follow Airspan’s instructions first.
Cambium: “NSE is not supported on cnMaestro On-premises.” Its NSE 2.5 beta (thread 108960, updated 2026-10-08) gives NSE 3000/4000 a full local web UI. Plan a replacement or local management, not a migration.
Cambium’s words are “through at least October 2026.” Exports and bulk re-pointing need the cloud. Start now and don’t plan to finish on the last day.
Official sources
Get the image and the documentation from Cambium directly. We don’t host, mirror or redistribute the image.
Cambium’s guidance points to support.cambiumnetworks.com/files/cnmaestro/ for the On-Premises images, release notes and user guide. It needs a free Cambium support login. The 6.0.0 release was announced on 2026-07-15 (thread 108620) and ships as an OVA. Cambium says 6.0.0-r11 fixes onboarding through the Cloud Anchor and can be upgraded to from r5 in the UI.
The cnMaestro On-Premises User Guide is on cambiumnetworks.com. Its “cnMaestro features” table is Cambium’s full list of what On-Prem does and doesn’t do. Anchor account setup is in the cnMaestro 6.3 online help.
Cambium: “please do not clone VMs; create each one from scratch.” Cloned VMs share a synthetic serial number and overwrite each other in the Anchor. Community threads 108854, 108889 and 108979 describe running the image on other hypervisors and in Azure after a disk conversion. Those are operator reports, not Cambium support.
The sequence
Steps 01 to 04 change nothing and are safe to do today. Steps 05 to 11 are the migration. Steps 05 to 08 depend on the Cloud Anchor answering.
Anchor warning. Cambium: if the Anchor is disconnected, “cnMaestro on-premises will continue to work, but you will not be able to add or delete any devices.” Operators reported the Anchor not answering licence and claim requests from about 2026-10-02 to about 2026-10-06 (thread 108849, posts #195–#222). If onboarding stalls, check the Anchor before you change anything else.
Export group configuration from Configuration > Wi-Fi Profiles and Switch Profiles. Export serial numbers (inventory) and subscriptions. On cnMaestro X you can also script exports through the API.
Why: the cloud is the only place this lives. Once it stops answering, there is nothing left to export.
Cambium: “If you have device overrides, note them from Device → Configuration → Device Configuration page for each device.” On cnMaestro X, Wi-Fi AP overrides can be bulk-exported from Site > Devices > Configuration > Bulk Config > Device Overrides > Export/Import. Cloud 6.3 switch port configuration is not supported on 6.0 On-Prem, so save each switch’s device config by hand.
Why: operators report that applying a switch group on On-Prem wipes per-port settings (thread 108849, posts #223–#225, 2026-10-08). Your saved config is how you put them back.
Current and one-back firmware for each AP and switch model, stored off-site, plus a record of which version each device runs today. Downloads are limited to 10 files every 20 minutes (thread 109026, 2026-09-30), so pace it. Details on Cambium firmware download and what to save.
Why: On-Prem upgrades use files you upload yourself.
Cambium recommends an exact replica of each cloud account on On-Prem, and migrating only enterprise devices for now. Fixed-wireless devices go to a separate On-Prem server if you move them at all. For Airspan-owned lines, Cambium recommends keeping them together in one account or instance.
Why: depending on who ends up owning which line, Cambium says you may later have to split products onto separate instances anyway.
Save the Onboarding Key and Cambium ID. New Anchor accounts since 2026-09-17 include a 90-day cnMaestro X trial. When the trial ends, Cambium says On-Prem “will degrade to Essentials.” Operators reported an “Ownership Conflict” error on brand-new Anchor accounts on 2026-10-01 (thread 108849, post #186).
Why: On-Prem 6.0 can’t add devices without the Anchor.
One fresh VM per instance, never a clone. Size it for your device count using the user guide. Snapshot the VM before first boot and again after each milestone.
Why: snapshots are your rollback if an import or upgrade goes wrong.
Link the instance with the Cambium ID and Onboarding Key. One operator’s working playbook enables claiming by Cambium ID in the On-Prem onboarding settings and loads every WLAN and AP profile and site before any device arrives (thread 108849, post #48). Then import the profiles you exported in step 01.
Why: devices that arrive before their profiles exist are the ones operators report getting stuck.
Cambium’s order: set the On-Prem server on each device (community article 63164 gives the CLI; syntax differs by product), delete the group’s devices from the cloud, then approve them in the On-Prem onboarding queue. Wait a few minutes for subscription slots to come through. Operators add: wait until the device shows online in the queue before deleting it from the cloud, and don’t approve it until it is deleted.
Why: change the server first. One operator deleted a cnWave 60 GHz radio from the cloud before re-pointing it; it became unreachable and had to be onboarded again (thread 108849, post #42).
Onboard each switch, then add back the port lines you saved in step 02 before you apply any switch group. Check PoE on every AP port afterwards.
Why: if per-port settings go, every AP behind that switch can go dark.
Captive portals can fail on the appliance’s self-signed certificate. Cambium staff point to the Certificate Management section of the 6.0 user guide (thread 108959, 2026-09-23). UPSK and the Google, Azure and social logins in EasyPass are not available on On-Prem, so plan another path for those SSIDs.
Why: test from a phone before you tell anyone the cutover is done.
Where you control the site’s DHCP server, send options 15, 43 and 60 so factory-reset devices find On-Prem on their own (community article 45792). Confirm every device is online and configured. Take a VM-level backup and store it off the host. If you test a restore, do it on an isolated network where the copy can’t reach the Cloud Anchor, then destroy the copy. Put SNMP monitoring on the devices themselves.
