Você está na página 1de 520

PMP 450 Training

Version 3.4
Welcome and Introductions

Housekeeping Items
 Sign In
 Course Materials
 Restrooms
 Breaks
 Lunch

Course Expectations
 What brought you here?
 What are your current Wireless Network plans?

Course Outline - Modules
1. PMP450 Solution Overview Day 1
a. System Architecture and Components
b. Product Specs
2. PMP450 RF Technology Principles
a. Understanding RF Fundamentals
b. Understanding RF Scheduler and Synchronization
3. PMP450 Planning and Deployment
a. Planning Principles and Best Practices
b. Link Capacity Planner Tool
a. Instructor lead Lab
c. Link Planner Tool
a. Individual Lab
d. Frame Calculator and Co-Location Tools
a. Individual Lab

Course Outline - Modules
4. PMP450 Configuration Day 2
a. Student Lab Setup
b. Basic Initial Deployment Configuration
c. In-Depth Configuration
5. PMP450 Advanced Features
a. NAT
b. Protocol and Port Filtering
c. PPPoE
d. VLAN & Q-in-Q
a. VLAN Lab
e. QoS & SLA
a. QoS Radius Class LAB
b. QoS VoIP Class LAB
f. Security
a. Radius Class Lab
Course Outline - Modules
6. PMP450 Management Day 3
a. Configuration Management
• Manual Save / Restore
• Auto Provision using DNS
• SNMP Provisioning
b. cnMaestro & Wireless Manager
7. PMP 450 Statistics and Tools
a. Data VC Lab with HP channel
b. Spectrum Analyzer Lab
c. Link Capacity Lab
8. PMP450 Troubleshooting
a. Physical & RF Issues
b. Network Issues
9. Exam Prep
10. PMP450 Course Wrap-up
Overall Objectives
At the end of this session, participants should be able to:

1. Understand PMP450 product specifications

2. Understand PMP450 system architecture
3. Describe the advantages of GPS synchronization
4. Describe common deployment options
5. Understand configuration options and Advanced Features
6. Understand Management Features
7. Understand Troubleshooting techniques

Terms and Conditions of the Presentation
• This document is proprietary and confidential information of Cambium Networks, Inc. (“Cambium”), and is licensed to and

intended to be used solely for internal, personal, use by the individual to whom this document was sold (“you” or

“Student”). ©2017-2018 Cambium Networks, Inc.

• These materials are licensed to the Student on a personal, non-assignable, non-transferable, non-exclusive basis to, and intended

to be used by you solely for your internal, personal, use, with no right to copy, reproduce, replicate, or distribute, either physically

or electronically, any part hereof. No part of these materials may be reproduced or distributed in any form or by any means, or

stored in a database or retrieval system, without the prior written permission of Cambium. You agree not to remove from these

materials any of Cambium’s proprietary and/or copyright notice(s).

• The information presented in these materials are for general information and training purposes only, and are updated by

Cambium on a regular basis. However, the information contained herein is provided by Cambium on an "as is" and "as available"

basis, and Cambium makes no (and has not authorized any other party to make on its behalf any) representations or warranties of

any kind, express or implied, about these materials or any information contained herein being accurate, complete, reliable,

suitable, current, or error-free, or that you will pass any certification exam as a result of your use of these materials. Any reliance

you place on these materials is therefore strictly at your sole risk. In no event will Cambium be liable for any loss or damage

including without limitation, indirect or consequential loss or damage, or any loss or damage whatsoever arising out of, or in

connection with, the use of, reference to or reliance on these materials.

PMP 450 Training

Solutions Overview
Cambium Networks
Wide Temperature Range
-40º to +140º C
-40º to +60º C

More Than
Mean Time Between
5 Billion Failure
MTBF excluding

Field Hours lightning damage > 100

in service Wind Speed Survival
200 mph

Industry Track Record

More than 10 years experience

Cambium Portfolio
Proven Fixed Wireless Network Solutions
Product ePMP 450/450i 450m 670 820
Unparalleled Industry Leading
Massive MU-MIMO
Budget Constrained Scalability for Sub-6GHz Microwave
Design Focus technology delivers
Residential Multipoint Performance Backhaul
ground breaking
networks Up to 8 M-PTP
spectral efficiency
Up to 200 Mbps / Up to 1Gbps* /
Throughput 250+ Mbps / sector 450 Mbps 1+ Gbps
sector sector
900, 2.4, 3.5, 3.65, 5
Spectrum (GHz) 2.4, 5 GHz 5 GHz 4.9 – 6.0 GHz 6 – 38 GHz

• Extreme Capacity, Unparalleled Scalability

• Low-Cost, Low-Complexity, Low-Maintenance Infrastructure
• Scalable from small to region wide deployments
• Consistent throughput and low latency
• Rapid Deployment
• Supports Video, Data, Voice and Control Applications
• NLOS, nLOS and LOS performance
PMP Portfolio Specifications
Legacy Fixed Wireless Network Solutions
Product PMP 105 PMP 320 PMP 400 PMP 430
Budget Cost Effective Public Safety High Performance
Design Focus 3.5 / 3.65GHz
Small networks Large networks 4.9 GHz Large Networks
Fixed Outdoor
Up to 14 Mbps /
Throughput 7/14 Mbps / sector 48 Mbps / sector 20 Mbps / sector 50 Mbps / sector
900 MHz, 2.4, 5.1,
900 MHz, 2.4, 5.2,
Spectrum (GHz) 5.2, 5.4, 5.8, 5.9, 3.3, 3.5, 3.6 4.9 5.4, 5.8
5.4, 5.8,
PMP Portfolio Specifications

Next Generation Fixed Wireless

Network Solutions

Product PMP 450 PMP 450i

High PPS, High

High Performance
Design Focus Throughput,
Large Networks
Large Networks

Up to 185 Mbps /
sector 250+ Mbps / sector
5-30MHz 5-40MHz channels

2.4, 3.5, 3.65, 5.4-
Spectrum (GHz) Wideband 3.5-3.65
Wideband 4.9-5.9
PMP Portfolio 450m Specifications
cnMedusa™ Massive MU-MIMO
technology delivers ground breaking
spectral efficiency
High Capacity, spectral
Design Focus efficient performance,
interference mitigation
Up to 500+ Mbps / sector in a
20MHz Channel, future 30 &
40MHz channels support 1Gbps
/ sector

Up to 185 Mbps / sector

5-30MHz channels

Spectrum (GHz) 4.9-5.9

Additional Features Fiber port, AUX PoE Out

PTP Portfolio Specification
Legacy Point-To-Point Links
Product PTP 100 PTP 230 PTP 250 PTP 500 PTP 600 PTP 650
Design Budget Links Budget Links
Cost Effective High High High
Focus Short Links Performance Performance Performance

Integrated / Integrated / Integrated / Integrated / Integrated / Integrated /

Antenna Connectorized Connectorized Connectorized Connectorized Connectorized Connectorized
Up to 250
Throughput 7/ 14 Mbps 50 Mbps
52 / 105Mbps 150 / 300 Mbps 125 / 450 Mbps

Spectrum 2.4, 5.2, 5.4, 5.7

5.4, 5.7 GHz 5.4, 5.7 GHz 5.4, 5.7 GHz
2.5, 4.5, 4.8, 4.9,
4.9-6.05 GHz
(GHz) GHz 5.4, 5.7, 5.9 GHz
PTP Portfolio Specification
Reliable Links To Meet Your Needs
Product PTP 450i PTP 670 PTP 700 PTP 800 PTP 810 PTP 820
Budget Mission Critical High High Multi-Core High
Design Focus Performance High Capacity Performance Performance Performance
High Capacity
Links Multipoint Licensed Licensed Licensed
Integrated / Integrated / Integrated / Split Mount Split Mount / All outdoor /Split
Connectorized Connectorized Connectorized / All Indoor All Indoor mount /All indoor

Throughput 300+ Mbps 450 Mbps 450 Mbps 368 Mbps 700 Mbps Gigabit Speeds

Spectrum PTP 450i – 900,

4.9-6.05 GHz 4.5-6.05 GHz 6 – 38 GHz 6 – 38 GHz 6 – 38 GHz
(GHz) 3GHz, 4.9-5.9 GHz
Cambium WiFi Portfolio
cnMaestro™ WiFi Controller and Network Manager

Client Restful APIs

Planning Management Analytics, Monitoring,
Policy Management
AP Management WiFi Controller

cnPilot ™ Family of WiFi Access Points

cnPilot™ R190, R200, ePMP™ 1000 Hotspot cnPilot™ Indoor E400, cnPilot™ Outdoor E500,
R201 E410, E600 E501s

PMP 450 Design
• 4th Generation (4G) of PMP product family from Cambium
• Dramatically increases overall system capacity
– Up to 300 Mbps per Access Point (40MHz Channel)
– Over 1.5 Gbps of tower bandwidth possible
– Can support any symmetrical or asymmetrical speed
• OFDM MIMO provides near Line of Sight (nLOS) and LOS access
• Software defined radio design allows for rapid expansion of
frequency bands, both licensed and unlicensed
• Utilizes GPS synching capability to achieve maximum spectral
efficiency and very low latency supporting VoIP and video

• Installation and turn up in

days, not weeks or months
PMP 450 Advantages
Characteristic Cambium PMP Implications
Without scheduled TDD, users will
Scheduled TDD – Deterministic and
Channel Access complain about availability as
Scalable regardless of load
subscribers are added.
Consistent and Deterministic – Without consistent latency, network
Latency and QoS critical for voice and video and T1 users will complain about delays
replacements and poor performance.
Unsynchronized systems perform
Supported -> Efficient Channel Re- inconsistently and poorly as
GPS Synchronization use / Easy Deployment. in Multi- subscribers are added. Use more
Sector / Multi-Site systems channels to serve the same # of
High ability for frequency reuse.
Competitive systems require more
Throughput and System Higher aggregate real user
AP towers to be added to meet
Capacity throughput and system capacity for
demand – but this adds
(bits/sec/Hz/sq km) given channel width and available
PMP 450 GPS Synchronization
• AP and SM communication is
synchronized (all APs and SMs
have controlled alternating
communication) – reducing
self interference
– All SMs within a network
– All APs within a cluster
– All APs on a tower (multiple clusters)
– All APs on all towers in the network
• Enables channel re-use and
easy to deploy multi-sector,
multi tower networks
(minimal tower separation)
• Use the same number of
channels to serve a higher
number of users
Next Generation – PMP 450i and PTP 450i
• New Radio Design
– Ultra Wide-band radio – 4900 to 5925 MHz
• Includes Dynamic Interference Filtering
– 900MHz
– Wide-Band 3.5-3.65GHz (Q3 2016)
– Improved Radio Characteristics
• Increased Transmit Power
• Better Receive Sensitivity
• New FPGA / SoC architecture
– Platform evolution to new generation
– Expect to triple processing power of radio at
launch with path to >75k PPS
– Allows for wider channel support leading to
more throughput
Next Generation – PMP 450i and PTP 450i
• Ruggedized, IP66/67
– Visually similar to PTP 650
– All metal construction
– Increased Reliability in harsh
– Optional ATEX/HAZLOC
certified models available

• New Power scheme

– 802.3at PoE compatible
– Aux port with PoE Output
• Allows direct connection of
camera or other equipment
Dynamic Interference Filtering

Static Filter

5.925 GHz Interference from

Neighboring Dynamic Filter
Impacting the Radio

RADIO Selected Channel


Selected Channel
4.900 GHz
Static Filter
Dynamic Filter

Spectrum Traditional Fixed Filter Cambium’s Dynamic Filtering

Makes Radio Susceptible Wraps around selected channel,
to Neighboring Channel Filtering out Interference from
Interference Neighboring Channels
Overview: PMP 450 Series Architecture

Base Station
Subscriber Module
AP Cluster
(Up to 12)




CMM cnPilot Home Router


Operator’s SS
IP Network

AP: Access Point SM: Subscriber Module

SS:– Surge Suppressor IP: Internet Protocol
CMM: Cluster Management Module C3VoIP – Cambium ATA Router
Components and Options
• Access Point
• Access Point Antenna’s
• Access point RF Cables
• Remote Module
• Cluster Management Module (CMM)
• Universal GPS
• Power Supplies
• Surge Suppression (SS)
• Remote Module Lens/CLIP/Reflectors
PMP 450 AP’s
Introduction of PMP 450i 5GHz AP
Category Specification
Ethernet 1000BaseT (Gig-E) Interface, 10/100BaseT Aux interface
Frequency 4900 - 5925 MHz
Max Throughput Up to 300 Mbps in 40MHz Channel
Modulation Modes
QPSK, 16QAM, 64QAM, 256QAM
Latency 3-5ms (2.5ms frame), 6-10ms (5ms frame)
Max TX Power Up to +27 dBm combined
Channel Bandwidth 5, 10, 20, 30, 40 MHz (2.5MHz interval)
15 W typical, 25 W max, 55 W max with Aux port PoE out
Power Consumption
AP Antenna 17 dBi – 90°/120° integrated or sector
26.0 x 13.4 x 6.4 cm (10.3” x 5.3” x 3.3”) Connectorized
AP Dimensions
59.5 x 15.7 x 15.5 cm (23.4” x 6.2” x 6.1”) Integrated
Security 56-bit DES, FIPS-197 128-bit AES
Power 48-59vdc, 802.3at Compliant
Aux Port Ethernet PoE Out, Sync In/Out
Dynamic Interference Filtering, Optional ATEX/HAZLOC certified
Introduction of PMP 450i 3GHz AP
Category Specification
Ethernet 1000BaseT (Gig-E) Interface, 10/100BaseT Aux interface
Frequency 3300 - 3900 MHz
Max Throughput Up to 300 Mbps in 40MHz Channel
Modulation Modes
QPSK, 16QAM, 64QAM, 256QAM
Latency 3-5ms (2.5ms frame), 6-10ms (5ms frame)
Max TX Power Up to +25 dBm combined
Channel Bandwidth 5, 10, 20, 30, 40 MHz (50KHz interval)
15 W typical, 25 W max, 55 W max with Aux port PoE out
Power Consumption
AP Antenna 17 dBi – 90°/120° integrated or sector
26.0 x 13.4 x 6.4 cm (10.3” x 5.3” x 3.3”) Connectorized
AP Dimensions
73.2 x 19.7 x 15 cm (28.8” x 7.8” x 5.9”) Integrated
Security 56-bit DES, FIPS-197 128-bit AES
Power 48-59vdc, 802.3at Compliant
Aux Port Ethernet PoE Out, Sync In/Out
Dynamic Interference Filtering, Optional ATEX/HAZLOC certified
Introduction of PMP 450 2.4GHz

Category Specification
1000BaseT (Gig-E) Interface, built in Surge
Frequency 2400-2483.5 MHz

Max Throughput Up to 180 Mbps (30MHz Channel)

Modulation Modes
QPSK, 16QAM, 64QAM, 256QAM
Latency 3-5ms (2.5ms frame), 6-10ms (5ms frame)

Max TX Power +22 dBm combined

Channel Bandwidth 5, 10, 20, 30 MHz

Power Consumption 10 W typical , 14 W peak

AP Antenna 18 dBi – 60° sector

AP Dimensions 11” x 8” (Current PMP 450 AP)

Security DES or AES

Antenna not as shown

Components and Options 5GHz AP Antenna
Features 90°/120° Sector Antenna
Range: 4.9 GHz to 5.97 GHz
90° - 3dBi rolloff, 120° - 6dBi rolloff
8° Elevation
Electronic -2° downtilt
Dual Linear, Horizontal / Vertical
Front-to-Back Ratio: 35dB
Gain: 17dBi
Size: 23.4”(H) x 6.2” (W) x 4.3 (D)
(594mm x 157mm x 110mm)

6.8 kg (15 lbs) - Integrated

Components and Options 3GHz AP Antenna

Features 90°/120° Sector Antenna

Range: 3.3 GHz to 3.9 GHz
90° - 3dBi rolloff, 120° - 6dBi rolloff
8° Elevation
Electronic -2° downtilt

Dual Linear, Horizontal / Vertical

Front-to-Back Ratio: 35dB

Gain: 17dBi
Size: 73.2 x 19.7 x 15 cm (28.8” x 7.8” x
5.9”) Integrated
7 kg (15.5 lbs) - Integrated
Components and Options 2.4GHz AP Antenna

Features 60° Sector Antenna

6° Elevation - OFDM

Elevation Null to -18° - OFDM

Dual Pol, Dual Slant +/- 45°

Gain: 18dBi
Size: 1122h x 245w x 117d mm
Weight: 9.5 kg (21 lb), w/o bracket
Physical Ports – PMP450 2.4GHz AP
Interface Function

RF Port RF Antenna
Label A -45deg

RF Port RF Antenna
Label B +45deg
GPS synchronization
signaling, provides
Sync/Default power to uGPS
module. Default
plug port.
RJ45 cable
and data)
Ground Lug For grounding the
(bottom of unit) unit
Physical Ports – PMP450i AP
Interface Function
10/100BaseT 10/100.1000BaseT
Ethernet Port, PoE
RF Antenna
AUX Port RF Port
PoE Out Connection
Label A 5GHz: Vert
900, 3GHz: -45deg
RF Antenna
RF Port connection
Label B 5GHz: Horz
900, 3GHz: +45deg

10/100 BaseT RJ45

RF Port Label B RF Port Label a
Aux Port GPS synchronization
signaling, PoE Out

Ethernet, 10/100/1000 BaseT
Ethernet RJ45
(management 802.3at Compliant
and data)
For grounding the
Ground Lug
PMP 450m

• cnMedusaTM technology enhances sector

capacity by combining a smart
beamforming antenna array with multiple
RF transmit and receive chains, effectively
multiplying available capacity by more than
three times.
• Multi-User MIMO more effectively uses
available spectrum by simultaneous
transmissions to multiple subscribers,
increasing spectral efficiency to more than
40 bps/Hz.

PMP 450m

• Protect your investment in the 450

platform equipment by continuing to utilize
existing Subscriber Modules (both 450 and
450i SMs work with the 450m and
cnMedusa technology).
• Dramatically reduce the effect of
interference with smart beamforming
• SFP port allows for greater deployment
flexibility, and AUX port allows for
connection of camera or other PoE directly.

PMP 450 SM’s
Components and Options – PMP450 SM
2.4GHz, 5.4 – 5.8 GHz
12Watts power consumption
3-5ms (2.5ms frame), 6-10ms (5ms frame)
Diffserve QoS
Up to 22db depending on Region
Quick-Mount Hardware
Antenna Gain:
9dBi 5GHz, 8dBi 2.4GHz

4Mbps, 10Mbps, 20Mbps, and
uncapped versions available
Components and Options – PMP450 SM
3.5GHz, 3.65GHz
12Watts power consumption
3-5ms (2.5ms frame), 6-10ms (5ms frame)
Diffserve QoS
Up to 25db depending on Region
Quick-Mount Hardware
Antenna Gain: 8dBi

4Mbps, 10Mbps, 20Mbps, and
uncapped versions available
Components and Options – PMP450 SM
Connectorized - All Frequencies
12Watts power consumption
3-5ms (2.5ms frame), 6-10ms (5ms frame)
Diffserve QoS
Two LMR 195 antenna cables
Quick-Mount Hardware
Up to 23dB depending on Region
IP 55
4Mbps, 10Mbps, 20Mbps, and
uncapped versions available
Physical Ports – PMP450 SM

Ethernet Sync /
Interface Function
Ethernet, Ethernet
Ethernet communications
(management and

Sync / Default
ult plug port.