Why: a migration you can’t restore is a liability. Monitoring that doesn’t depend on any Cambium cloud keeps you from being blind again.
Troubleshooting
This is the most-reported migration problem. Operators describe it in thread 108849 as “Waiting for Subscription” (posts #34 and #36, 2026-09-18), stuck “getting a license” (#74, 2026-09-21) and “Device could not acquire subscription slot” (#177, 2026-09-30).
The most common cause in operator reports. The device reached On-Prem but its subscription is still held by the cloud account. One operator’s summary: if it gets stuck waiting on subscription, you forgot to remove it from the original tenant (post #48). Delete it from the cloud, wait a minute or two, then approve it on On-Prem.
Approving before the cloud delete has gone through can leave a device in a permanent wait (post #48). Another operator got stuck devices through by re-approving them with only a site, or the default, and no configuration, then moving them once onboarded (post #89). The device keeps its running config meanwhile.
Cambium says every device must acquire a subscription slot, “even for Essentials,” and adding devices depends on the Anchor. Check the instance is linked to the Anchor account and the X trial is active. If many devices stall at once, suspect the Anchor itself (see the outage note above).
An NSE 3000 reported “could not acquire subscription slot” (post #177). Cambium staff confirmed NSE is not supported on On-Premises at all (post #179). No fix exists for that one.
Remote sites
Every device has to learn the new server address. Which method works depends on what reaches the site today.
While the cloud answers, you can re-claim devices to On-Prem by serial number instead of touching each one (thread 108849, post #48). Change the management server before deleting anything from the cloud.
Article 63164 gives the CLI to set the remote management server. If you can SSH to devices over a VPN or management network, push that change in a loop, one group at a time. Syntax differs between products, so test one device of each model first.
Set the DHCP options from article 45792 at each site. New and factory-reset devices will find On-Prem without a visit. Cambium also says devices need a trusted network path to On-Prem: “avoid public networks.”
Put an out-of-band jump host or site VPN in place, then use one of the methods above. One community recipe ran Tailscale on the On-Prem server and on a remote NSE 3000 in a single test (thread 109074, 2026-10-08). It is an operator recipe, not Cambium guidance.
Known clean-up issues: operators can’t delete PMP 450m APs from On-Prem after unclaiming them from the cloud, with no confirmed fix (thread 109077, 2026-10-09), and there is no bulk delete in the cloud (thread 108849, post #226). Sites with no remote access at all need someone on site. We cover Sacramento and the Bay Area in person.
FAQ
Partly. The cloud is needed to export configuration and to re-point devices in bulk. Adding devices to On-Prem depends on the Cloud Anchor, which is a separate service. Without the cloud, devices can still be re-pointed one at a time by CLI or DHCP options, as long as the Anchor still answers. Cambium commits the cloud through at least October 2026; we plan against 2026-10-31.
Yes, as of 6.0.0-r11. New Anchor accounts since 2026-09-17 include a 90-day cnMaestro X trial; when it ends, On-Prem degrades to Essentials. If the Anchor is disconnected, On-Prem keeps working but you cannot add or delete devices. Cambium says it plans a Wi-Fi and switch image with no Anchor dependency before the Anchor shuts down, but has given no date.
In operator reports, the usual cause is that the device is still claimed in the cloud account, or was approved on On-Prem before the cloud delete went through. Delete it from the cloud, wait a minute or two, then approve it. If many devices stall at once, check the Anchor link and the trial. NSE devices never get a slot because NSE is not supported on On-Prem.
Yes. Cambium’s method changes the management server on the running device by CLI, then you delete it from the cloud and approve it on On-Prem. Operators report the device keeps its existing configuration until On-Prem applies a group to it. DHCP options 15, 43 and 60 are for devices that get factory reset later.
Per Cambium: Network Assurance, some EasyPass features (Google, Azure and social logins, UPSK), MarketApps, some 6 GHz features, and support for NSE and RV22. Cloud 6.3 switch port configuration must be saved and re-entered by hand. Device overrides must be noted by hand, or bulk-exported on cnMaestro X for Wi-Fi APs.
Cambium ships the 6.0 image as an OVA through its support portal. Community threads describe running it on other hypervisors and in Azure after a disk conversion; those are operator reports. Cambium says to build each instance fresh and never clone a VM, because clones share a serial number in the Anchor.
Sources
All accessed 2026-10-11. Forum posts are operator and staff reports, not official documentation.
Done for you
cnMaestro On-Prem stand-up and migration: time and materials at $325/hr, with a written estimate before any job over 2 hours. It runs on your existing hypervisor, or on a customer-owned mini PC we can source at cost + 15%. You own the server and the data.
Network Risk Assessment: from $3,500 (one site, up to three switch groups (a stack counts as one), 100 connected devices and 6 access points; larger estates and WISP networks priced by size on our assessment pricing page).
Continuity Monitoring for Cambium equipment: from $497/month; scope and onboarding quoted after an inventory. Monitoring only: alerts route to your team, with no included changes and no engineer response target. Any work is billed at our hourly rates.
Ambio Edge Networks is an independent network engineering firm. We are not affiliated with, authorized by, or a partner of Cambium Networks, Airspan Networks, Univastu or the administrators (RSM UK). Product names are trademarks of their owners, used only to identify the equipment we work on. Questions about creditor claims go to the administrators at [email protected]; we don’t give legal or creditor advice.