Ground Lug on
back of For grounding the
connectorized unit
PMP 450 Subscriber Module Tiers
4Mb 10Mb 20Mb Uncapped
20 MHz channel 80
*5ms frame in 13.3,
throughput in 5
&10 MHz channels
SMs fully upgradeable from 4 to 10, 20 & Uncapped Software keys available to easily move between tiers
Burst bucket has increased from 500 Mb to 2.5 Gb! Amount of burst can be fully managed per SM
Components and Options, CLIP
Snaps onto PMP 100/430/450 Series SMs
Compresses beam to 18° azimuth and Elevation
9dB of Gain @ 5.4GHz for PMP100
8dB of Gain @ 5.4GHz for PMP430/450
9dB of Gain @ 5.8GHz for PMP100/450
8dB of Gain @ 5.8GHz for PMP430

PMP100 Integrated – 5.1, 5.2, 5.4, 5.8, and
PMP430 SM - 5.4, and 5.8GHz
PMP450 SM – 5GHz
Components and Options, Reflector
Installs with specific mounting bracket
Compresses beam to 6° azimuth and
18dB of Gain @ 5GHz for PMP100
15dB of Gain @ 5GHz for PMP430
14 dB of Gain @ 5GHz for PMP450
12 dB of Gain @ 2.4 and 3GHz for PMP450
PMP100 Integrated – 5.1, 5.2, 5.4, 5.8, and
PMP430 SM - 5.4, and 5.8GHz
PMP450 Integrated SM – 2.4, 3.5, 3.65, 5GHz
PMP 450d - Integrated Dish SM

• 5GHz Only
• 25 dBi Integrated dish
• Works with existing power supplies
• Compatible with cnPilot Home
• Extremely easy to assemble and
• Reduce total cost of ownership:
– Single supplier
– Speed of installation
– Improved first install rates
Components and Options – PMP450b SM
Wideband 4.9 – 5.925 GHz
9watt, 12watt peak power consumption
Gigabit Ethernet
5, 10, 15, 20, 30 or 40 MHz Channels
Up to 300Mbps in 40MHz Channel
45,000 PPS
Up to 22db depending on Region
3.5 mm audio alignment jack

Mid Gain Model High Gain Model

17dBi 25dBi
12.5 x 24.8 x 12 cm 47 cm diameter x 28 cm
(4.9” x 9.8” x 4.7”) (18.5” diameter x 11.2”)
PMP 450 – 3GHz High Gain SM

• 3.5GHz or 3.65GHz
• +25 dBm combined output
• 10° azimuth for 19 dBi
integrated antenna
• Works with existing power
• Compatible with cnPilot
Home Router
• Uncapped SM only
PMP 450i – High Gain Directional SM

• Integrated Flat Panel Antenna

– 23 dBi Gain
– 12” x 12” panel
– 11° azimuth and elevation
– Compact design
– Easy Alignment and Installation

• New Tilt Bracket Assembly

– Sturdy mounting bracket
– Reduced installation time
ATEX and HAZLOC Certified

PMP 450i will also be available with ATEX / HAZLOC Certification

ATEX (Atmospheres Explosibles) HAZLOC (Hazardous Locations)
Equipment Group II Class 1 Location
Category 3 / Zone 2 Division 2
Gas Group IIC Gas Groups A, B, C, D
Temperature Class T4
ATEX / HAZLOC Oil & Gas Applications
• Target Markets:
– PetroChem
– Utility (Generation and Transmission)
– Defence
• Solution:
– PTP 700 and 450i Series
– 4. 9 to 5.85 GHz
– ATEX and HAZLOC Compliant
– Dedicated SKUs
• Value Proposition
– Universal radio for all applications
• Non LOS
• Over Water
• Over long distance
• High RF interference
– Avoid expensive NEMA
– Established field reliability
– Easy to plan and install link

PMP 450 900MHz Introduction
• PMP 100 (legacy 900MHz FSK) systems have been in use for many years
and continue to work
– Low but very reliable data rate
– Consistent throughput
– Good penetration in nLOS and NLOS applications
• New bandwidth demands have pushed the limits of FSK capacity
– Voice/Video application adoption Video Cloud Computing M-2-M

– Low bandwidth availability

– Spectrum congestion
– User scalability
• Need for migration to newer technologies and hardware
– Increased spectral efficiency
– Improved interference mitigation
– Increased channel size Mobile Data is
– Seamless transition
– Much higher capacity
Source: Cisco VNI 2012
450i 900 MHz: Key System Features
• Product Mission Statement:
– Cambium Network’s 450i 900 MHz product platform is the path to higher
throughput for tough to reach customers
– Increased coverage and throughput
• Improved Radio system, same propagation
– PMP 450i 900 MHz: Providing more throughput for difficult links

450i 900 MHz: Key System Features
Features Customer Benefit / Competitive Advantage
Redesigned 900 MHz Radio
Increased performance, based on 450i platform
(902-928 MHz)
Improved Range and Make NLOS links. Using 900 MHz, propagation is fantastic. Upgrade your
Coverage tough NLOS deployments to higher throughputs.
Specified using Industrial-rated components. Designed to meet IP66 and
Rugged Enclosure for AP
IP67 ratings for harsh environments.
Clean installation for SM Attach the SM directly to the slim but powerful (12 dBi) Yagi antenna.
Triple the processing power compared to PMP 450, an order of
Updated SoC (FPGA)
magnitude more than PMP 100. Allows for future platform
chipset on the AP enhancements.
A second Ethernet port with multiple functions allow for greater
Multifunction AUX port on
flexibility of deployment: add a camera or other PoE device directly,
the AP provide GPS timing in/out, and an audible alignment tone.
Industry standard 802.3at PoE compatible on the AP. Continue to use the
Updated Power Scheme
existing 30 VDC power for the SMs.

PMP 450i 900 MHz Overview
• 900 MHz ISM band Operation
– 902-928 MHz
– 5, 7, 10 or 20 MHz channels supported
• 2x2 MIMO design
– Allows higher capacity
• Power Scheme - New for AP, Same for SM
– AP 802.3at PoE compatible (56 VDC)
– SM 30 VDC, can re-use existing PSU
• Next Generation Architecture
– Utilizing PMP 450i architecture
– Maximize Spectral efficiency
• Using GPS timing and colocation with PMP 100 900 MHz
• Product Design Goal
– Under similar RF conditions, similar channel size, 8x PMP 100
– 4 Mbps capacity to 32 Mbps capacity
– In clean spectrum, PMP 450 900 MHz can provide 100+ Mbps
per sector
PMP 450i 900 MHz Migration Strategy

• Phased approach for systems that are deployed in the same geographical area, either during
migration or as a permanent solution
– Objective: Provide strategy for migrating one Hub at a time, versus a total rip and replace
– Recommend to replace the entire Hub, versus one ODU
• When co-locating systems, either for migration from an older technology to a newer technology, or
for a more permanent mixed deployment, it is important to select the correct system parameters in
order to avoid interference
– However, with different hardware models, choosing the same parameters on both systems
(e.g. duty cycle, range, contention slots, etc.) does not guarantee coexistence
– Use the co-location/migration tool in order to determine optimal co-existence parameters

PMP 450i 900 MHz Migration Strategy

• Two areas of focus:

– Synchronization and timing between FSK and PMP 450i systems for co-location and migration
– Optimal antenna and channel setup for co-location, migration and performance

• When multiple APs are deployed in the same geographical area, it is important that they all transmit
and receive at the same time, especially for migration and co-location of multiple system types

Migration Synchronization and Timing
• Both PMP 100 and PMP 450i are TDD systems
– A TDD cycle, or frame, is the minimum amount of time used to
communicate in both directions
• Different systems have different frame lengths and timing
– Choosing the same parameters on both systems (e.g. duty cycle,
range, contention slots, etc.) does not guarantee coexistence
– Use the migration tool in order to determine optimal transmit/receive
timing parameters to be configured on the AP.
– The Duty-cycle parameter (Downlink/Uplink Ratio) is recommended
to be changed first

Antenna and Channel Considerations
• Importance of Front to Back Ratio
– Front to Back Ratio is the ratio of power gain between
the front and rear of a directional antenna

 The ratio tells how good the antenna is at rejecting signals from the rear

 F/B ratio is important when antennas are orientated in a hub (antennas facing
in opposite directions) and using the same frequency

– Front to Back Ratio not really a concern in legacy PMP 100 (FSK) systems
because FSK uses only lower modulation levels
– Higher modulation rates require >32dB F/B ratio
– Using legacy FSK system antennas is not recommended when using newer
OFDM radios
 Use dual polarity antennas for optimal speed, performance and efficiency

Cambium 900MHz Antennas
• Performance Differentiation
– Dual slant polarization system to isolate from Vertical or Horizontal
– High Front to Back ratios to allow Frequency Re-use and high Spectral

• SM Yagi Antenna
– Dual slant
– 40° beam width
– 36” in length
– Cables to connect the SM

• AP Sector Antenna
– 902-928 MHz
– 65 degree (3 dB beam width)
– Can be used for 60 or 90 degree sector*
– Front/Back Ratio: > 32 dB
– 35” x 11” x 5”
– AP radio will mount to back of antenna

*A new 90° sector (3 dB rolloff) to be released in future

PMP/PTP Accessories
AC Power Injector AC+DC Power Injector
Model # N000065L001B C000065L002B
Extended Temperature Range
Key Attributes Low-cost AC/DC redundant power input
Required for AUX port powering
Inputs 120-240VAC
Output 56 VDC 56 VDC

Temperature 0° C to 40° C -40° C to +60° C

Range 32° F to 104° F -40° F to 140° F

Ordered Seperately
Power Cord N000065L003A - US
US included
Subscriber Module Power Supply
Power Injector for SM AC Line Cable
Model # N000900L001B N000900L007A
30 VDC PSU for Subscriber Module
Key Attributes Up to 15W
US Line Cord (IEC-60320 Type C5)

Inputs 120-240VAC 120-240VAC

Components and Options, Surge Suppressors

The 200SSB and provides a path to ground that
protects the connected radio equipment from
near miss lightening strikes

200SSB CMM3/4 DC lines
600SSB ALL PMP Models
GigE Surge Suppressor

Model Number C000000L033A

Connectors 2 x RJ-45 1000BaseT

Power 56VDC nominal

(compatible with PMP/PTP 450i)
Protection Mode Line-to-Line and Line-to-Ground

Response time TBD

Surge Rating TBD

Operating Temperature -40° F (-40C) to +140° F (+60C)

Operating Humidity 100% condensing

Mounting Pole or wall-mount

Dimensions TBD

Weight TBD

Environmental IP55
Components and Options, Brackets
The SMMB1 provides a mounting solution for
standard radio deployments

PMP100/430/450 SMs

The SMMB2 provides a mounting solution for
heavy duty radio deployments

PMP100/320/400/430/450 SMs
PMP 450 Sync Options
Components and Options, CMM4 Outdoor
Provides GPS sync and “Power over Ethernet”
(PoE) to up to 8 Access Points
Supplies either 30VDC or 56VDC power
Dual back up power inputs
Connects to GPS antenna
RJ11 aux timing port for GPS slaving

Supplied with our without 14 port switch

PMP100/320/400/430/ePMP/450 AP’s
Components and Options, CMM4 indoor

Features Compatibility
8 RJ45 Ports that Supply PoE and Sync PMP100/320/400/430/ePMP/450 AP’s
8 RJ45 Ports that pass through the
Ethernet from above mapped 1 to 1
RJ45 for Management
Dual 30VDC Terminal inputs
Dual 56VDC Terminal inputs
N type connecter to GPS
RJ11 aux timing port for GPS slaving
Components and Options, uGPS

Cost effect unit to provide GPS sync for two Aps
using RJ11/12 port
Supplied by standard 30VDC
Supplies GPS sync via RJ11 timing port
PMP 100/320/400/430/450 access points

Ext Power /
Default plug Timing port 2

Timing port 1

CMM5 Features

• Point-to-Multipoint AND Point-to-Point

– Distribution of synchronization and power
– Centralized monitoring of power and sync
• Platform
– Gigabit Ethernet support
– Modular and Scalable from 4 to 32 Ports
– Direct +/-48 VDC input or external AC/DC power supply
– Dual Resilient Power Inputs
– Rack-mount solution
– Remote management (http and snmp)
– cnMaestro support (roadmap)

CMM5 Components

• 4-port Rack-mount Power Injector (2U; half-width stand-alone module)

– 56vdc version (PMP 450m, PMP 450i, ePMP2000, PTP 450i, PTP 650/700)
– 29vdc version (PMP 100, PMP 450)
• Controller
– 1U; half-width stand-alone module
– Optional (only needed for remote management)
• uGPS
• DC power supplyOption 1: +/-48VDC from existing source
– Option 2: 240W AC/DC supply
– Option 3: 600W AC/DC supply

CMM5 – Scenario 1

CMM5 – Scenario 2

PMP 450 Client Premise Equipment
Managed cnPilot™ Home + Small Business
Key Specifications
Rich Voice/Call Features
• Voice Activity Detection,
Echo cancellation, Three-way calling
• Call hold, Call forwarding,
Call transfer, Call waiting

PoE to PMP 450

Networking Features
• VoIP: SIP V2, Adaptive jitter buffer
or ePMP SM
• DHCP, Dynamic DNS, 802.1Q,802.1P,

• Cambium Cloud /NoC Management,
Remote Troubleshooting, Provisioning
• SNMP V2 ,TR-069
4LAN Ports 2 Phone

Desktop Internet TV Printer Network FAX Phone

Managed cnPilot™ Home + Small Business
Single, 2.4,
R190w - -
R190 Single, 2.4,
R190v - ✓
Single, 2.4,
R200 - ✓
Single, 2.4,
R200 R200P ✓ ✓
Dual band,
R201 - ✓
R201 R201p
Dual band,
✓ ✓
Dual band,
R201w ✓ -
Simplifying the Home Network


AC Adaptor

VoIP server
1 Cambium POE

Eth 802.11ac 4-8 Port

PSTN 2 Router RJ-45



AC Adaptor

Simplifying the Home Network


cnPilot™ Home + AC Adaptor

PMP 450 SM
Small Business
ePMP 1000 SM
VoIP server
1 Cambium POE

2 802.11ac
Router 3 4-8 Port

Up to 4 VoIP ATA 4
Things in One

Cambium 450 Platform Summary
• Industry leading PMP and PTP solution for critical networks
• Proven field reliability
– Built upon our quality legacy (preceding product fielded for >10 years)
– >40 Year calculated MTBF (based on field returns and reliability testing)
• Extreme Scalability
– Access Points can support many subscribers
– Many Access Points can be deployed at each site for maximal throughput
– 2x2 MIMO provides high bandwidth for LOS access
– Single payload modulations provide link enhancement for nLOS and NLOS
• GPS synchronization
– Maximize spectral efficiency, frequency re-use across network
– Minimize self-interference, maintain low and consistent latency
• Robust Roadmap for future platform enhancements
– Serving customer needs for years to come

PMP 450 Training

RF Technology Principles
RF and Link Budget Basics

What is Radio and how did we get here?
• Basic Radio Hardware & Terminology

• Antenna Basics – Single and Diversity Antennas

• Interpreting Antenna Patterns

What is Radio and how did we get here?
• Radio Frequency is small part of what is referred to as Electromagnetic Radiation (EMR)
• We are exposed to EMR every day, both naturally and man made

What is Radio and how did we get here?
• What is our biggest single source of EMR?
• Sunlight or white light is made up of many
single colors
• Each color can be measured by its
wavelength and amplitude

What is Radio and how did we get here?
• Wave - a motion through matter or vacuum
• Electric Field - space within which an electric charged object will feel a push (like) or pull
(unlike) from a charged source. An electric field can generate a magnetic field.
• Magnetic Field - a force produced by a moving electric field that exists around a magnet. A
magnetic field can generate an electric field.
• Electromagnetic Wave - a propagating combination of electric and magnetic fields. The
alternating current (AC) in the antenna generates a magnetic field which creates an electric
field ad infinitum

What is Radio and how did we get here?
• Electric and magnetic fields are oscillating perpendicular to each other and they are both
perpendicular to the direction of the propagation.
• The wave created is a specific wavelength and frequency. For voice and data
communications, it is called a Radio Frequency Wave or RF wave.

What is Radio and how did we get here?

2.4Ghz Has longer Wavelength than 5.8Ghz

Radio Waves are measured in KHz, MHz, and GHz Popular Radio Frequencies
The lower the frequency the physically longer the radio AM Radio 1100 KHz
wave – Higher freqs have much shorter waves as such Shortwave 3 – 30 KHz
take more power to move them greater distances. They FM Radio 88 – 108 MHz
also will attenuate more when passing through objects Weather 162.4 MHz
such as foliage or walls. This is why 2.4GHz propagates Cellular Phones 700MHz – 2GHz
farther then 5 GHz (given the same amount of RF Wifi a/b/g/n 2.4 & 5 GHz
power) 89
A Radio needs a Proper Antenna!

Omni-Directional Antennas like the ones to the

right radiate much like a typical light bulb would
everywhere in all directions

Note: Same RF
energy is used but
results in greater
range as it’s focused
2.4 GHz

Antennas are custom made for the at the cost of other

coverage areas
frequency to be used. Some

antennas have two elements to

allow for different frequencies or Directional antennas like this
polarizations (Vertical and “Patch” antenna radiate
Horizontal) in one antenna housing forward like a flashlight

RF Connectors and Cable Types

RF Attenuation Exponential Decay Watts


• Loses power by inverse square of distance
• To calculate power at receiver means you must
multiply and divide using very large numbers
and very small fractions
Attenuation Exponential Decay in Linear Form


• Logarithms allow addition and subtraction of
easier to use numbers
• Called decibels or “dB”

Decibels – Power (dBm)
“Decibels” are used to
relate the attenuation (loss)
of a wireless signal.
Decibels follow a
logarithmic relationship
where adding decibels
corresponds to exponential
growth on the linear
domain (Watts).

Shortcut: 10mW = 10dBm

Use 3/10 rule to calculate other
dBm = 10 x log10(PowermW) values
mW = 10dBm/10 10dBm + 10dB + 3dB + 3dB =

Example: 1 watt = 10 x log10(1000) = 30 dBm 94

Acceptable Reception - What is Necessary?


• Sufficient signal strength for the receiver to
process the information correctly
• Sufficient energy for the sensitivity of the
Path loss
Free space path loss

FSPL Free space loss is a ‘simple’ calculation :

FSPL (dB) =
 wavelength( m ) 2 
10 log10  
Negative Value  (4 × π × distance ) 2
 (m) 
Or Wavelength =
Speed of Light (m/s)
Frequency (Hz)

FSPL (dB) =   4π  2 
10 log10   df  
Positive Value  c  

Simplified to FSPL (dB) = 20 log10 (d ) + 20 log10 (f ) − 147.56
Positive Value

Shortcut: Every doubling of distance is -6dB, 1/2 is +6dB

Free Space loss vs Frequency to 20Km

Calculators.html 97
Physics of Radio
Lower versus Higher Frequencies - Summary

• All radio signals weaken [attenuate] as they go through the air


• Low frequency = long wavelengths - travels farther with less


• High frequency = short wavelengths – travels shorter distances

• Very high frequencies can have their energy reduced by weather or

environment (fog, rain, leaves, trees)

RF Link Budget Basics

Radio Basics - Overview

• Making a link from A to B: a series of gains and losses

Antenna Path Antenna

(Gain) (Loss) (Gain)
Transmissio Transmissio
n Line (Loss) n Line (Loss)

Radio TX Radio RX
(Output Power) (Threshold

Radio Basics – Transmit Power

• The higher the radio’s output power the better for a radio link
• Transmit power is often limited by regulations.
• The output power is usually measured in dBm or Watts.

Radio Basics – Transmit Power vs EIRP
Equivalent Isotropic Radiated Power (EIRP)
• Describes the amount of power that a theoretical perfect
isotropic antenna would emit to produce the peak power
density observed in the direction of maximum antenna gain.
• EIRP is sometimes used as the unit to limit transmit power
• EIRP (in dBm) = Transmit (Tx) power of the Radio (in dBm)
+ Gain of the Antenna (in dBi)
- Cable loss (in dB)

Example EIRP Calculation

Tx Power 25dBm
Antenna Gain 28dBi
Cable Loss 1dB
EIRP 52dBm
Making the Link
Transmission Loss

• Loss occurs in any radio cable, but usually the higher the
frequency, the higher the loss.
• This RF cable should be kept as short as possible and be of a
high standard, radios with integrated Antennas have no loss.
• Is usually expressed in dB.

Making the Link
Antenna Gain

• Antennas have gain as they focus the radio energy into a

narrow beam and have large surface areas to receive more of
the signal.
• In most cases larger antennas have higher gains and narrower
beam width. Larger antenna are harder to align, but due to
there narrower beam width pick up less noise/interference.

System Gain Example:
PMP Using Integrated Antennas, FCC 5.8GHz, 20MHz, 2x

(Gain) Transmissio
Transmission n
Line (Loss)
Radio Line (Loss) Radio
(Output (Threshold
Power) )
Tx Power 20dBm EIRP 36dBm Antenna Gain 9dBm

Antenna Gain + 17dBi Minimum Receive Receive threshold -84dBi

level -93dBi
Transmission Loss - 1dB Transmission Loss - 0dB
System Gain
EIRP 36dBm (Difference Minimum Receive
between the above level -93dBm
figures) 129dB
Note:- Integrated Units Have no Transmission Loss
System Gain Example:
PMP Using Integrated Antennas, FCC 5.8GHz, 20MHz, 2x, dish

(Gain) Transmissio
Transmission n
Line (Loss)
Radio Line (Loss) Radio
(Output (Threshold
Power) )
Tx Power 20dBm EIRP 36dBm Antenna Gain 23dBm

Antenna Gain + 17dBi Minimum Receive Receive threshold -84dBi

level -107dBi
Transmission Loss - 1dB Transmission Loss - 0dB
System Gain
EIRP 36dBm (Difference Minimum Receive
between the above level -107dBm
figures) 143dB
Note:- Integrated Units Have no Transmission Loss
Making the Link
Path loss

Path loss occurs due to:

• Distance
• Fading
• Obstacles
The longer the link, and/or bigger the obstacles, the higher the path loss will be and the greater will
be the effect of fading.

System Gain - Loss Example:
PMP Using Integrated Antennas, FCC 5.8GHz, 20MHz, 2x, 2miles 3.22km

(Gain) Transmissio
Transmission n
Line (Loss)
Radio Line (Loss) Radio
(Output (Threshold
Power) )
Tx Power 20dBm EIRP 36dBm Antenna Gain 9dBm
Minimum Receive
Antenna Gain + 17dBi level -93dBi Receive threshold -84dBi

Transmission Loss - 1dB System Gain Transmission Loss - 0dB

(Difference Minimum Receive
EIRP 36dBm between the above level -93dBm
figures) 129dB
Free Space Loss
(2miles, 3km) 117.87dB

Fade Margin 11.13

System Gain - Loss Example:
PMP Using Integrated Antennas, FCC 5.8GHz, 20MHz, 2x, 10m 16km

(Gain) Transmissio
Transmission n
Line (Loss)
Radio Line (Loss) Radio
(Output (Threshold
Power) )
Tx Power 20dBm EIRP 36dBm Antenna Gain 9dBm
Minimum Receive
Antenna Gain + 17dBi level -93dBi Receive threshold -84dBi

Transmission Loss - 1dB System Gain Transmission Loss - 0dB

(Difference Minimum Receive
EIRP 36dBm between the above level -93dBm
figures) 129dB
Free Space Loss
(10miles, 16km) 131.87dB

Fade Margin -2.87

Path Loss plus Availability
An equipment type can support a maximum range at a given availability for a given data

 Cannot quote a range without also quoting a data rate at a given availability.
 The range of a link has a direct impact on the amount of available fade margin
 The data rate affects the equipment sensitivity and hence the available fade margin.
 The sensitivity for a modulation mode is often different depending on whether used in fixed or
adaptive mode
 The amount of fade margin affects the availability

Parameters which affect Availability
In addition to Fade Margin the following factors affect availability:

• Geoclimatic Factor – Environment dependent

• Altitude of path above sea level
• Inclination of Path
• Path Length
• Frequency
• Latitude – how far away from equator path is
• Rain

Attenuation due to Atmospheric Gases
60 GHz
23 GHz Oxygen
Water peak
Plays in
this Area

RF Modulation Basics

Information Encoded as Bits
Bits are Binary Symbols

One symbol identifies a one and another

identifies a zero (for example):
1 0 0 1 0 1

Symbols are called pulses

Pulses are formed by combining frequencies

Simple Modulation Schemes
Change One Property of an AC signal:
Amplitude (i.e. signal strength levels)
Frequency (i.e. frequency levels)
Phase (i.e. phase positions)

Called shift key (2ASK, 2FSK, 2PSK)

These can be called symbols

0 1 0 1 0 1
Amplitude Shift Key Frequency Shift Key Phase Shift Key
Complex Modulation Schemes - OFDM
Orthogonal Frequency Division Multiplexing

Radio technology has a lot in common with

old twisted pair phone line that started out at
300 baud and then quickly increased.

In order to get faster data rates (throughput)

into the radio signal, complex modulation
schemes such as QPSK or 64 QAM are used.

OFDM splits the radio signal into Generally speaking, the faster the data rate
multiple smaller sub-signals that are the more powerful signal needs to be at the
transmitted simultaneously at different receiver to be decoded.
frequencies to the receiver.
OFDM is NOT specific to a frequency like 2.4
or 5 GHz. It can be used in any band.

Complex Modulation Schemes - OFDM
Orthogonal Frequency Division Multiplexing

Quadrature Amplitude Modulation

or QAM is one of the fastest types
actually sending two signals that are
out of phase with each other and then
somehow “putting the pieces back
together” for even faster throughput.

Complex Modulation Schemes - OFDM
Orthogonal Frequency Division Multiplexing

Generally speaking, the faster the data rate

the more powerful signal needs to be at the
receiver to be decoded.
PMP450 Modulation Chart, 5.8GHz, 2.5ms
More complex
5 MHz 10 MHz 20 MHz
modulation schemes MIMO Modulation
provide higher aggregate Type Type
throughput rates
1x MIMO A QPSK -90 2.2 Mbps -87 6.9 Mbps -84 16.2 Mbps

Cambium products will 2x MIMO-B QPSK -90 4.5 Mbps -87 13.9 Mbps -84 32.4 Mbps

automatically “step
2x MIMO-A 16-QAM -83 4.5 Mbps -80 13.9 Mbps -78 32.4 Mbps
down” to lower rates if
the RF environment 4x MIMO B 16-QAM -83 9 Mbps -80 27.9 Mbps -78 64.7 Mbps

deteriorates 3X MIMO-A 64-QAM -77 6.8 Mbps -74 20.9 Mbps -72 48.54 Mbps

*PMP450 13.2 added 6X MIMO-B 64-QAM -77 13.5 Mbps -74 41.8 Mbps -72 97.1Mbps

MIMO-A support. 4X MIMO-A 256-QAM -69 9 Mbps -64 27.9 Mbps -61 64.7 Mbps
MIMO-A sends the same
data on both poles for 8x MIMO-B 256-QAM -69 18.1 Mbps -64 55.7 Mbps -61 129.5Mbps

improved nLOS paths.

*PMP430 Interoperability supports 1x (QPSK SISO),
2x (16-QAM SISO), and 3x (64-QAM SISO)
Regulation of Radio Waves

• Band – Portion of Spectrum Allocated by Regulatory for a Specific Use

• Channel – Portion of Band designated to carry information
• Channel Bandwidth – Range of frequencies that carry information
• Carrier Frequency – Specific frequency used to define the channel

Broadband Wireless Bands
Subject to governmental changes
1 GHz 2 GHz 3 GHz 4 GHz 5 GHz 6 GHz

ISM (Industrial, Scientific and UNII (Unlicensed National

Medical). Unlicensed Information Infrastructure)
• 902-928 MHz • UNII-1: 5.150-5.250 GHz
(Indoor Only, 802.11a)
(“900”, cordless phones, SCADA)
• UNII-2: 5.250-5.350 GHz
• 2.400-2.4835 GHz (“5.2”, BWA, 802.11a)
(“2.4” cordless, 802.11b/g/n)
• UNII-3: 5.470-5.725 GHz
• 5.725-5.850 GHz (“5.4”)
(“5.8”, BWA) • UNII-4: 5.725-5.825 GHz
(“5.7”, BWA)

Examples of frequency bands

Band Range Total Unique Channels

Bandwidth Available

ISM 900 902 – 928 26 MHz Three 8-MHz channels

ISM 2.4 GHz 2.400 – 2.4835 83.5 MHz Four 20-MHz channels

UNII 5.2 GHz 5.250 – 5.350 100 MHz Five 20-MHz channels
UNII 5.4 GHz 5.470 – 5.725 255 MHz Thirteen 20-MHz
25 10-MHz channels
ISM 5.7 GHz 5.725 – 5.850 125 MHz Six 20-MHz channels
UNII 5.7 GHz 5.725 – 5.825
Broadband Wireless Bands
Subject to governmental changes

Current FCC Proposal for
adding 195Mhz to 5 GHz
Unlicensed Band
Carrier Frequency - Center Frequency of
• Channel center frequencies have half of their
bandwidth on either side. A 20 MHz channel is 10 MHz
below and 10 MHz above.
• Signal is electronically reduced at edges so that
adjacent channels do not interference with each other.
• Depending on the quality of this reduction, radios may
or may not require a guard band between channels.
Example, 20-MHz channel: Example, 20-MHz
No Guard Band channel: 5 MHz Guard
5.735 5.755 5.735 Band 5.760

5.725 5.745 5.765 5.725 5.745 5.750 5.770

Noise and Interference

The Impact of “Noise”
Analog Encoding Can’t Be “Perfect”

• While in transit the encoded signal is always further modulated

(i.e.: mixed with natural or man-made signals)

• Received signal is always “corrupted”

• The receiver must attempt to decode the signal correctly

• If it does so then digital information transported is “perfect”!

Types of Noise
• Interference
– Reflections of Signal Causing Multiple Paths at Receiver (Multipath)
– Signals from other sources in the same frequency band
– Weather
• Noise
– Lightning
– Electric Motors & Generators
– Vehicles

Multipath Effects of “Reflected” Signals

• The Line of Sight (LoS) path

• Some reflections reinforce
• Some reflections cancel-out

Other Sources

• Radio Systems
– Other Radio Systems
– 802.11 Wi-Fi
– Cordless Phones
• Weather
– Microwave Systems 6GHz and higher

Pulses Recovered
Received Symbols are Processed


Noisy Pulses Can

Still Work

Noisy Pulses
Might Not Work

Sensitivity for Digital Radio
Avoiding Errors

• In digital transmission decoding errors can be measured as a bit

error ratio (BER)
• Note that this is measured on the radio channel
• Other mechanisms can reduce the packet error rate to essentially
– Retransmission and Forward Error Correction for example

Digital Packet Transmission
RF Errors Don’t Affect the Data

• While the Digital has a particular BER performance,

it does not mean that Ethernet packets (“frames”)
are “errored”
• Through Forward Error correction and
retransmission and use of Ethernet Frame Check
Sequence, a digital system will:
– Never release an errored Ethernet packet
– Will discard a packet rather than release it towards its

Metal-to-Air Interface

• Purpose of an antenna is to transfer the signal from

electrical on wire to electromagnetic in “space” (or
• Antennas can direct the power in a specific direction

Types of Antennas

• Isotropic – Point (Omnidirectional sphere)

• Dipole (Omnidirectional doughnut)

• Yagi

• Parabolic dish

• Flat Panel

• Patch

How High the Gain?
Describing Signal Strength

• Any directional antenna provides a gain in signal

strength relative to a reference antenna
– Isotropic point source
– The amount of gain is given in dBi

• Effective Isotropic Radiated Power (EIRP) equals the

transmitter power plus the antenna gain.

Sample Radiation Pattern
Described in dBi
• 3dBi gain means that in the direction of interest the receiver will see twice the
power of an isotropic (radiating in all directions) antenna

Radiation Pattern Example

To Apply – Both ends -Must be on Same Horizontal Plane


Cambium Networks 137

Fresnel Zone Radio Wave Interaction

nel Z
A one

B+C=A+½ λ 138
Fresnel Zone Partially Blocked Path

• The antennas are at the focal points of an

ellipsoid – Football
• But the ellipsoid in practice is so elongated
that the antennas are often shown at the

Fresnel Zone Earth Curvature

• Antennas more than 10 Miles apart must

account for the curvature of the earth

Line of Sight

Fresnel Zone
Problem is the 1st Fresnel Zone

• Any reflections or deflections that alter the reinforcement of Zone

One, reduces the received signal.
• Rule of thumb states that at least 60% of the 1st Fresnel zone
should be clear of obstacles to have adequate signal for good
• Successive Fresnel Zones have less impact

RF Scheduler and
Synchronization Basics

Transmitting in Both Directions

• Frequency Division Duplex Base

• Time Division Duplex

• Downlink
• Uplink


Frequency Division Duplex
Uses Two Carrier Frequencies

Transmitter Medium Receiver

Receiver Medium Transmitter

• Forward/reverse or Downlink/Uplink
• Has “guard band” that separates the channels

Time Division Duplex
One Channel “Reverses” Many Times


Transmitter Medium Receiver


Receiver Medium Transmitter

• Typically “reverses” 200 times per second (5ms)

• The “guard time” separates the direction

Aggregate Throughput

•Example: 50 Mb/s Base

• Aggregate = Sum of both

• Symmetric Up and Down
• 25 Mb/s down, 25 Mb/s up

Aggregate Throughput

•Example: 50 Mb/s Base

• Aggregate = Sum of both

• Asymmetric Up and Down
• 37.5 Mb/s down, 12.5 Mb/s up

Architectural Overview
• If a subscriber needs high data rate between two specific locations,
– “Campus” environment, or
– Needs dedicated channel resource
• Can use a dedicated AP/SM or a pair of “Backhaul” modules
– Termed Point-to-Point operation
– May employ a “passive reflector” for longer range operation

Point to Point
Two Way Communication

•Backhaul Master Base

•Dedicated AP

•Backhaul Slave
•Dedicated SM

Architectural Overview
Point-to-Multipoint Example

3 AP Cluster

4 5

• Radio #2 is the intended recipient

• Radio #2 responds

Air Interface

Synchronization - Why Synchronize APs

• Cambium modules use TDD (Time Division Duplexing) to alternate transmissions

between uplink and downlink
• Cambium SMs use TDMA (Time Division Multiple Access) on the uplink frames to
resolve contention for accessing the AP
• If one AP were to transmit while another is receiving, the possibility for
interference or de-sensing exists.
• APs must be synchronized to prevent interference and de-sensing.

AP: Access Point 152

SM: Subscriber Module
Synchronization - Why
The Need for Synchronization:
Interference Due to non-Synchronization AP6 AP1

Each AP is
transmitting SM
at a different AP5 AP2








AP: Access Point 153

Synchronization - How
Synchronization: CMM/uGPS
Reduces System Interference AP6 AP1

Each AP is
transmitting SM
at the SAME AP5 AP2








AP: Access Point 154

Synchronization - Self Interference
One unsynchronized AP can cause self interference to all others.

Synchronization – Wide area
GPS Synchronization not
only synchronizes one
cluster but, all clusters in
the area.

Synchronization CMM3/CMM4/uGPS
• With synchronization, Cambium AP modules begin each transmit or receive cycle at the
same time.
1. For APs in a cluster, set Downlink Data Percent and Maximum Range the same for those APs.
2. Use a Cambium the following units to control synchronization of APs with GPS:
• uGPS
• CMM3
• CMM4
• Internal GPS

Using GPS for Synchronization

• The CMM3/4 and uGPS contains a GPS receiver that tracks eight or more satellites
and derives a precise clock that is used to synchronize Cambium APs.
• This clock is used to synchronize the transmit/receive cycles of every module in
your Cambium Wireless Broadband network.
• In addition to precise timing, the GPS receiver provides information on the latitude
and longitude of the CMM, number of satellites being tracked, number of available
satellites, and other information to aid in network diagnostics.

Air Interface Structure

Cambium’s PMP100/400/430/450 Wireless Broadband

PMP Communication is Divided Into Frames, Uplink And

Air Interface Structure - Basics

• The basic frame is 2.5ms or 5ms, divided into uplink and

• Access Point modules communicate with Subscriber
Modules using Point to Multipoint protocol.

Basic Frame: = Downlink

2.5ms or 5ms = Uplink

Air Interface Structure -
Default Downlink Percentage is 75%
• Point to Multipoint has one origination (the AP) and
potentially many endpoints (SMs).
• The AP schedules the sending and receiving of data.
• SMs must request bandwidth to send data to the AP on the
• The request / reservation process introduces delay into the
transmission cycles (latency).

Basic Frame: 75% Downlink

= Downlink

2.5ms or 5ms = Uplink

25% Uplink = Uplink

Multipoint Capacity

• Aggregate throughput counts transmission in both directions

(AP – SM & SM – AP)
• Throughput varies based on equipment selected and on
bandwidth allocation.
• Aggregate throughput varies based on RF environment,
equipment, settings such as the Uplink / Downlink ratio and
Max Range.

Air Frame Overview
Guard Time

UL 0–9 0–9 0 – 15
Beacon Data Data
Sched Ack Ack Cont.

AP Transmit (Downlink) AP Receive (Uplink)

• Downlink percentage is configurable at the AP.

• Other bandwidth settings can be set at the AP, at the SM, or
using management software

Air Frame Overview - Guard Time
Guard Time

UL 0–9 0–9 0 – 15
Beacon Data Data
Sched Ack Ack Cont.

AP Transmit (Downlink) AP Receive (Uplink)

• For each module (AP or SM), guard time exists

between the module’s transmit and receive.
• This guard time
– Allows devices to use the same radio channel
– Prevents uplink and downlink transmissions from
colliding/overlapping with each other.

Air Frame Overview - Downlink
Guard Time

UL 0–9 0–9 0 – 15
Beacon Data Data
Sched Ack Ack Cont.

AP Transmit (Downlink) AP Receive (Uplink)

• Beacon and Uplink Schedule slots are fixed, and are

always broadcast by the AP.
• No other fixed slot allocation; if no requests for
uplink, then ack slots are used for data.
• AP can transmit up to 9 acknowledgements; this is
variable, based on activity and demand.
• Downlink schedule is calculated but not broadcast.

Air Frame Overview - Data Slots
Guard Time

UL 0–9 0–9 0 – 15
Beacon Data Data
Sched Ack Ack Cont.

AP Transmit (Downlink) AP Receive (Uplink)

• Data slots contain fragmented user data

– Ethernet packets are broken into 64-byte
fragments to transmit over the wireless link.
– Bit errors have minimal effect.
– No Ethernet Maximum Transfer Unit effect.
• System designed for maximum efficiency
– AP can send to multiple SMs in one downlink
– Multiple SMs can send to the AP in one uplink
Air Frame Overview - Uplink
Guard Time

UL 0–9 0–9 0 – 15
Beacon Data Data
Sched Ack Ack Cont.

AP Transmit (Downlink) AP Receive (Uplink)

• All uplink traffic is scheduled by the AP, based on

incoming requests.
• *Contention slots are used for contention between
SMs requesting to send packets and during the
registration process if no empty uplink data slots are
• The minimum number of control slots to be reserved is
set by the operator. This is based on the number of
SM’s and/or the amount of real time Uplink traffic
*Earlier version of software used the term Control Slots
Air Frame Overview – Contention Slots
Guard Time

UL 0–9 0–9 0 – 15
Beacon Data Data
Sched Ack Ack Cont.

AP Transmit (Downlink) AP Receive (Uplink)

• Starting Point - Contention Slots for typical WISP deployment

1-10 SMs: 3 Contention Slots

11-50 SMs: 4 Contention Slots
51-150 SMs: 6 Contention Slots
>150 SMs: 8 Contention Slots

• If continuous uplink CONGESTION is present such as video surveillance,

addition contention slots may need to be added
• Insufficient contention slots can result in increased latency
Air Frame Overview
Example, 75% Downlink
Guard Time

UL 0–9 0–9 0 – 15
Beacon Data Data
Sched Ack Ack Cont..

AP Transmit (Downlink) AP Receive (Uplink)

• The Downlink/Uplink ratio is set on the AP

• The AP broadcasts to its SMs information on:
– The ratio of downlink to uplink transmission
– The amount of time the SM needs to wait before it
sends information back to the AP (Guard Time)
• The SM will adjust based on AP’s information
• Different applications might require different
ratios of Downlink and Uplink capacity
Frame Contents

• 1 Beacon slot
• 1 Uplink Schedule slot
• 0 – 9 Downlink acknowledgement slots (dynamically assigned)
• Downlink data slots (amount varies)
• Air delay (based on “max range” setting)
• 0 – 9 Uplink acknowledgement slots (dynamically assigned)
• Uplink data slots (amount varies)
• 0 – 15 Contention slots (Set by operator)

Multipoint Latency: AP to SM

AP Transmit
AP Receive
= Downlink
= Uplink

In every transmit frame, the In every receive frame, the AP

AP sends: receives:
• Schedule for next uplink • Up to 9 acknowledgements
frame from the SMs who are
receiving data packets
• Up to 9
acknowledgements of • Data packets from SMs
packets received in a
previous uplink frame • Requests from SMs to send
• Data packets down to
SMs 171
Handling High Priority Traffic
• For high priority traffic, the hardware scheduler dynamically sizes each SM’s high priority
channel to serve the high priority traffic ahead of low priority traffic.

PMP Airframe with High Priority Channel

• No change to the air frame structure

UL 0–9 0–9 0 – 15
Beacon Data Data
Sched Ack Ack Cont.

AP Transmit (Downlink) AP Receive (Uplink)

• The scheduling program looks at all the requests and sends high
priority traffic first, even to the exclusion of low priority traffic.

Note: Enabling the High Priority channel reduces the number of

channels available to the AP. With this feature enabled on all SMs, an
AP can support 119 SMs, instead of 238 SMs.
Setting High Priority Options
• The High priority option must be enabled on a per-SM basis.
– Use the SM Configuration > Quality of Service page to enable the high priority
channel. Set the Hi Priority Uplink and Downlink Committed Information Rates
• When using the high priority channel, each SM with High Priority is
counted as 2.
• This will effect the number of recommended contention slots set in the
AP. Configuration> Radio page.

PMP Training -
Network Build out and
Capacity Planning
The Initial PMP Planning Dilemma….

Common Customer question: “I have a desire to

deploy a PMP Wireless Access Network, but when it
comes to sizing and planning….Where do I start?”

Different Prevailing methods:

1. Identify some random high sites, then throw
something up on the tower and see what you get!
2. Find someone you can leverage who has years of
historical wireless experience and deep knowledge
of your deployment environment and have them
guesstimate your service areas and performance.
3. Model your planned deployments using guided
purpose-built planning tools
Solving the Initial Planning Dilemma….

Model your planned deployment using guided

purpose-built planning tools….

– What are these tools?

– What do they do for me?
– Where do I find them?
– How do I use them?
RF Planning - Tools

There is a wide and varying range of RF planning and coverage

tools available to you.

There are also a number of costs considerations when it comes to

RF network planning:
– Cost of the Tool
– Cost of the Mapping
– Cost of Planning
The Necessary Tools for the Job…
You need a vendor who can offer you a rich set of
planning tools that are specifically optimized to
model their products and keep them up to date.

PMP Capacity LINKPlanner

Atoll Templates
Guided by Guides - The Tools for the Job…
Solving the Initial Planning Dilemma….

Model your deployment using guided purpose-

built planning tools….

– What are these tools?

– What do they do for me?
– Where do I find them?
– How do I use them?
What do these tools do for me….?
PMP Capacity Planner • Excel-based Tool that provides a
• Provides Initial Capacity Estimations
on a Per Sector Basis details about the performance
• Basic Radio Inputs plus SLAs
you can expect from PMP
• Supports PMP 450 and ePMP • Estimate the throughput and
capacity that an Access Point can
provide based on:
– Distance of SMs from the AP
– Transmit power levels &
channel size
– Antenna gains
– Expected level of interference
in the environment.

Requires Microsoft Excel with Macro support enabled

What do these tools do for me….?
Use LINKPlanner to help predict where and
how equipment will work. It allows the
network planner to answer these questions:
• Will each link transmit data fast enough
for the user?
• Will each link be reliable enough for the
• Which Access Point will be best for a

• Individual SM Path Profiles

• Google Maps/Earth integration
• Add path obstructions and adjust
antenna heights
• Adjust AP’s and SM’s specifications
(antenna, reflectors etc)
• Automatically calculates expected RSSI
& Modulation Rate per SM
What do these tools do for me….?
Atoll provides a comprehensive and
integrated set of network tools and
features that allow you to create and
define your radio-planning project in a
single application.
• Coverage Modeling (Heat Maps)
• Frequency Planning
• Best Server Signal
• Clutter Classes & Interference Inputs
• Drive Test Optimization
• Traffic / Capacity Modeling
RF Planning - Tools
Cost of the tool
– RF planning and coverage tools range from free to thousands of $.
– Recommend initially using LINKPlanner and PMP Capacity Planner
– RF planning and coverage tools like Atoll are usually not simple. It
can take days or weeks to plan large networks or coverage area’s

Cost of the mapping data

– Some free terrain and clutter mapping is available and, depending on
the locations this has different granularity.
– Some deployments require more detailed planning for tenders etc.,
additional mapping may be required and is usually available but can
be costly.

Cambium Networks offers Professional Planning Services for

large deployments. A quotation can be obtained through
your Regional Sales Manager (RSM)
Solving the Initial Planning Dilemma….

Model your deployment using guided purpose-

built planning tools….

– What are these tools?

– What do they do for me?
– Where do I find them?
– How do I use them?
RF Planning - Tools


Solving the Initial Planning Dilemma….

Model your deployment using guided purpose-

built planning tools….

– What are these tools?

– What do they do for me?
– Where do I find them?
– How do I use them?
Solving the Initial Planning Dilemma….

What else is there to consider when initially

planning out my PMP Network….?

– Frequency & Channel Planning

– RF Spectrum Surveys
– Customer Densities (Overlaying Clusters?)
– Physical Site Surveys
RF Planning - Basic Channel Planning

Synchronization allows frequency re-use!

But how do you plan frequency re-use? C B

– 6 Sectors: select three non-overlapping A
frequencies for AP clusters

– 4 Sectors: select two non-overlapping B A
frequencies for AP clusters

So what about any Guard Band Requirements? C D

So what about SNR Requirements?
RF Planning – 4 Sectors - Multiple Towers


D C B A D C B A Symbol Frequency
A 5.740 GHz
B 5.760 GHz
B A D C B A D C C 5.780 GHz

C D C D D 5.800 GHz

D C B A D C B A Looks Good…
But Is this Optimal??

B A D C B A D C Let’s take a closer look!

RF Planning – 4 Sectors - Multiple Towers




C C Frequency

D D Symbol
A 5.740 GHz


B 5.760 GHz


C 5.780 GHz

C D A C D D 5.800 GHz


A simple 90 deg.


Rotation of certain


Neighboring Cells can
A A yield dramatic C/I


RF Planning – 6 Sectors - Multiple Towers

Symbol Frequency

A 5.740 GHz
B 5.760 GHz
C 5.780 GHz
RF Planning - Distance / Area

• To increase capacity/ density, AP

clusters may be located closer

• A second ring of AP’s can be

added to increase a tower
capacity to over 1Gbps
Spectrum Analysis

• Use a Spectrum Analyzer to sweep the proposed coverage area to

determine existing RF activity.
– Cambium Aps and SMs can be used as spectrum analyzers.
– Operators can perform a remote SM Spectrum analysis from the AP.
– Full spectrum scanning with zooming in/out to view power information on a
specific frequency
– Ver 12.3 allows Direct AP spectrum Analysis without SM mode
– Ver 13.3 allows sector spectrum Analysis
• Conduct spectrum analysis at several different times of day for a more
complete picture of the RF environment.
Spectrum Analyzer

Example of 10 second Timed Spectrum Analysis

Spectrum Analyzer

Zooming in scan with

Mouse-over Detail
Co-Location Tools

Excel Co-Location

Frame Calculator
RF Planning – Mismatched Settings

Frame Calculator:
Benefit, Now or Later?
• APs with slightly mismatched settings and low
levels of data traffic may see little effect on
• As the data traffic increases, the impact of
mismatched settings will increase
• This means that a system that was not tuned for
collocation may work fine at low traffic levels, but
have issues at higher traffic level
• Settings do not help if a synchronization device is
not used. ie CMM4
RF Planning - Collocation: 5.2 and 5.4 GHz

Care must be taken on frequency planning when

collocating 5.2 and 5.4 GHz AP modules.
– Frequencies of 5595 MHz and below can interfere with
closely collocated 5.2 GHz modules.
RF Planning – PMP450 Co-location and
Throughput Calculation Tool

• Download PMP450 Co-location Tool (excel spreadsheet) at:

• Enter parameters for both PMP450s that reflect your situation.
• Automatically calculates timing for both radios
• Adjust until both devices in Checks Box indicate “OK”
• Also used to calculate maximum possible throughput using various settings
RF Planning – PMP100 Co-location Tool

• Download PMP100 Co-location Tool (excel spreadsheet) at:

• Requires 2.5ms frame on PMP450
• Enter parameters for both the PMP450 and PMP100 that reflect your
• Automatically calculates timing for both radios
• Adjust until PMP450 and PMP100 indicate “OK” in the Checks Box
RF Planning - Collocation: FSK and OFDM

• Plan spacing between OFDM and FSK channels

– Plan 10 MHz guard band between FSK and OFDM eg. PMP130,
20MHz channel: 5800MHz
PMP450, 20MHz channel: 5770MHz
– OR –
– 3 ft (~1 m) vertical separation and 5 MHz guard band
• Applies for units on the same tower, but also in the same geographical
area (RF visible)
• PMP100/450 Calculator is REQUIRED for collocation.
RF Planning - Collocation: PMP450 & PMP320

• PMP320 utilizes a 5ms frame. PMP450 ver. 13.3 >= support

5ms frames.
5ms frame

2.5ms frame

• This resolves self-interference issues and allows co-location

and migration to the PMP450 platform.
• Although frames sizes are now the same, the frame structure
is different
• The PMP320 Co-Location Tool must be used to calculate
appropriate settings for both the PMP450 and PM320
• See PMP320 Migration white-paper for further details
RF Planning – PMP320 Co-location Tool

• Download PMP320 Co-location Tool (excel spreadsheet) at:

• Requires 5ms frame on PMP450
• Enter parameters for both the PMP450 and PMP320 that reflect your
• Automatically calculates timing for both radios
• Adjust until PMP450 and PMP320 indicate “OK” in the Checks Box
RF Planning – Frame Calculator

• Manual Frame tools are available on

all Cambium Radios
• PMP450 – OFDM, PMP 100 - FSK
• Frame Calculator details can be found
in the Product User Guide
• Frame Calculator does not use device
settings and does NOT change any
Frame Calculator – OFDM Entries

Calculator must be run

on each specific PMP

Enter parameters in the

Frame Calculator that
reflect your situation.

Key Fields:
• Platform Type
• Channel Bandwidth
• Frame Period
• Max Range
• Downlink %
• Contention Slots
Frame Calculator – FSK Entries

Enter parameters in the

Frame Calculator that
reflect your situation.

Key Fields:
• Max Range
• Frequency Band
• Downlink %
• Contention Slots
Frame Calculator – Calculate

Once entries are

complete, click
Calculate. Scroll down
to see results.

Note: <v13 had an

additional “Apply
Settings” button that
needed to be clicked
before Calculate.
This button did not
change any settings on
the device.
Frame Calculator – Results

1. Find value for “AP

Antenna Receive Start”
2. Repeat calculations for all
APs in the cluster with
different settings
3. Change “Downlink Data
%” or other settings
4. “AP Receive Start” value
for all APs in cluster must
be greater then all other
“AP Transmit End”
5. Implement new settings
from calculator to each
AP in the cluster
Site Survey - Identify General Requirements
Performance Considerations Step 1

• What is the geographic area to be covered?

• How many subscribers will be served?
• What is the terrain?
• What man-made and natural obstacles exist
(trees, buildings, bodies of water)?
• What other microwave radio services may
present a source of RF interference to your
proposed wireless network?
– Telco point-to-point relays
– Competitive wireless service providers
– Terrestrial Satellite Radio Repeater (2.4 GHz)
– Pager network modules (900 MHz)
Site Survey - Identify General Requirements
Physical Considerations Step 2

• What types of structures will

be required to provide wireless
network service to your
proposed customer base? All of these
• What are the power items must be
requirements for the proposed considered when
installation? designing a
wireless network
• What type of applications will
be required over the wireless
Site Survey - Conduct Potential Site Step 3

Assessments - Begin Identifying Locations

• Study local and topographical

• Drive the proposed coverage
• Take photographs
• Refer to Cambium equipment
specifications to plot the
range between modules
Site Survey Step 4

Identify Structures for Radio Placement

• Tall structures such as buildings, radio towers, water towers and hills or
mountain tops are ideal sites.
• The site must have some source of power: AC, DC, Solar, and
emergency backup power (UPS, generator, batteries).
• If the site is not being used as a repeater, some type of data source
must be available: Ethernet/fiber-optic cable, modem/ mux, telco line
or wireless backhaul.
Step 5
Verify Line of Sight Transmissions
• PMP 450 modules provide near-line-of-sight transmissions. Range and
throughput may be reduced. Links must be tested before installation.
• Use LINKPlanner to generate a Path Profile
• Physically observe the path (driving or flying)
• Measure height of suspect obstructions
• Use maps or software (terrain database, mapping or topographical)
• Aeronautical charts
• Electronic strobes, flashing mirrors or CDs
Step 5
Site Survey - Verify Line of Sight, cont’d
• Radio test
• Video camera on a boom
• Weather balloons (colored) or flares
• Never assume the intended path is clear of obstructions!
• See the Appendices for examples of the above-listed methods.
Step 6
Site Survey - Provide Physical Protection
• The site must have provisions for grounding and lightning protection.
(See Appendix.)
• If devices like hubs, switches or routers are used, element protection is
required (e.g.: weatherproof cabinet, radio room etc.).
• Follow local regulations regarding installation and operation of RF
• Site must be accessible for maintenance but secure from vandalism,
animals and the curious.
Step 6
Site Survey - Physical Protection, cont’d
• Mounting structures should be rigid and capable of supporting
modules, mounting hardware and the technician installing the
• Units with parabolic antennas or reflectors should be mounted on
structures designed to withstand, at minimum, the wind load rating of
the antenna.
Site Survey – Step 7

Assess Potential Sources of Interference

• Check for sources of potential interference. These could be other radios, or high
energy sources affecting the cables.
• If you suspect interference, sweep the area with a spectrum analyzer. Check
multiple times, at different times of the day.
• The actual performance and range of Cambium Fixed Wireless Broadband PMP
equipment can be affected by interference levels.
– In environments with heavy interference, reflectors or the CLIPs may be needed to obtain
optimum performance.
Step 8
Site Survey - Test Proposed Radio Links
• The only way to find out if the
radio path will work is to try
• It is not good business
practice to provide service
where the signal is reflected
off of objects or passes
through trees unless you have
control over new
construction, trees, repainting
of RF reflective surfaces, etc.
Regulatory Considerations
• Different countries have different regulations for different frequency bands.
• The difference regulations may limit radio transmission power, either Effective
Isotropic Radiated Power (EIRP) or Peak transmit power to the antenna.
• Dynamic Frequency Selection (DFS) may also be required.

Regulatory Considerations - DFS Setup
• A Region Code field must be entered for modules, whether or not DFS
is in use.
– RMs get Region Code information from their AP.
– Default Region Code is “None,” and the module will not transmit until the
code is changed to another value.
– Select the Region Code that indicates the country/region where the module is
– Select “Other” if no DFS requirement exists for that module, frequency, or
Regulatory Considerations- DFS History Log

• Modules running DFS have a Home> DFS Status page, which displays an event
history log.
RF Optimization - PMP Considerations

• In densely populated areas, consider breaking your system into multiple smaller
• If allowed and if needed, consider using a LENS or reflector for increased range /
throughput. Follow local regulations on power settings.
• For near or non line of sight:
– Use multiple clusters to achieve LOS
• Verify the band and frequency to be used will be free from interference from other
RF sources. (Interference can reduce range.)
RF Optimization - PMP450 Capacity

15 Mbps

• Download PMP450 Throughput Tool (excel spreadsheet) at:

• Enter parameters to see maximum capacity available.
RF Optimization - Sector Capacity PMP450
Using Integrated Patch Antenna on SM

Area Average of
30 Mbps
90 Mbps
60 Mbps
Across coverage area
Of ~4 miles
• Users are uniformly
15 Mbps
distributed across coverage area
• Data usage is equally distributed
across subscribers
• Sector edge is 6 miles
(not to scale)
RF Optimization - Sector Capacity PMP450
Using CLIP Antenna on SM

30 Mbps
Area Average of

90 Mbps 63Mbps
Across entire coverage area
60 Mbps
• Users are uniformly
distributed across coverage area
• Data usage is equally distributed
across subscribers
• Sector edge is 6 miles
(not to scale)
RF Optimization - Sector Capacity PMP450
Using Reflector Dish Antenna on SM 30 Mbps

Area Average of

90 Mbps 80 Mbps
Across entire coverage area

Assume: 60 Mbps
• Users are uniformly
distributed across coverage area
• Data usage is equally distributed
across subscribers
• Sector edge is 6 miles
(not to scale)
Performance Considerations
• Evaluate the throughput requirements for your network.
• Ensure there are no bottlenecks on the system.
• Determine the appropriate Uplink / Downlink ratio.
• Establish high priority settings if necessary.
• Verify line of sight.
• Verify current RF interference levels.
Capacity Planner Lab
Instructor Led
LinkPlanner Lab
Instructor Led
LinkPlanner Lab
PMP 450 Training

Prerequisites—Before you Begin

• Study and survey of area that is being covered

• Any calculations of Elevation angle for coverage and down tilt
• Survey of structures including power, existing lighting protection, fixings needed and cable

Lightening Protection

The need for power surge protection

• Structures, equipment and people must be protected against power surges (typically
caused by lightning) by conducting the surge current to ground via a separate preferential
solid path. The actual degree of protection required depends on local conditions and
applicable local regulations. Cambium recommends that PMP 450 installation is contracted
to a professional installer.
• Full details of lightning protection methods and requirements can be found in the
international standards IEC 61024-1 and IEC 61312-1, the U.S. National Electric Code
ANSI/NFPA No. 70-1984 or section 54 of the Canadian Electric Code.

Lightening Protection
The ‘rolling sphere method’ is used to determine where it is safe to mount
An imaginary sphere, typically 50 meters in radius, is rolled over the
structure. Where the sphere rests against the ground and a strike
termination device

Zone A: In this zone a direct

lightning strike is possible.
Equipment Do not mount equipment in
Zone B this zone.
Zone A
Zone A Zone B: In this zone, direct
EMD (lightning) effects are
50 m still possible, but mounting
in this zone significantly
reduces the possibility of a
Zone B direct strike. Mount
equipment in this zone
Lightening Protection - Basic requirements
• The AP must be grounded to the supporting structure.
• The equipment must be in ‘Zone B’
• A surge suppression unit (600SS) must be installed close to the SM.
• The distance between the SM and 600SS should be kept to a
• The drop cable length between the SM and 600SS must be less than
600 mm.
• An surge suppression unit (200SS) must be installed within 600 mm
(24 in) of the point at which the power cable enters the building or
equipment room.
• The drop cable must be grounded at the building entry point.
• The drop cable must not be laid alongside a lightning air terminal.
• All grounding cables must be a minimum size of 10 mm2 csa (8AWG),
preferably 16 mm2 csa (6AWG), or 25 mm2 csa (4AWG).
Lightening Protection – Tower Installation
• AP must be lower than the top
of the tower or its lightning air Outdoor CAT5e cable: shielded
with copper-plated steel
terminal. Cat5e cable

• Tower or mast must be Ground Cable

correctly grounded. Tower/building ground system

• A grounding kit must be

installed at the first point of AP
contact between the drop
cable and the tower, near the
Equipment building
• A grounding kit must be
installed at the bottom of the 600SS

tower, near the vertical to Network

horizontal transition point. This

External switch
ground bar

grounding kit must be bonded

to the tower or tower ground
bus bar (TGB), if installed.
Ground ring

Lightening Protection – Tower Installation

GigE Surge PMP 450 PS or CMM


Additional Surge
Suppressor may be
required at base of

*Do not use Cambium 600SSH (not rated for Gigabit)

Lightening Protection – Wall installation
Outdoor CAT5e cable: shielded

• The equipment with copper-plated steel

must be lower than Cat5e cable

the top of the Building ground system

building or its Ground cable

Equipment building

lightning air SM

• The building must
be correctly

ground bar

Ground ring

Lightening Protection – High Rise Building
• AP must be below the lightning CAT5e cable: outdoor, shielded

terminals and finials. Air terminal (finial) with copper-plated steel

Ground cable

• A grounding conductor must be AP

Building ground system

installed around the roof

perimeter, to form the main roof Tower grounding

perimeter lightning protection

ring. To equipment area

• Air terminals are typically installed

along the length of the main roof
perimeter lightning protection ring
typically every 6.1m (20ft).
• The main roof perimeter lightning
protection ring must contain at
least two down conductors
Building ground ring service

connected to the grounding

electrode system. The down
conductors should be physically
separated from one another, as far
as practical. 241
Lightening Protection – Inside high rise
CAT5e cable: outdoor shielded
• The drop cable with copper-plated steel

shield must be CAT5e cable

bonded to the AP Ground cable

building grounding Building ground system

system at the Surge


entry point to the

• The drop cable
shield must be Equipment area within a

bonded to the larger building

building grounding
Supply Network
system at the
entry point to the
equipment area.
To building ground ring

Site Grounding (Lightening, Power, Logic)

• Grounding conductors must be run as short, straight, and smoothly as

possible, with the fewest possible number of bends and curves.
• Grounding cables must not be installed with drip loops.
• All bends must have a minimum radius of 203 mm (8 in) and a
minimum angle of 90°. A diagonal run is preferable to a bend, even
though it does not follow the contour or run parallel to the supporting
• All bends, curves and connections must be routed towards the
grounding electrode system, ground rod, or ground bar.
• Grounding conductors must be securely fastened.
• Braided grounding conductors must not be used.
• Approved bonding techniques must be used for the connection of
dissimilar metals.

Cable Recommendation - Shielded CAT5!
To minimize the possibility of performance problems that may be
caused by external sources of interference, it is strongly recommended
that shielded CAT5 cable be used in all Cambium PMP installations.
 Poor quality, poorly constructed and chafed or nicked cables
can create intermittent module performance and/or network
 A large majority of technical support calls (35% or more) can
be attributed to improper cabling or the use of inferior quality
 Ethernet cables cannot exceed 100 meters (328 feet) in length.
 Improperly terminated Ethernet and Sync cables can result in
external signals being coupled into the cable resulting in
interference and erratic module performance.
 Use a drip loop to reduce the risk of water following a cable
into a module.

PMP 450 Cable Recommendation

Best-Tronics (www.best-tronics.com) provides bulk shielded and unshielded outdoor Cat5e

cable as well as premade custom length terminated cables
• BT-0781-XXX: Custom Length Unshielded
• BT-0781S-XXX: Custom Length Shielded
• CA-0367: 1000’ Bulk Unshielded
• CA-0367S: 1000’ Bulk Shielded

PMP 450 Cable Recommendation

Cambium PoE Cable Wiring Diagram

Power over Ethernet Cable for Cambium Wireless Broadband ePMP

• 30 VDC – Power on pins 7 &

8, return on pins 4 & 5

• IMPORTANT! Use care not

to wrongly use standard PoE
power sources, as the ePMP
power system uses different
pinouts as well as different
voltages. DAMAGE MAY

Extra Nuggets for Good Site Installations
Use dielectric grease (which is uniformly non-conducting) on all connections and in all
RJ-45 Ethernet connectors. The best practice is to use enough grease to fill the RJ-45
female connector, and then insert the RJ-45 male connector and push the grease
further into the ePMP Unit and around the RJ-45 connector. Excess grease can be
wiped over the connector area to provide some resistance to water ingress around the

Silicone Dielectric Compounds

GC Electronics - www.gcwaldom.com/catalog.html I.C.E - Industrial Communications

Silicone Compound Catalog number: www.iceradioproducts.com
10-8101-000 Silicone Compound, 1 fl. oz. tube Model: 615-2 Silicon filler grease. 1 oz. tub
10-8102-0000 Silicone Compound, 1 gal can Available in 2oz., 4oz., pint can,
quart can.

PMP 450i Series Installation
PMP 450i - Superior Essex BBDGE Cable
PMP 450i Cables, Connectors, and Grounding

• WB3176A 328 ft (100 m) Reel Outdoor Copper Clad CAT5E

• WB3177A Tyco/AMP, Mod Plug RJ45 Unscreened, 25 pack
• WB3211A Tyco/AMP Crimp Tool
• 01010419001 Coaxial Cable Grounding Kits for 1/4" and 3/8" cable
• C000065L007A LPU and Grounding Kit (1 kit per radio)
PMP 450i LPU (Lightning Protection Unit)
Antenna Alignment - AP Alignment

• Access Point alignment involves using a local or topographical map to

determine which direction one or more APs in a cluster will be aimed
to cover a specific sector in a community.
• Depending on the angle both Azimuth and Elevation should be
considered when choosing the correct antenna.
• Depending on the height of the AP cluster above the local terrain, it
may be required to calculate a degree of downtilt and Elevation.

AP Alignment

• A compass, GPS or similar device can be used to properly aim an

Access Point.

• Once the Access Point has been positioned, lock the module down.

• Remote Modules are then aligned to their respective AP.

SM Alignment

• Three methods can be used for aligning a Subscriber Module to an

Access Point:
– Alignment Tool on SM Tools page: Monitor the power level (dBm) values after
SM registers
– Alignment on SM Tools page – Used for longer distance links when SM has
not registered
– Positioning Tone feature. This requires a special cable and headphones, or
audio amplifier with speaker.
• Small Screen alignment tools for PDA or Mobile devices are available
using the PDA option.

SM Alignment

Method 1: Monitor Power Level and Jitter,

Alignment Tool Page
• Use the SM Alignment Tool page for near real-time graphical
display of power level, signal strength radio/Jitter
• From the Tools menu, select the Alignment Tool tab to access
the SM Alignment page
• Graphical, color-coded display presents clear information on
quality of jitter and power level

PDA: Personal Digital Assistant 255

SM Alignment Method 1: Example Screens

PMP 100 - FSK

SM Alignment Method 1: Steps

1. Point the SM in the direction of the AP.

a. PMP 430/450: beam width is 55 x 55 degrees
2. The SM cycles through a series of steps to register to
an AP: scanning, syncing, registering, and registered.
Power level and jitter will not report on the web page
until the unit is registered.
3. Use the SM’s Tool> Alignment Tool page to monitor
link quality, SNR and power level. Wait for a refresh
after moving the module.

NOTE: PMP 100 displays jitter, not SNR

SM Alignment Method 1: Steps cont’d

4. After the module has registered, slowly adjust the

positioning of the SM so that jitter is minimized and
power levels are at best settings possible. Lock
down the module when finished.
5. After alignment, perform a link test to check the
efficiency of the link.

NOTE: If using a PMP 100/430/450 Series SM with a Passive Reflector, the

radiated pattern will change to 6 x 6 degrees
If using a PMP 100/430/450 Series 5GHz SM with the LENS/CLIP, the
radiated pattern will change to 18 x 18 degrees.
SM Alignment Method 2

Method 2: Monitor Power Level

And AP Beacon Information
• Use the SM Alignment page for near real-time graphical
display of either AP Power level or AP Beacon and Power
level information
• From the Tools menu, select the Alignment tab to access the
SM Alignment page
• Click enable to place SM into Alignment mode
• Follow same alignment steps as method 1

PDA: Personal Digital Assistant 259

SM Alignment Method 2

SM Alignment Method 3: Positioning Tone

• Subscriber Modules incorporate an audible

positioning tone to help installers find the best
location for a module.
– The pitch changes to reflect the power level
– Volume level changes to reflect jitter – PMP100
• Move the module around until you achieve the
highest pitch and volume.
• Lock the unit down.

SM Alignment Method 3: Headset Requirements

• The positioning tone feature requires a cable adaptor

• The cable adaptor allows the 6 pin RJ-11 GPS cable to interface to a
headset or amplifier (adaptor doesn’t require active or passive devices)
• The tone output is available on pin 5 of the RJ-11 connector, with pin 6
being ground.
• The headset or amplifier load should be between pins 5 and 6.

Wiring Diagram, Alignment Tone Cable

1 1

2 2

3 3
4 4
5 5 Audio
6 6 Ground
7 7
8 8
Not used

PMP 450 Training

Basic Configuration for Quick Initial

Lab Configuration
60dB Attenuator
Direct to SM
Direct to SM

RF 2way Splitter

SM 1 SM 2

Power Supply Power Supply

Power Supply
Initial Configuration Overview

• Device Type – AP or SM
• Region
• RF Frequency
• Channel size
• Color code
• IP address settings

Administrative GUI

• Default Settings
– for all Canopy PMP units
– Usernames: root and admin
– Passwords: none
– AP transmitter is turned off
• The PC configuring a module must be on the same subnet.

Configuring The Management PC

Use this procedure to configure the local management PC to

communicate with the PMP module.

1. If your LAN setting are set for DHCP, connect

Ethernet cable to AP or SM and wait for DHCP
timeout. Your PC will autoset to 169.254.x.x

- OR -

1. Select Properties for the Ethernet port.

2. In Windows 7 this is found in Control Panel >

Network and Internet >
Network Connections >
Local Area Connection.

3. Select the Internet Protocol (TCP/IP) item:

Configuring The Management PC

Use this procedure to configure the local management PC to

communicate with the PMP module.

5. Enter an IP address that is valid for the network such as

6. Enter a subnet mask of

7. Leave the default gateway blank.

8. Click OK, then click Close

Configuration of Unit - Access Points

• Set the correct Region Code (DFS) and reboot the module.
• There are two options for completing Access Point configuration:
– The “Quick Start” menu allows you to configure the Access Point using a
minimum number of parameters.
– The “Configuration” menu pages contain all of the parameters required to
perform a complete setup of an Access Point.
• Following are sample screens from an AP module, with some fields highlighted.
For complete descriptions of all screens and fields, consult the user

AP Configuration > General (1)

AP Configuration > General (2)
1. Device Type: Can set the AP to operate as an SM.
• Required for spectrum analysis pre ver 13.0
• Reset P7 or P8 APs to SMs
2. Link Speeds: Set both sides of the link the same, otherwise the link may not
3. Sync Input: Source of timing pulse based on AP Type
 Standard AP will check Power Port, Timing Port, Internal GPS
 Remote AP will check Timing Port, Internal GPS
• AutoSync: AP will check GPS sources and select in the order above.
• AutoSync + Free Run: Autosync procedure however if sync is lost, AP
will revert to Generate Sync until pulse is re-established (Valid sync of
60 seconds must first be established)
• Generate Sync: Internal sync pulse; no other AP or BH in range
4. Regional Settings: Select the location where the module will be installed,
for DFS compliance. If the Country is not listed, select “Other Regulatory
/Other.” Save changes & reboot to “see” the other DFS fields that can be
configured for the module.
AutoSync Status
• On PMP 450, status of all the three sync sources is displayed along with
the selected sync source

AP Configuration > General (3)

8 274
AP Configuration > General (4)
5. Bridge Configuration
– Timeout: must be a longer period than the ARP cache timeout of the router
– SM Isolation Disabled: Allow SM-to-SM communication
– Block SM Packets from being forwarded. Blocks all SM-to-SM
– Block and Forward SM Packets to Backbone. Sends all SM-to-SM through
the Ethernet port of the AP.
– Packet Flooding: When enabled, all unknown unicast packets arriving at AP
are forwarded to SMs.
6. Prioritize TCP Ack: For primarily video surveillance, disable setting
7. DHCP Relay Agent: When enabled, AP acts as a DHCP relay for SMs and CPEs
underneath it. Use when DHCP server is not on local subnet.
8. Coordinates: Operators can enter GPS coordinates, if desired.
AP Configuration > IP Page (1)

AP Configuration > IP Page (2)

1. LAN 1 Configuration: IP address for the AP, the appropriate

subnet mask and Gateway IP address.
• Units should never have public IP addresses. (Do not
use the default 169.254.x.x)
• Maintain records of all IP addresses set.
• DHCP State: use a DHCP server to assign the IP
address for the AP.
2. Advanced LAN 1: Allows alternative IP instead of native
3. LAN 2 Configuration: RF Private Interface used for AP to SM
• Usually not changed unless LAN 1 and LAN 2 are in the
same subnet.
AP Configuration > Custom Frequencies

3.5GHz and 3.65GHz ONLY

1. Custom frequencies with a channel raster of 50 KHz can be added from the
available range by clicking on the ‘Add Frequency’ button.

2. 3.65GHz APs have a Default Frequencies button to auto-load common


3. Displays the complete list of user configured custom frequencies.

AP Configuration > Radio Page (1)


AP Configuration > Radio Page (2)
1. Frequency Band: In 5GHz, select 5.4 or 5.8GHz
2. Frequency Carrier: Specify the primary and up to two alternate transmit
frequencies (for use with DFS)
3. Channel Bandwidth: Select 5, 10 or 20MHz channel size
4. Frame Period: 2.5ms frame or 5ms frame
5. Color Code: Variable to help ensure SMs register to the intended AP. Color
codes must match for SMs to register. (SMs can have up to 10 color codes
specified, for registration to alternate APs.)
• Color Code Rescan: Initiate SM rescans in order to register to an AP
configured with the SM‘s primary color code.
• Wait Period for Idle: Time in minutes SM is idle before a rescan is
6. Installation Color Code:
• Operators can install and remotely configure SMs without having to
configure matching color codes between the modules.
• SM will register to AP but no user data will pass over the link.
• Will not work if Color code is 0
AP Configuration > Radio Page (3)

AP Configuration > Radio Page (4)
6. Frame Configuration
• Max Range: Distance of furthest SM. Greater range will reduce overall AP throughput.
• Downlink Data: Percent of aggregate throughput used for downlink transmissions (15% - 85% in 1%
• Control Slots: Number of (reserved) control slots that SM can use. Reserved control slots and unused
data slots are used for registration and bandwidth requests.

Number of Suggested Control

Registered SMs Slots, PMP 450
1 to 10 3
11 to 50 4
51 to 150 6
151 and above 8

IMPORTANT: All APs in a cluster and/or APs that are RF visible, must have
all Frame Configuration settings the same.
AP Configuration > Radio Page (5)
7. Power Control
1. Transmitter Output Power: Transmit output power of AP. Maximum set by region and country.
2. External Gain: When using an external antenna, enter the published gain of the antenna used to
ensure the radio will meet regulatory requirements.
3. SM Receive Target Level: Each SM’s Transmitter Output Power is automatically set by the AP. The AP
monitors the received power from each SM, and adjusts each SM’s Transmitter Output Power so that
the received power at the AP from that SM is not greater what is set in this field.

IMPORTANT: All APs in a cluster and/or APs that are RF visible, must have
all Power Control settings the same.

AP Configuration > Radio Page (6)
8. Multicast Data Control*
1. Version <= 12.2 multicast packets were transmitted as part of the
Broadcast VC (1X)
2. Can be used for IPTV applications
3. VC Data Rate: The rate at which multicast traffic is sent at, on the DL. It
can be configured as 1x, 2x, 4x or 6x.
4. Repeat Count: number of times the multicast traffic is repeated. Used
to ensure packets are received by a SM. Will reduce bandwidth of the
multicast VC. Independent of the Broadcast Repeat Count

Packet AP Packet SM Default 0
Repeat Count = 2
1. CIR: Committed Information rate of Multicast Data - Guaranteed
multicast VC bandwidth, this includes the repeat count as part of the
multicast bandwidth. Independent of the Broadcast CIR.

*Not backward compatible with PMP430 SMs 284

AP Configuration > Radio Page (6)
Statistics are available under Statistics  Data VC for both the AP and
the SM.

AP Configuration > Radio Page (7)
9. Advanced
1. Control Messages: SISO or MIMO-A
MIMO-A (Default): AP control messages are transmitted on both
channels. If APs cables are swapped, setting "MIMO-A” fixes this issue
SISO: Control messages are only sent on Channel A
2. PMP 430 Interop Mode: SISO or MIMO-A.
MIMO-A (Default): Downlink data for PMP430 SMs are transmitted on
both channels
SISO: Forces single channel operation for PMP430 devices operating in
QPSK and 16QAM, providing a 3dB boast in sensitivity. Used in rare
cases where there are PMP430 at the edge of your network. Helps
PMP430 devices register and operate at the lowest modulations when
not possible in MIMO-A.
3. Receive Quality Debug: AP will report the number of fragments
received per modulation and per channel. Note: Will slightly degrade
packet per second processing when enabled.

SM Configuration > General

Ethernet Link: enable or

disable Ethernet/802.3
connectivity on the wired
port of the SM. 2
Region / Country: Currently
inherits setting from AP,
however best practice to set
it appropriately.

IP Address Handling
SMs have 2 (Bridge) or 3/4 (NAT) IP addresses
• Bridge Mode
• LAN 1 – Management IP (Local or Public)
• LAN 2 – Hidden AP-to-SM IP Address
• NAT Mode
• LAN 1 – Customer Side LAN IP
Data • LAN 2 – Hidden AP-to-SM IP Address
• WAN (NAT Public) – Customer Public IP
• Remote Management (optional)

APs have 2 IP addresses
• LAN 1 – Management IP
• LAN 2 – Private AP-to-SM IP subnet `
SM Configuration > IP

IP Address of SM

Network 1
Accessibility Local:
IP address visible 2
only on Ethernet
Public: Visible locally 3
and over wireless

DHCP: Obtain IP
address from DHCP
only if Network
Accessibility is Public

SM IP Address Handling - Bridge Mode
Management IP
(AP LAN1) SMs Bridge Mode
• LAN 1 – Management IP
• Local – Only accessible on LAN port
• Public – Accessible on LAN port and
Wireless interface
Data • LAN 2 – Hidden AP-to-SM IP Address

AP Management IP

192.168.101.x `

SM Configuration > Custom Frequencies

3.5GHz and 3.65GHz ONLY

1. Custom frequencies with a channel raster of 50 KHz can be added from the
available range by clicking on the ‘Add Frequency’ button.

2. 3.65GHz APs have a Default Frequencies button to auto-load common

frequencies 291

3. Displays the complete list of user configured custom frequencies.

SM Configuration > Radio (1)

Frequencies will vary based

on Radio Band, Region, and
Country selected, and
custom frequencies

Removing unused
frequencies will decrease
SM boot time, however,
caution must be taken
when changing AP
frequency as SMs can be

SM Configuration > Radio (2)
Scan Procedure:
1. SM will scan all frequencies
in each of the channel sizes
selected, one at a time,
starting at the smallest.
2. Once the entire scan is
complete, the SM will select
the best AP from the
scanned list.
Best practice: remove channel
sizes not used on APs. Complete
scan in 5GHz takes 2 minutes

AP Selection: Based solely on

Power Level or Throughput
(Power Level, channel size, &
number of users)
SM Configuration > Radio (3)
Color Code 1: The primary
color code used by the SM for
AP selection.

Installation Color Code: If

enabled, Color Code 1 must be
0 and Color code 2-10 must be

Large VC Data Q: Enable for

primarily UL video surveillance

SM Configuration > Radio (3)

Additional Color Code: Add up

to 19 color codes as Primary,
Secondary, or Tertiary

External Gain: Set the gain of

any external antenna or
reflector. Do NOT include the
gain of the internal antenna
when using integrated radios

Receive Quality Debug: SM will

report the number of fragments
received per modulation and
per channel. Note: Will slightly
degrade packet per second
processing when enabled.

AP Session Status

AP Session Status

Hyperlink to SM using
AP LAN2 address
AP Session Status
Device Tab Click to Download
Sessions Report
Click Title to sort in Ascending
or Descending order

Sessions Tab

AP Session Status
Power Tab

Configuration Tab

AP Remote Subscribers

Hyperlink to SM using
AP LAN2 address


Configure AP as follows (all other settings as default)

• Region & Country: Current Location
• Static IP:
• Subnet Mask:
• Frequency Band: 5.8GHz
• Frequency Carrier: 5800GHz
• Frame Period: 2.5ms
• Channel Size: 20MHz
• Transmit Power: 4 dBm
Save settings, reboot AP

Configure SMs as follows (all other settings as default)

• Region & Country: Current Location
• Static IP: SM1:, SM2:
• Network Accessibility: Public
• Subnet Mask:
• Enable only 20MHz Channel
• Enable only 5.8GHz Frequency Scan List
Save settings, reboot SMs
Log into AP and/or SMs and ensure SMs are registered.

PMP 450 Training

In-Depth Features and

Configuration Topics

•Networking (IP, VLAN,NAT)

•Management (SNMP, PPPoE)

•QoS (DiffServ, SLA)

•Security (RADIUS, etc)


NAT (Network Address Translation)

• NAT provides a means for using private (non-routable over the internet) IP
addresses behind a router, switch or firewall and translating any of these addresses
wishing to access the public network to one routable (public) IP address.
• NAT isolates (to a degree) a private network from the public network.
• Usually the NAT device performs port translation and “stateful” inspection of
incoming packets to confirm they are a response to packets that were generated
from the private network.

SM IP Address Handling - NAT Mode
Management IP
(AP LAN1) SMs NAT Mode
• WAN (NAT Public) – Customer Public IP
• LAN 1 – Customer Side LAN IP
• LAN 2 – Hidden AP-to-SM IP Address
• Remote Management (optional)

Remote Management IP

192.168.101.x ` B.B.B.11

` B.B.B.10

SM Configuration> NAT Page (1)

• WAN Interface: RF access

• Connection Type: can
be Static IP, DHCP or
• Reply to ping on WAN
interface: default value
is Disabled.
• LAN Interface: Ethernet
access – Overrides
Config/IP settings
• DMZ Support

SM Configuration> NAT Page (2)
• LAN DHCP Server: serves
IP addresses to devices
connecting to the Ethernet
port of the SM. If enabled,
set the LAN-side DHCP
Remote Configuration
• Enable: provide an IP
address for WAN-side
management access.
• Disable: No access to SM’s
WAN side via IP address;
use the AP’s Session Status
or Remote Subscribers
pages, or access via the
LAN (Ethernet) side.
SM Configuration> NAT Page (3)

• Garbage Timeout: When a large

number of devices (or NAT sessions)
are below SM, set values lower to
flush unused NAT sessions faster.
• Translation Table Size: The number of
NAT sessions available for clients. If
the table is filled, no additional
sessions will connect until sessions
timeout. A single computer can
generate multiple session requests.

Example 1: IP Addressing, No NAT

• Computers connected to the SM are

accessed directly by their IP addresses,
which might have been assigned by a
DHCP server on the network.


` A.A.A.22

DHCP Server
` A.A.A.23

Switch 311
Example 2: IP Addressing, with NAT (1 of 2)

• Computer connected to the SM starts

a connection using its non-Internet-
routable IP address
• This non-routable IP address is
translated by the SM into an Internet-
routable IP address (NAT)
LAN 1: B.B.B.1 CPE

WAN Interface CPE

` B.B.B.11

DHCP Server
` B.B.B.12

Switch 312
Example 2: IP Addressing, with NAT (2 of 2)
• A remote host can communicate back
with the computer via the Internet-
routable IP address, which is
translated back to the original non-
routable IP address by the SM (NAT)
• This connection must have been
originated by the computer connected
to the SM LAN 1: B.B.B.1 CPE

WAN Interface CPE

` B.B.B.11

DHCP Server
` B.B.B.12

Switch 313
Example 3: IP Addressing, with NAT, DMZ

• A remote host can communicate

directly with a device connected to an
SM configured with a DMZ address.
• In this case, the connection can be
originated by the remote host.

LAN 1: B.B.B.1

WAN Interface CPE

` B.B.B.11

DHCP Server
Switch 314
Protocols Supported with NAT

• Basic NAT supports non-embedded protocols (such as HTTP) and

requires Application Layer Gateways (ALGs) written to support
embedded protocols like ICMP (Internet Control Message Protocols),
Ping and FTP (File Transfer Protocol).

• Cambium PMP system’s NAT includes ALG’s for ICMP, FTP, L2TP over
IPSec and PPTP for VPNs.

NAT Port Mapping

• With NAT enabled, operators can map up to 10 ports to a specific IP

address, for all protocols, TCP or UDP.

Protocol & Port Filtering

Protocol & Port Filtering

• Operators can filter (block) specific protocols and ports

for upstream or downstream RF Interface for both IPv4
and IPv6.
– Protects the network from packet loading or probing
by network users.
– Provides a level of protection to users from each
• Protocol and port filtering can be set on AP or SMs.
– Filtering takes place as packets arrive or leave the
AP/SM headed to the air interface, except SNMP.
– If SNMP is configured, then SNMP packets are
blocked from entering the AP/SM.

SM: Subscriber Module 318

SNMP: Simple Network Management Protocol
Protocol & Port Filtering

• On an AP or SM With NAT disabled, operators can:

– Filter specific packet types and/or three user-specified ports
– Allow all protocols except those specified
– Block all protocols except those specified
• On SM with NAT enabled, the operator can filter three user-specified

Protocol & Port Filtering (1)
• With NAT disabled, operators can block PPPoE, any
combination of the IPv4 protocols listed, or ARP.
• Tool tip pop-ups provide guidance on screen as to the
effects of making these selections.
• Filters can be assigned to Upstream or Downsteam data
Pop-Up Tips
PPPoE: Blocks Ethernet
Types 8863 and 8864.

IPv4 Filtering

IPv6 Filtering

Filtering Direction:
Entering or leaving RF
port 320
Protocol & Port Filtering (2)

Operators can specify

up to three ports to
be blocked.
For example,
specifying ports 20
and 21 for TCP and
UDP will stop users
from using FTP.
Specifying ports 161
and 162 for TCP and
UDP will block a
subscriber’s access
to SNMP.

AP Specialty Filters

Security Enhancements

• RF Telnet Access: restricts telnet access from device located below

• PPPoE PADI (Active Discovery Initialization): Prevents PPPoE client
PADI packets to be sent to PPPoE Servers below SMs.
• Default: Not restricted


PPPoE Configuration (SM) (1 of 3)

• NAT must be enabled on the SM, and Translation Bridging must be

disabled on the AP.
• When PPPoe is enabled, the SM will register to the AP then
immediately attempt to connect to the PPPoE server.
• Operators must plan for the PPPoE server, set up operations to support
and take advantage of PPPoE, then configure the SM to be consistent
with their PPPoE implementation.

PPPoE Configuration (SM) (2 of 3)

On the SM’s
Configuration>NAT page:
• Enable NAT
• For WAN Interface
Connection Type,
select PPPoE from the
drop-down list.

Now go to the SM’s

page to enter the PPPoE
server information.

PPPoE Configuration (SM) (3 of 3)

VLAN & Q-in-Q

VLAN and QinQ

• Operates at Layer 2 of the IP model

• Establishes a logical group within the network.
• Regardless of initial or eventual physical
location, each computer in the VLAN can
access the same data
• Provides flexibility in network segmentation,
simpler management, and enhanced security.

VLAN - PMP 450 Features

• VLAN Transparent (disabled) and VLAN enabled modes

• Layer 2 (Switch) VLAN specifications:
– IEEE 802.1-Standards based
– 802.1q: “unique identifier” each for VLAN
– 802.1p: “priority levels” within each VLAN

• 802.1ad (Provider Bridge) aka “QinQ”:

– Allows 802.1q VLANs inside of a 802.1ad VLAN.
– 802.1ad standard replaces 802.1QinQ protocol

• VLAN VID and Priority Mapping based on MAC Address

• VLAN VID and Priority Remarking

VLAN Tagging

6 bytes 62bytes
bytes 2 bytes Variable

Destination Source
TPID TCI Payload

Priority CFI VID

3 bits 1 bit 12 bits

TPID - Tag Protocol Identifier Priority – 802.1p
Ethertype 0x8100 CFI - Canonical Format Indicator
TCI - Tag Control Information VID – VLAN Identifier

VLAN QinQ Tagging

6 bytes
6 bytesQ Outer Tag Q Tag
Q Inner Tag 2 bytes Variable
DestinationTPID TCI
Source TPID TCI Payload
4 bytes 4 bytes

Outer Tag (Service Tag) Inner Tag (Customer Tag)

TPID - Tag Protocol Identifier TPID - Tag Protocol Identifier
EtherType 0x88a8 (Provider Bridging) EtherType 0x8100
or 0x8100,0x9100,0x9200,0x9300 (QinQ) TCI - Tag Control Information
TCI - Tag Control Information

Transparent Mode
• Factory Default is transparent mode.
• AP is configured to have “VLAN Disabled”
• The SM configuration doesn’t matter
AP page

SM Page

Transparent Mode Traffic Behavior

untagged untagged

tagged tagged

AP SM Management traffic
is untagged

untagged untagged

tagged tagged

QinQ QinQ

VLAN Enabled Mode - AP


VLAN Enabled Mode - AP
1. Enable / Disable VLAN functions for AP sector
2. Ver <13.1.1 required APs to be set as an SM for spectrum analysis.
Enable to retain local VLAN settings when rebooted as an SM.
3. Allow Frame Types Filter:
• All Frames
• Tagged Frames Only
• Untagged Frames Only
4. Dynamic Learning: AP will (Enable) or will not (Disable) add VLAN VIDs
of upstream frames to the VID table.
5. Management VID: VID used to communicate with the module manager.
6. QinQ EtherType
– 0x88a8 for 802.1ad
– 0x8100, 0x9100, 0x9200, 0x9300 for 802.1QinQ (pre 802.1ad)
7. Active Configuration: Settings and Current VID Member Set

VLAN Enabled Mode - AP

VLAN Enabled Mode - AP
8. VLAN Membership Table
If Dynamic Learning is disabled, manual VLAN VIDs need to be entered into the
Membership Table. Any packets arriving that are not in the table are dropped.
9. VLAN 802.1p Remarking
Tagged packets arriving at the AP’s Ethernet Port, can have their priority
remarked based on the existing VID. Packets exiting the Ethernet port are not

VLAN Enabled Mode - SM


VLAN Enabled Mode - SM
1. VLAN Port Type
– Q: Tags untagged packets as 802.1q
– QinQ: Tags untagged packets as 802.1q plus 802.1ad
or tags 802.1q packets with 802.1ad
2. Accept QinQ: Enabled filters QinQ packet on Ethernet Port
3. SM Management VID Pass-through: When disabled, all data with the
Management VID will be blocked at the Ethernet Port. (default Enabled)
4. Default Port VID: 802.1q Tag ID or Inner Tag ID for QinQ
5. Port VID and Priority MAC Address Mapping: Checks inbound MAC
address of packet and overrides Default Port VID and Priority
– First 3 fields of MAC address are the Ethernet devices Manufacturer
ie Intel, ATI
– Wildcards can be used in last 3 fields of MAC address using ff ff ff
6. Provider VID: 802.1ad Outer Tag ID. Only used if VLAN Port type is QinQ

VLAN Enabled Mode - SM

VLAN Enabled Mode - SM

7. VLAN VID Remarking

Tagged packets arriving at the SP’s Ethernet Port, can have their VID remarked based on the existing VID.
Packets exiting the Ethernet port are not remarked
8. VLAN 802.1p Remarking
Tagged packets arriving at the SP’s Ethernet Port, can have their priority remarked based on the existing VID.
Packets exiting the Ethernet port are not remarked

VLAN Enabled Example Mode Behavior

Tagged with VID defined in the configuration Untagged

Tagged/Unaltered Tagged

QinQ QinQ


Dropped or
Untagged treated as
Tagged Tagged/Unaltered

QinQ Dropped

Tagged Untagged
(VID matched with Default Port VID
or MAC/VID mapping)

Management traffic is tagged, If want to manage the SM from LAN port,

traffic need to be tagged with the same VID as the Management VLAN of the SM
Note that when the SM is not connected with the AP, it will however only allow untagged management

• Default(transparent, SM VLAN port type “Q”, AP VLAN disabled ) mode allows
passing Q-in-Q back-and-forth
• You can also configure the SM to put a S-Tag to the traffic
• Important!!! Don’t configure the SM to tag S-VID with “1”, it will NOT do

QinQ tagging Mode Example Behavior
Provider-VID (S-VID) = X, !=1 !!!!
Default VID = Y !=1
QinQ (ctag contains Default vid) Untagged

QinQ, unaltered QinQ

QinQ, adding S-Tag VLAN Tagged

QinQ (S-VID = X, C-VID != Y) VLAN Tagged (S-Tag removed)

C-tag remains, even VID=0
QinQ (S-VID = X, C-VID = Y)

QinQ (S-VID != X, C-VID != Y) QinQ, unaltered

VLAN Tagged (VID !=X & VID !=Y)


VLAN Tagged (VID ==X || VID == Y) Untagged

Untagged Dropped!

SM cannot be locally managed if connected to AP. SM can be managed from AP,

But can be locally managed without VLAN tagging when disconnected With VLAN ID set to that configured at the AP
from AP (connect a PC directly to the SM)
Step 1
• AP – Enable VLAN
• SMs – Set Default Port VID to 100
• Save and reboot
Step 2 (On computers connected to SMs)
• Set static IP addresses
– Computer 1:
– Computer 2:
• Try to access SMs and AP
• Try to ping each local computers (may not work if firewall enabled)
Step 3 (From computer connected to AP)
• Try accessing SMs from AP and from AP computer

PMP 450 – Canopy Traffic Delivery Background
One of Cambium Network’s unique differentiators within our Canopy PMP
product family is the ability to offer several settable stages of service delivery
prioritization, allowing Service Providers to offer differentiated and assured
tiers of service to their customers.

This technical presentation attempts to

provide an initial overview of the
concepts and parameters governing
PMP 450’s ability to deliver:
1) Quality of Experience (QoE)
2) Service Level Agreement (SLA)
3) Quality of Service (QoS)

PMP450 – Canopy Traffic Delivery Background
Before getting into the deeper concepts and parameters governing how
Quality of Experience (QoE), Service Level Agreement (SLA), and Quality of
Service (QoS) attributes are implemented and managed on PMP450, one
needs to first understand some foundational information defining what
different traffic delivery channels exist between a Canopy AP and SM.

Service 1
QoE Customer 1 Service 2
Service 3
Service 1
Policy Customer 2 Service 2
Canopy Service 3
Scheduler Service 1
QoE Customer 3 Service 2
Service 3
Service 1
Policy Customer 4 Service 2
Service 3

PMP 450 – Canopy Traffic Delivery Background
Virtual Circuit Quantities
Every SM is automatically assigned a Dedicated VC for Best Effort traffic delivery.
High Priority VCs are optionally configured as needed. If all SMs connected to an
AP have both VCs assigned, then 119 SMs can be supported by the AP.

Dedicated VC #1
Virtual Circuts (VC) High Priority VC
Data transmitted Dedicated VC #2 VCs can have High or
between the AP and High Priority VC #2 SM2 Best Effort Priority.
each SM is carried over
Virtual Circuits (VCs). AP High Priority VCs are
scheduled* before Best
There are 238 Effort, therefore time
bidirectional VCs sensitive data (VoIP)
available for data Dedicated VC #237 SM237 should be directed to
transmission. High Priority VCs.

So why is this
last VC #237,
and not #238? * The AP performs scheduling of ALL
Data Transmissions

PMP 450 – Canopy Traffic Delivery Background
Special Purpose VCs
There are also a few additional VCs which are reserved for Special Purpose
traffic delivery such as Downlink Broadcast and Downlink Multicast traffic.

DL Broadcast VC
All Broadcast traffic
from an AP is sent over
a common VC which all SM2 UL Broad / Multicast
DL Broadcast Each SM’s Dedicated
SMs listen to. AP DL Multicast
VC’s are used for all
Broadcast and
DL Multicast VC Common VCs Multicast UL traffic to
All Multicast traffic from the AP.
an AP is sent over a
common VC (separate SM237
from Broadcast VC)
which all SMs listen to.

* The AP performs scheduling of ALL

Data Transmissions

PMP450 – Canopy QoE / SLA / QoS Policies
So looking at the “Data VC” Tab available as part of Canopy’s
SM Statistics, you can see this SM below has FOUR total VC
entries. What are they…??

PMP450 – Canopy QoE / SLA / QoS Policies
Now that we know what different traffic delivery VCs exist
between a PMP450 AP and SM, we’re now ready to discuss
how QoE/SLA/QoS Policies can be mapped to these VC flows.

Dedicated VC SM1
Service 1
QoE Customer 1 Service 2
Service 3
Dedicated VC QoS
High Priority VC SM2 Policy
Service 1
Customer 2 Service 2
Canopy Service 3
Scheduler Service 1
QoE Customer 3 Service 2
Common VCs Service 3
Service 1
Policy Customer 4 Service 2
Dedicated VC SM237 Service 3

PMP 450 – Canopy QoE / SLA / QoS Policies
AP Defines SM Defines
Sector Wide Individual Policy SM Service Policy
Policy Parameters Parameters Parameters
AP Service Policy
Rate Shaping (QoE)
Parameters UL Sustained Data Rate
DL Sustained Data Rate
Dedicated VC Policy SM1
DL Broadcast Data Rate UL Burst Data Rate – (EIR)
DL Multicast Data Rate DL Burst Data Rate – (EIR)
Dedicated VC Policy UL/DL Burst Token Allocation
High Priority VC Policy SM2
MAC/Frame Definition UL Broadcast/Multicast Rate
DL Data % - (TDD Duty Cycle) AP
Control Slots – (SM Scaling) CIR (SLA)
Common VC UL Data Rate – High Priority
DL Multicast Modulation Rate Policy DL Data Rate – High Priority
DL Multicast Repeat Count UL Data Rate – Best Effort
Dedicated VC Policy SM237 DL Data Rate – Best Effort
DL Broadcast Repeat Count

SM Isolation – (Option 1 & 2) Traffic Prioritizing (QoS)

1. Honoring Packet Markings
CIR - Committed Information Rate 2. AP RF Scheduler Prioritization
EIR - Excess Information Rate

PMP450 – Canopy QoE / SLA / QoS Policies
AP Defines
AP Policy Sector Wide
Parameters Policy Parameters
CIR (SLA) Sector Wide committed Data Rate allocations for the AP’s
DL Broadcast Data Rate Broadcast VC and Multicast VC Traffic
DL Multicast Data Rate

MAC/Frame Definition The AP’s DL Data % definition dictates how much of the total AP
DL Data % - (TDD Duty Cycle) capacity is allocated to DL, with remainder allocated to UL
Control Slots – (SM Scaling)

AP defaults to lowest modulation mode for Multicast Traffic

DL Multicast Modulation Rate distribution. Users can change to higher modes for more multicast
DL Multicast Repeat Count
heavy use-cases (e.g. IPTV). Higher Repeat Counts increase
DL Broadcast Repeat Count probability of RF packet reception.

SM Isolation – (Option 1 & 2)

SM Isolation controls SM Peer-to-Peer traffic switching on
AP including Broadcast and Multicast (You want Option 2
for IPTV)

PMP 450 – Canopy QoE / SLA / QoS Policies
SM Defines SM Service Policy
This can be done
by RADIUS or WM Individual Policy Parameters
Rate Shaping (QoE)
UL Sustained Data Rate
Canopy SMs provide an INCREDIBLY robust amount of DL Sustained Data Rate
parameters to Rate Limit End-User traffic and offer
Bursting (or EIR) over Limits as desired. Service Providers UL Burst Data Rate – (EIR)
DL Burst Data Rate – (EIR)
can also Rate Limit Broadcast and Multicast UL traffic if UL/DL Burst Token Allocation
UL Broadcast/Multicast Rate

The AP’s RF Scheduler will use all measures to achieve CIR (SLA)
these CIR values for each SM when service is being UL Data Rate – High Priority
requested. These CIR values are often set to match DL Data Rate – High Priority
Service Provider SLA package offerings. UL Data Rate – Best Effort
DL Data Rate – Best Effort
Canopy PMP’s QoS implementation provides multiple unique
traffic delivery mechanisms. An eight-level service prioritization Traffic Prioritizing (QoS)
engine that incorporates the basic honoring of Ethernet packet 1. Honoring Packet Markings
priority markings, and then feeds this to Canopy’s robust RF 2. AP RF Scheduler Prioritization
Scheduler process. Both of these interrelated processes are
explained in the following slides

(QoS) – Honoring Packet Markings – L3
How do you put traffic into a High Priority queue?

Option 1: The level of priority is determined by the L3 IP ToS bit

(aka. the Diffserv code point or DSCP) which can be
adjusted by Diffserv Configuration Page.

a. ToS Bit 0-3 = Best Effort VC

b. ToS Bit 4-7 = High Priority VC

Table below is example mapping:

Decimal Priority
Codepoint Value Value Result
000000 0 0 “Default” behavior
110000 48 6 High priority channel
111000 56 7 High priority channel

(QoS) – Honoring Packet Markings – L2
How do you put traffic into a High Priority queue?

Option 2: The level of priority is determined by the L2 IEEE

802.1p priority bits of a VLAN (Q or QinQ).
Mapping is fixed.

a. 802.1p Bit of 0-3 = Best Effort VC

b. 802.1p Bit of 4-7 = High Priority VC
Table below is example mapping:
VLAN Decimal Priority
Priority Value Value Result Options:
000 0 0 “Default” behavior 802.1p Then DiffServ ( Default )
100 4 4 High priority channel
DiffServ Then 802.1p
111 7 7 High priority channel

(QoS) – AP RF Scheduler Prioritization
Clearly Canopy has many value-added traffic controlling
attributes at both an individual SM level and at a sector-wide
OF THEM??!!!

Dedicated VC SM1 1. High Priority CIR

2. Best Effort CIR
3. Multicast Downlink CIR
Dedicated VC
High Priority VC SM2 4. Broadcast Downlink CIR
5. High Priority EIR
AP 6. Best Effort EIR
7. Multicast Downlink EIR
Common VCs
8. Broadcast Downlink EIR
Dedicated VC SM237
If Best Effort CIR is set to 0, then High
Priority traffic will be delivered before ANY
Best Effort traffic is fulfilled (analogous to
“Strict Priority”)
PMP 450 – Triple Play Prioritization Example 1
High Priority 200 kbps VoIP

Best Effort 0 kbps Data

Multicast DL 15000 kbps IPTV

Broadcast DL 50 kbps
High Priority 0 kbps
Best Effort 0 kbps

Multicast DL 0 kbps
Broadcast DL 0 kbps

Serviced Triple-Play Serviced Triple-Play

Customer Base Customer Base

1 VoIP 3 5 VoIP 7 9 VoIP 11 VoIP
Data Data Data Data Data Data
VoIP SM Data
SM VoIP SM Data SM Data SM Data
Data 2 Data 6 10
4 8 X

PMP450 Leaky Bucket Concept for MIR/BURST SIZE/BURST

Burst Duration Calculation

Burst Duration: T
Burst Size: BS
Max Burst Rate: MBR

MIR * T + BS = MBR * T


Burst Size

Burst Rate

Service Profile Example
Triple Play
UP Link Down Link

Sustained Data Rate 1000 kbps 6000 kbps

Burst Allocation 1,000,000 kbits 1,000,000 kbits Downlink Burst Duration:

Low Priority CIR 200 kbps 4000 kbps T = BS/(MBR-MIR)
Hi Priority CIR 200 kbps 200 kbps = 1000000/(8000-6000)
Max Burst Data Rate 8000 kbps 8000 kbps = 500 seconds

T-put Chart

Service Profile Example
Enterprise Backhaul
UP Link Down Link

Sustained Data Rate 15,000 kbps 15,000 kbps

Burst Allocation 0 0

Low Priority CIR 12,000 kbps 12,000 kbps

Hi Priority CIR 3,000 kbps 3,000 kbps Replacement of ~10 T1s

Max Burst Data Rate 15,000 kbps 15,000 kbps with traffic prioritization

Uplink/Downlink throughput chart 366

Service Profile Example
Price Sensitive, Low Tier Customer
UP Link Down Link

Sustained Data Rate 1,000 kbps 5,000 kbps

Burst Allocation 500,000 kbits 500,000 kbits Uplink Burst Duration:

Low Priority CIR 0 0 T = BS/(MBR-MIR)
Hi Priority CIR 0 0 = 500,000/(10000-1000)
Max Burst Data Rate 10,000 kbps 10,000 kbps = 55 seconds

Up Link
T-put Chart



PMP450 Security
• Access Control
– Security Mode
– Ports and Subnet Access
– User Control
• SNMP Security v2c and v3
• Air Interface Security: DES or AES FIPS197
• Authentication
– BAM / Pre Shared Key
– RADIUS SM Authentication
– RADIUS QoS and VLAN profiles
– RADIUS User Authentication
• Configuration Files
Access Control

Security – Security Mode

• Web access type: When selection secure web (HTTPS), radio uses the loaded
• SNMP type: When selection SNMPv3, radio uses the loaded Certificates.
• Telnet, FTP, TFTP: Enable or Disable Access

• Features available >= v13.3

Security – Ports

Change TCP/UDP ports in Configuration->Port Configuration

Security – Subnet Access

• Operators can configure Aps and SMs so that its IP address

is not accessible.
• Prevents rogue access to the management interface.
• Network operators always maintain access to the SM
through the AP.

Traffic Blocked CPE

Attempted ` B.B.B.4
Traffic Blocked

Switch: B.B.B.2 374

Security – Subnet Access
SM Ethernet Port Access “Disable” to
block all
attempts to
manage the
SM using an
Ethernet port
AP and SM Subnet Filtering Access connection.

When Enabled,
operators can
specify up to three
IP addresses that
are allowed
management access
to the device. 375
Security - Passwords
• Module-specific accounts with passwords and Read-Write
or Read-Only can be set up to control access to the
• Default Settings
– No login required
– admin and root accounts with ADMINISTRATOR level access,
read-write permission. No passwords set.
– guest account with GUEST level access: read-only with
limited view of Status page. Can not be changed or removed.
• Passwords must be set for both root and admin to secure
• Both admin and root accounts can be removed but it is
advised to not remove the root account.

Security - Passwords

• Up to 4 User Accounts can be created with the following

access and Read-Write or Read-Only permission
– ADMINISTRATOR: Full access to all settings
– INSTALLER: Full access to all settings except installer cannot
add, delete or changes users.
– TECHNICIAN: Permission to modify basic radio parameters and
view informational web pages

Security - Passwords
• Guest account can be restricted from see the General Status page
when viewing the initial module page.

SNMP v2c and v3

Security – SNMP v2c
• PMP 450 modules support SNMP v2c and v3*
• SNMP 2c is not considered secure as all data is transmitted
in clear text.
• To maximize v2c security, set strong Community Strings and
restrict SNMP subnet access.
• Default access is Read Only. Must be changed when using an
SNMP manager such as Wireless Manager (WM)

* SNMP v3 is available >= v13.3

Security – SNMP v3
• SNMP v3 provides a means of identification and secure communication
between known entities.
• SNMPv3 default setting must be changed to enable secure
communications Unique
Identity per
Security and


Security – SNMP Access
• SNMP Access can be restricted by IP address or subnets

Security – SNMP Traps
• Traps are events triggered by a module rather then by being
polled by a SNMP server.

Traps can be
sent to more
then one
SNMP Server

AP Trap
events 383
Security – SNMP Information
• SNMP Site information is available as follows
– AP / SM Status Page (can be restricted for Guest Account)
– Site Name in all Session Status Links (in addition to the MAC address)
– Any SNMP server requested
• Wireless Manager

Air Interface

Security - Air Interface

Two Encryption Alternatives DES or FIPS 197AES

• Software selectable in Configuration>Security
• Encryption handled outside normal packet handling and does not
add to system latency or overhead.
• Provides over-the-air security for transmitted data.
DES: Digital Encryption Standard
• 56-bit key, block cypher
AES: Advanced Encryption Standard
• 128-bit key for “strong encryption
• Highly secure form of encryption
• Optional feature on Cambium products
– Limitations on use outside the US
– Encryption type cannot be changed after purchase

Security - Authentication
AP’s has the following authentication modes:-

1. Disabled—the AP requires no SMs to authenticate.

2. AP PreShared Key
3. Authentication Server (BAM)
4. RADIUS (Remote Authentication Dial In User Service) AAA

BAM: Bandwidth and Authentication Manager.

Security – AP Authentication Settings
n Type

Up to 5 BAM
Up to 3 Radius AAA
Servers with Shared

AP Pre-Shared Key

Security – SM Authentication Settings

Radius Enforcement


Security – Authentication Disabled

If no authentication is enabled any SM will connect to the AP and pass

While this is generally thought of as bad practice additional security may
be in place e.g. requiring PPPoE to authenticate.

Security – Pre Shared Key Authentication

The AP acts as the authentication server to its SMs and will make use of a user-configurable
pre-shared authentication key.
The operator enters this key on both the AP and all SMs desired to register to that AP. There
is also an option of leaving the AP and SMs at their default setting of using the “Default
Due to the nature of the authentication operation, if you want to set a specific
authentication key, then you MUST configure the key on all of the SMs and reboot them
BEFORE enabling the key and option on the AP. Otherwise, if you configure the AP first,
none of the SMs will be able to register.

Security – BAM Authentication

Bandwidth and Authentication Manager (BAM)

The AP requires any SM that attempts registration to be authenticated
in BAM before registration
BAM Server was the earliest form of Canopy Authentication. It is still
supported but no longer available for purchase.
Radius AAA has super seated BAM, however, requires >= v11 software
on APs and SMs.

Security – Radius AAA Authentication
Remote Authentication Dial In User Service (RADIUS)
• The PMP 450 system includes support for RADIUS protocol functionality
• Authentication: Allows only known SMs onto the network (blocking
“rogue” SMs), and can be configured to ensure SMs are connecting to a
known network (preventing SMs from connecting to “rogue” APs).
RADIUS authentication is used for SMs, but not used for APs.
• SM Configuration: Configures authenticated SMs with MIR (Maximum
Information Rate), High Priority, and VLAN (Virtual LAN) parameters from
the RADIUS server when an SM registers to an AP.
• SM Accounting provides support for RADIUS accounting messages for
usage-based billing. This accounting includes indications for subscriber
session establishment, subscriber session disconnection, and bandwidth
usage per session for each SM that connects to the AP.

Security – Radius AAA Authentication
• Centralized AP and SM user name and password management: Allows AP and SM
usernames and access levels (Administrator, Installer, Technician) to be centrally
administered in the RADIUS server instead of on each radio and tracks access events
(logon/logoff) for each username on the RADIUS server. This accounting does not track and
report specific configuration actions performed on radios or pull statistics such as bit
counts from the radios. Such functions require an Element Management System (EMS)
such as Cambium Wireless Manager. This accounting is not the ability to perform
accounting functions on the subscriber/end user/customer account.
• Framed-IP-Address: Operators may use a RADIUS server to assign management IP
addressing to SM modules.

Security – Radius Configuration Source
Configuration/General Tab

During registration, SM’s retrieve VLAN and QoS from the following locations, based
on this AP setting.
Note: When No Authentication is selected, only SM is available.

• SM – All settings are retrieved from the SM

• Authentication Server – QoS and VLAN settings are retrieved from Radius. Any
QoS settings not set in Radius are taken from QoS Settings tab on AP
• Authentication Server + SM – QoS and VLAN settings are retrieved from Radius.
Any QoS settings not set in Radius are taken from the SM

*Is is easy to forget this setting. Doing so will allow authentication of SMs but
VLAN and QoS settings will be taken from the SM, not Radius

Security – Registration Process

The SM sequences through several steps to register with an Access Point:

1. If DFS applies, the SM scans for a radar signature (1 minute).
2. If DFS scan is negative, the SM scans for an AP beacon.
3. The SM sees a beacon from the AP.
4. The SM attempts to synchronize with the AP.

1, 2: Scanning

3 Beacon

4. Syncing

AP: Access Point

SM: Subscriber Module
DFS: Dynamic Frequency Selection 397
Security – Radius Authentication Process
1. SM sends a registration request to the AP using Phase 1
authentication credentials and a public certificate.
2. AP passes request, along with the AP shared secret to Radius.
3. Radius evaluates request and if correct, creates a EAP-TTLS tunnel
between Radius and SM using AP as proxy.
4. SM sends Phase 2 credentials to Radius using PAP/CHAP inside
secure tunnel. Radius sends authentication/rejection response to SM.
5. Radius passes authentication response to AP as well as QoS and
VLAN setting. AP forwards these to SM and allows access.

SM AP 2. Authentication Request Phase 1 Radiu

1. Registration Request Phase 1

3. EAP-TTLS Tunnel 3. EAP-TTLS Tunnel

4. PAP/CHAP Credentials Phase 2 4. PAP/CHAP Credentials Phase 2

5. QoS / VLAN 5. Authorization Response / QoS /


Security – Radius User Authentication

Local Root and Admin Accounts must have passwords set

• Local – Local SM Accounts are used for User Authentication
• Remote – Radius is always used for User Authentication
• Remote then Local – Local is used after Radius Failure based on “Allow Local Login
after Reject” setting. If Radius is not available, Local is used.

Radius Demo
WISP Toolbox
– Pre-configured Radius Server
• Open Source with open PHP frontend
• VM Available
• Developed by Cambium Tech Support
– Supports
• PMP 100 – 450 & PMP 320
• Authentication
• QoS Settings
• SM Access Control
• Syslog Server
• Framed IP Address
Configuration Files

Configuration Files
• Must use an Administrator Account with Read/Write Access
• Can Manually Import and Export files from Config->Unit Settings
• Creates an editable Text File - JSON Format
• Naming Conventions:
– <MAC Access>.cfg
– canopy.cfg
• File can contain full configuration settings or partial configuration
• Settings from file will be merged with those already on radio
• Optional file Headers
– setToDefault: Factory Default all settings except for those in the file
– rebootIfRequired: Reboot module after load if required.
*Configuration Files are available >= v13.3
Configuration Files – Manual Method

Click to download

Upload and Apply

File name must be <MAC>.cfg
or canopy.cfg
"userParameters": {
"gpsConfig": { {
"gpsInput": 0 "cfgFileString": "Canopy configuration
}, file", "cfgFileVersion": "1.0",
"apRadioConfig": { "configFileParameters": {
"radioControlSlots": 3,
"ofdmSMRcvTargetLvl": -52,
"rebootIfRequired":true, }
Configuration "limitFreqBand900": 0,
"radioFreqCarrier": 5800000,
File – *Edit to "displayAPEval": 0,
include only "pmp430InteropMode": 0,
Option File Header to
"apBeaconInfo": 0,
necessary "rfOLEnable": 0, set Values to Factory
settings "radioMaxRange": 2,
Default and reboot
"radioColorCode": 0,
"radioTransmitOutputPower": 5,
"colorCodeRescanTimer": 0,
"radioDownlinkPercent": 75,

*JSON editor recommended but Text Editor will also work

Configuration Files – SNMP Method
• Export Config file using SNMP MIB number to FTP Server
Example using CLI snmpset program
$ snmpset -v 2c -c Canopy <SM IP> . s
ftp://user:password@<FTP IP>/config.json
Import Config file using SNMP MIB number from FTP Server
Example using CLI snmpset program
$ snmpset -v 2c -c Canopy <SM IP> . s
ftp://user:password@<FTP IP>/config.json


Windows option: http://www.net-snmp.org
Linux / MAC: built in
Configuration Files – Zero Touch Method
Zero Touch Requirements
• Operates using DHCP Server with Option 66
• Server based Configuration Files
– Located on TFTP / FTP / HTTP / HTTPS server
• Configuration Files
– Golden Configuration File (All SMs)
– Specific SM Configuration using MAC address
• Can be used for initial configuration or ongoing
maintenance and system consistency.
• See Zero-Touch Configuration PDF in Student files.

Configuration Files – Zero Touch Method
Zero Touch Operation
• DHCP enabled SM
– Sends out DHCP Discover packet with DHCP Option 66 request.
• Factory Default SM registered using Installer Color Code (ICC)
– DHCP Discover packet is sent, even though DHCP client is not enabled
in factory default config.
• DHCP server responds with a DHCP Offer including a URL in response
to the Option 66 request. The URL points to a directory (MAC based)
or a specific file name (golden file).
• SM downloads the configuration file, apply it, and reboot
automatically if needed.
– Note: this requires “rebootIfRequired” flag to be added to the config

Configuration Files – Zero Touch Method
Zero Touch Setup (Golden Config File)
• Create the golden config file(s)
– Configure a sample SM and export the Config File
– Use a JSON Editor or Text Editor to modify Config file
• Online JSON Editor: https://www.jsoneditoronline.org/
• Host it on an TFTP/FTP/HTTP/HTTPS server
• Configure the DHCP server to return the URL of the golden config
file in option 66
– Examples
• Set SMs for Public and DHCP or use ICC to test configuration.

Configuration Files – Zero Touch Method

Sample Golden Config File

SM Specific information removed

Additional Set to Defaults


Configuration Files – Zero Touch Method
Zero Touch Setup (Specific SM File)
• Create sample config file from SM
– Use Editor or Script Engine to modify Config File
– Name each file as <MAC>.cfg
• Host files in a config directory on an TFTP/FTP/HTTP/HTTPS server
• Configure the DHCP server to return the URL directory in option 66
– Examples
• Set SMs for Public IP and DHCP or use ICC to test configuration.

Configuration LAB

PMP 450 Training

Management and Upgrades

Management Systems
• Wireless Manager 4.0
– Supports complete Line of Cambium Products including PMP 100 and PMP 320
– Extensive EMS platform
– On-Premise Linux or Windows based system
– Licensed Based
– Gradually will be phased out as cnMaestro adds product lines and features
• cnMaestro
– Next Generation Management Platform
– Cloud and On-Premise Versions
– HTTPS based system eliminates firewall issues
– No cost and future Advanced paid verison
– Currently supports PMP450, ePMP and cnPilot product lines
Configuration of Unit - Web Pages/Remote

Wireless Manager
Cambium Networks Wireless Manager
4.0 is recommended for managing PMP
450 networks.
This network management software tool
offers breakthrough map-based
visualization capabilities using
embedded Google maps, and combined
with advanced configuration,
provisioning, alerting and reporting
features you can control your entire
outdoor wireless network

cnMaestro – Next Generation Management Platform
Network Lifecycle Cloud Manager
Management Network Management
Inventory Management
Wi-Fi Controller
Support & Warranty Services On Premises
Network Manager

Long Distance: PTP 650, 820 Distribution Access: PMP 450, ePMP Edge Access: cnPilot

Home + Small

- Single Band
- Dual Band


Point to Point Point to Multipoint 802.11n, 802.11ac Indoor & Outdoor

cnMaestro Design
One Common Manager – Single pane of glass Management
• Map location of PMP Access
points, SMs and PTP Radios
• Hierarchical device organization
• Summary view of UP & DOWN
• Sticky Alarms – Critical, Major &
• Also supports cnPilot WiFi and
ePMP product families

cnMaestro Design
Cambium Networks’ cnMaestro provides an integrated, intelligent, easy way
to manage your network in the cloud.

Easy onboarding - Claim your PMP450, ePMP or Wi-Fi devices in

the cloud or on-site
Monitor your entire network - Leverage hierarchical
dashboards, statistics, and maps to view status and drill into
problem areas.
Configure devices on the cloud – Automatically provision devices upon
registration, or group devices and apply configuration parameters across your
Troubleshooting was never so intuitive- Visualize tower-to-edge device health and evaluate
real-time client network connectivity

cnMaestro – Key features
Simplify device deployment
• Use a barcode scanner to add devices into cnMaestro
• Devices can be claimed into your management system and pre-configured
before ever being unboxed. Deliver to installers for simplified and
consistent deployments
• Automatically upgrade devices to desired version during installation
Advanced Troubleshooting
• Quickly view the status and performance of the end-to-end chain of devices
providing service to a customer
• Remotely access all managed devices including customer WiFi routers to
resolve issues with minimal customer involvement
• Troubleshoot easily with status and health details of end-user devices or by
executing specialized operations such as spectrum analysis, network tests
and capturing tech support logs.
cnMaestro – End-to-end management
End-to-End Management
• Enhance your ability to resolve customer problems by providing fully managed end-to-end
solutions and earning additional revenue for the service
• Easily keep devices organized with automatic device hierarchy along with towers, sites and
network elements
• Obtain at-a-glance status with dedicated dashboards for a bird’s eye view of the entire
system as well as detailed dashboards for each device.
• View real-time notifications that are generated when a device loses network connectivity
• Visualize device status and performance using geographical maps

cnMaestro – Lower operational expenses

• Reduce support call times using

specialized troubleshooting
views of each device in the chain
supporting this customer
• Manage device software versions
and configuration centrally to
ensure consistency throughout
• Reduce operational risk by
leveraging tools tailored for your
Cambium Networks deployment

cnMaestro – Lower operational expenses
Always up to date with cnMaestro Cloud
• Eliminate the hassle of purchasing and
maintaining servers, updating
applications, backing up databases and
providing battery backup power
• Get started quickly by creating an
account. The solution scales with you
as you grow
• The cloud solution is highly
available with automatic failover,
database backup and uses encrypted
communication to the device and
browser sessions

cnMaestro Demo
Updates and Upgrades

Cambium Network Update Tool
Updates and Upgrades - CNUT
• Canopy Network Updater Tool (CNUT)

CNUT Overview
• Gives network operators the ability to manage software and firmware
upgrades across their entire network from one location
– No visits to individual modules
– Controlled updates in proper sequence
– Provides status report and activity logs

Using CNUT
• CNUT software can be downloaded at no charge from the Cambium
support website at http://www.cambiumnetworks.com/support/planning/index.php?cat=3&type=1
• Download the software upgrade package from the Cambiums support
website (URL above).
• Test the upgrade on a small portion of your network.
• Use CNUT to upgrade a standalone unit, an AP sector, or the entire

Details on Upgrade Process

• Each SM takes about four minutes to upgrade.

• Upgrades can be performed in parallel if there are multiple AP
• If the AP is rebooted before all SMs are upgraded, the process needs to
start over.
• All SMs must be powered on during the upgrade.
– Because some customers may power down their SMs periodically, leave the
update function operational for multiple days.

CNUT – Do’s and Don’ts

– Download the instructions and read them carefully
• Review the examples in the CNUT Release Notes
– Check that all SMs are active before upgrading
– Upgrade one Access Point cluster at a time
• Multiple sweeps may be needed
– Schedule the upgrade during a maintenance window
– Confirm upgrades are complete before disabling the upgrade function
– Call if you have questions before you start

CNUT – Do’s and Don’ts
– DON’T Just download the software and begin upgrading
– DON’T Upgrade the entire network at one time
– DON’T Forget to check that all SMs are active
– DON’T “Upgrade now and ask questions later”

CNUT Installation Notes
• Download CNUT from Cambium support website at
• Confirm the correct version of CNUT required to install the targeted
– Version listed in the release
– CNUT requires new format for System Release packages (.pkg3).
• CNUT has been tested and runs on:-
Windows Platforms (32/64‐bit OS)
– Windows Server 2003
– Windows 2000, Windows XP or XP Professional
– Windows 7
Red Hat Enterprise Linux (32‐Bit OS)
– Version 4
– Version 5
Using CNUT

Add to Network Root
• Use the Edit – Add Canopy Elements to Network Root command to add your network
infrastructure devices (AP and BH) to the CNUT database.

AP: Access Point 431

BH: Backhaul
Adding Elements

Specify the Element Type

by selecting the drop-
down arrow.
CNUT assumes use of
default network password
and default SNMP
community string. To
change this, deselect this
check box and enter the
appropriate passwords.
Enter the IP address of the
element to be added.
When you click your
cursor inside this box, the
sample string goes away.
Moving Elements

Use the check boxes to

the left of the element lists
to select item(s) to be
Use the “Edit – Move
Selected Network
Elements” command to
arrange elements into the
correct network hierarchy.

Auto-Discover SM and BHS Modules

Use the View menu to

discover some or all of
the SMs and BHSs in
your network.
You can discover the
entire network, or portions
of it. You must select the
specific AP or BHM
modules using the
checkboxes before
initiating the Refresh/
Discover process for a
subset of the network.

AP: Access Point SM: Subscriber Module
BHM: Backhaul Master BHS: Backhaul Slave
Interpreting Display of Information

Note the details displayed for each module: IP address, device type,
ESN (MAC address), software version, FPGA version, boot version, last
access date (by CNUT), and state (whether refreshed or newly
After the Discover process executes, the infrastructure items are
expanded. The SMs that are auto-discovered are listed under the
separate “Subscriber Module” heading. This list must be expanded by
clicking on the key-shaped icon to the left of the Subscriber Module
Display of Information – Expanded View

The auto-discovered Remote Module list is now expanded.

The IP address listed is for the AP to which the SM is registered.
The ESN column lists the MAC addresses of the individual Subscriber
AP: Access Point
SM: Subscriber Module
Load New Software Release into CNUT

Use the “Update –

Manage Packages”
menu option to load
software into CNUT.

Package Manager Window
Software packages
available in CNUT are
listed in the top half of
this window.
Use the Add button to
browse to another
software package that
has been saved to your
computer’s C drive.
Note, the software
version that is selected
with a checkmark will
be applied during the
Software can be downloaded from Cambium Support Web site at
upgrade process.

Initiate Network Update

Use the Update menu to

start the upgrade
process, whether for the
Network Root items, for
selected elements only,
or selected network
Must enable autoupdate
for SMs in order to
update the SMs that
were auto-discovered by

SM: Subscriber Module
Update Progress Steps
• CNUT will complete a series of update steps that include:
– Starting update process
– Using active FTP for file transfer
– Queue
– Checking network element status
– Using package
– Detect registered master device link
– Transferring files …
– Programming
– Waiting for reboot…
– Verifying…
– Waiting max 300 secs for master/slave to re-register…
– Completed success
– Update completed
NOTE: If autoupdate is enabled, a dialog box will display to indicate the start of that process.
Users can monitor progress through this dialog box, or periodically refresh the network
information display.
Refresh to Confirm Upgrades

Use the “View –

Refresh/ Discover
Entire Network” menu
option to confirm the
software upgrades
were successfully
applied to the elements
in your network.

CNUT Operational Tips

Tool used to set the valid address

from which APs will accept Auto-
update commands. Use this tool if
the Update Application Address on
the AP has been manually set to a
machine other than the one running

Tool that sets the valid network mask

for indicating from which machines
Cambium modules will accept SNMP
requests. Use this tool if the current
SNMP mask value on the modules is
too restrictive, in that the Network
Updater server isn’t allowed to
communicate with the modules via

Using CNUT to Change PMP 430 Channel Size

Change the SMs to the same

targeted channel bandwidth
Use CNUT to change the
channel size on the AP
• In the Update
Configuration tab, click on
the HPAP Channel
Bandwidth tab and then
select a target bandwidth.
• Select whether to proceed
if SMs are present.
• Select OK to implement
the change.

Updates and Upgrades - CNUT
• Automatically discovers all network elements
• Autoupdate mode within APs
• Network Updater automatically sets this Configuration parameter
in the APs to the IP address of the Network Updater server when
the server performs any of the update commands.
• Allows you to choose among updating
– your entire network.
– only elements that you select.
– only network branches that you select.
• provides a Script Engine that you can use with any script that you

Updates and Upgrades

License Upgrades
Updates and Upgrades - Upgrades
PMP100/400/430/450 SM’s can be license upgraded to deliver a higher throughput.

For example PMP450 SM’s are supplied in 4Mbps, 10Mbps, 20Mbps and uncapped versions
and these can be upgraded by applying a license key.

Updates and Upgrades – Upgrades cont..

Licence upgrades can be purchased from your Cambium Distributor, and are supplied in the form of
an enrolment key which is activated on the Cambium website:-

Once the enrolment key is activated the MAC address of the SM is used to generate a key which is
pasted into the web browser of the unit (the IP address would be the IP address of the unit), an
example is below:-

Configuration - Override/Default Plug

• Can be used to access any Cambium Wireless

Broadband module that is password protected or
is set to an IP address that is unknown to the
network administrator.
• Set operations as override or default:
– Override plug: Allows operator access.
– Default plug: Resets module to factory
• Plug intended for RJ-11 port. It can be
purchased or created.
• Use with the SNMP “set” command and a new
OID to return a module to factory defaults.

Configuration - Using Override / Default Plug

• Default setting is override plug operation.

• Enable as Default Plug on the Configuration – Unit Settings page.
• Insert plug into a module’s sync port (RJ-11).
• Reboot the module with plug inserted.
– For Override: the module will override IP address and password, allowing access to module
with current settings.
– For Default: All module parameters are reset to factory default values.

Configuration - Unit Settings Page (SM)

Configuration - Unit Settings Page (AP)

Configuration - Unit Settings Page Fields

1. Default Plug, Set to Factory Defaults: When enabled and an override plug is
inserted into the module, following a reboot, all parameters will be reset to
factory defaults. If disabled, the override plug will allow access to the module
with existing parameters left intact.
2. LED Panel Settings: For SM operations only, operators can activate a revised light
scheme for the LED lights on the module.
3. Unit-Wide Changes: Operators can undo changes saved to individual pages,
prior to a reboot of the module. Operators can also reset the entire module to
factory defaults.

PMP 450 Training Session

Link Capacity Test

Link Capacity Test
Test Type

SNR and Priority

Optional Testing

SM Section and

• RF Link Test – AP to SM Radio Transmission Only

• Link Test with Bridging – Simulates AP Ethernet to SM Ethernet traffic
• Link Test with Bridging and MIR – Simulates AP Ethernet to SM Ethernet traffic
including QoS MIR settings of SM
Link Test Results
Primarily used to look at downlink, uplink and
aggregate throughput and Link Efficiency

90% or higher is
considered a quality link

Link Test Results with SNR

Available when Signal to

Noise Ratio Calculation is
SNR is an indication of the
separation of the received
power level vs. noise floor.
Average Corrected Bit Errors
is also shown which is the
basis of SNR calculation
Link Test Results with SNR
• When SNR is selected, additional information such as BER is gathered
by the SM and AP.
• A packet is divided up into 64 byte fragments
– i.e. 512 byte packet is divided into 8 individual 64 byte fragments
• Received over the RF and recorded which path and which modulation
received at
• If transmitting at 8X, 8 fragments sent in one data slot

Link Test Statistics
Average Corrected Bit Errors
• Forward Error Correction records how many bits were corrected in that
• These are averaged for the link test
• The lower the number the better
• Signal to Noise Ratio is estimated based upon these bit corrections

1X SISO Data Slot




Path A
Fragment 1

2X MIMO Data Slot




Path A Path B
Fragment 1 Fragment 1

4X MIMO Data Slot



Path A Path B
Fragment 2 Fragment 2 16-QAM

Path A Path B
Fragment 1 Fragment 1

6X MIMO Data Slot


Path A Path B
Fragment 3 Fragment 3 64-QAM

Path A Path B
Fragment 2 Fragment 2 16-QAM

Path A Path B
Fragment 1 Fragment 1

8X MIMO Data Slot

Path A Path B
Fragment 4 Fragment 4 256-QAM

Path A Path B
Fragment 3 Fragment 3 64-QAM

Path A Path B
Fragment 2 Fragment 2 16-QAM

Path A Path B
Fragment 1 Fragment 1

Link Test Statistics – 8x operation
• % of QPSK fragments received on V =
– (V QPSK) / (total received all of path V)
– 80405 / (80405+ 80373 + 80371 + 80351) = 25%

Perfect 8x link would show 25% in each Path and Modulation
Link Test Statistics – 6x operation
• % of QPSK fragments received on V =
– (V QPSK) / (total received all of path V)
– 30664 / (30664 + 30578 + 30378 + 159) = 33%

Perfect 6x link would show 33% in QPSK – 64QAM Path and Modulation
Link Capacity Test Lab

Spectrum Analysis

Spectrum Analyzer
Example of 10 second Timed Spectrum Analysis

Download data as

Spectrum Analyzer
Zooming in on the 10 second timed spectrum analysis

Spectrum Analyzer

Mouse over the frequency for Each reading (vertical color bar)
detailed power information represents current instant or
average received power level

Instantaneous: Each reading has 2 black horizontal bars,

showing Max and Average Received power level
Averaging: Each reading shows one black horizontal bar
showing Max Received power level

Spectrum Analyzer - SM
• Select Min and Max
Frequency Range and
scan bandwidth
• Duration of scan can be
timed (10-1000sec) or
Continuous (Max 24
hours) After 24 hrs, SM
will automatically stop
• Once completely, SM will
display results and start
the registration process

Remote Spectrum Analyzer - AP
• Select connected SM,
duration and Bandwidth
size for Scan
• SM will drop the
connection and perform
a full spectrum scan i.e.
5.4-5.8GHz for 5GHz
• Once completely, SM will
re-register and send
results to AP for display

Spectrum Analyzer - AP
• Prior to v12.1, AP had to be
set as SM for Spectrum
• AP will only scan at its
current bandwidth setting.
SMs will however scan
using the selected setting
• V13.3 adds Sector Scanning.
When an AP scan is started,
all connected SMs also start
a scan. The AP will scan
40secs longer then the
selected duration to ensure
SMs do not see AP beacons

Spectrum Analysis Lab

Additional Tools

AP – Sessions

• Force a single SM or all SMs to re-register

• Local / Remote:
– SM (remote): AP immediate drops SM session
– Local: AP drops SM session when SM times out

AP – Subscriber Configuration

• Quick View of SM Settings

AP – Link Status

• Breakdown of each SM session showing current statistics

• Color coded to easily identify link performance
• Columns can be sorted
• Note: Links that have little activity may operate at lower modulations, showing red or
yellow while still being high quality links
SM – Link Status

• Summary of current SM Session

SM – AP Evaluation

• Shows all visible APs that do not have AP Evaluation blocked

• Data is taken during AP scan (registration) process
• Clicking Rescan APs will force a re-registration process

SM – Alignment Tool

PMP 100 - FSK

*Note: Only shows data when SM is registered
SM - Alignment
Scan Radio Frequency:
Enabled: Show Receive
Power Only
Disabled: Scan AP
Beacon Information and
Receive Power
• Click Enable to start
• Set Web Page refresh
to >=3 seconds to
refresh screen while
• After 15mins, SM will
exit alignment mode
Alignment Lab

PMP 450 Training

Course Wrap-up
Contact Information
Email: support@cambiumnetworks.com
North America Europe, Middle East, Africa
•Canada: 1 866-961-9288 •Denmark 043682114
•Mexico: 001-800-942-7721 •France 0157323434
•US: 1 866-961-9288 •Germany 06950070204
•Italy 0291483230
Latin America and Caribbean •Lithuania 880 030 828
•Argentina: 0800-666-2789 •Netherlands 0202061404
•Brazil: 0800-55-22-77 •Norway 24159815
•Colombia: 01-800-912-0557 •Portugal 0217616160
•Peru: 0800-70-086 •Russia 810 800 228 41044
•All other: 420-533-336-946 •Saudi Arabia 800 844 5345
•South Africa 0800 981 900
Asia Pacific •Spain 0912754787
•All: +420 533 336 946 •United Kingdom 0203 0277499
•All other: 420 533 336 946

Social Media
Follow us to get the latest information






Share Ideas
Learn from network operators around the world

Community Forum

Discussion Forums
Network Planning
Business Issues

Knowledge Base with technical detail


Submit development Ideas

Real world connectivity Stories


Thanks for participating!


• AAA Authentication, Authorization, Accounting
• FCC Federal Communications Commission
• AES Advanced Encryption Service
• GPS Global Positioning System
• AP Access Point
• HARQ Hybrid Automatic Repeat Request
• ARP Address Resolution Protocol
• HOA Home Owner’s Association
• ASN Access Services Network
• ICMP Internet Control Message Protocol
• BE Best Effort
• IDU Indoor Unit
• BS Base Station
• IEEE Institute of Electrical and Electronics Engineers
• CAP Cluster Access Point
• IP Internet protocol
• CEN Customer Enterprise Network
• LAN Local Area Network
• CINR Carrier Interference Noise Ratio
• LOS Line of sight
• CIR Committed Information Rate
• MAC Media Access Control
• CMM Cluster Management Module
• MIB Management Information Base
• CNS Cambium Network Services Server
• MIMO Multiple In, Multiple Out
• CNUT Canopy Network Updater Tool
• MIR Maximum Information Rate
• CPE Customer Premises Equipment
• MS Millisecond
• CCSM Cluster Subscriber Module
• MSCHAP Microsoft Challenge Handshake Authentication
• CSN Connectivity Services Network Protocol
• DES Data Encryption Standard • NAS Network Access Server
• DHCP Dynamic Host Configuration Protocol • NAT Network Address Translation
• DNS Domain Name System • nLOS Near Line of Sight
• DL Downlink • NLOS Non Line of Sight
• DSCP Differentiated Services Code Point • NMS Network Management System
• EAP Extensible Authentication Protocol • nrtPS Non Real-Time Polling Service
• EMS Element Management System
• ertPS Extended Real-Time Polling Service
• ERTVR Extended Real-Time Variable Rate


• NRTVR Non Real-Time Variable Rate • TEK Traffic Encryption Key

• NTP Network Timing Protocol • TOS Type of Service
• OFDM Orthogonal Frequency Division Multiplexing
• TTLS Tunneled Transport Layer Security
• OFDMA Orthogonal Frequency Division Multiple Access
• UGS Unsolicited Grant Service
• PMP Point to Multi-Point
• PPS Packets Per Second • UL Uplink
• PTP Point to Point • VDC Volts Direct Current
• QAM Quadrature Amplitude Modulation • VLAN Virtual Local Area Networking
• QoS Quality of Service • VoIP Voice over IP
• QPSK Quadrature Phase Shift Keying
• VSA Vendor Specific Attribute
• RADIUS Remote Authentication Dial-In UserService
• WAN Wide Area Network
• RF Radio Frequency
• ROI Return on Investment • WiMAX Worldwide Interoperability for Microwave Access
• RSSI Received Signal Strength Indicator • WLAN Wireless Local Area Network
• rtPS Real-Time Polling Service • WM Wireless Manager
• RTVR Real-Time Variable Rate
• SA Security Association
• CSM Subscriber Module
• SNMP Simple Network Management Protocol

PMP 450 Training

Lab 1 – Network Planning

Network Planning

Lab 1 – LINKPlanner v4
Lab 1: Create Site and Hub
1. Open LINKPlanner v4.x

1. Create New Project

2. Create New Site

– Site Name: Golf Club
– Maximum Height: 66 feet (20 meters)
– Latitude: 39.75093N
– Longitude: 104.84035W
– Description: Hub Site located at Golf Club

3. Create New Hub

– Select Golf Club as the Network Site
Lab 1: Modify AP
5. Navigate to the Golf Club Hub Site
– Modify the automatically created AP to the following
– Band: 5.8GHz
– Product: PMP 450i
– Country: United States
– Sync Source: Generate Sync
– Bandwidth: 20MHz
– Max Range: 2 miles (3.2 km)
– DL/UL Ratio 75 %
– Contention Slots: 3
– Antenna Selection: Cambium Networks 90°, 4.9-6 GHz, 90/120 deg Sector Antenna (18.0 dBi)
– Antenna Height: 66 feet (20 meters)
– Antenna Azimuth: 90 degrees
– Antenna Tilt: 0 degrees
– EIRP: 36 dBm (read only)
– Power: 20 dBm
– SM Receive Target Level: -57 dBm
– Interference?: Tick, -87.0 dBm
Lab 1: Add Subscriber Modules
6. Add New Subscriber Site
– Name: Billings Street
– Maximum Height: 33 feet (10 meters)
– Latitude: 39.74739N
– Longitude: 104.82459W
– Description: Corner of Billings Street and E. Montview Blvd
7. Add New Subscriber Site
– Name: Xanadu Street
– Maximum Height: 33 feet (10 meters)
– Latitude: 39.75385N
– Longitude: 104.82905W
– Description: Customer on Xanadu Street
Lab 1: Add SMs to AP
8. Select Access Point from Navigation Tree
9. Add Subscribers to AP
– Billings Street
– Xanadu Street
10. Navigate to each SM and modify settings as follows
– Type: PMP450
– Antenna Selection: Cambium Networks 55° Integrated Antenna (9 dBi)
– Antenna Height: 16.5ft (5m)
– Interference?: Tick, -87.0 dBm
11. Profiles Should have automatically been downloaded
12. Select Google Earth and view links
13. On Billings Street Link, add the following obstructions
– 0.502miles (0.808km): 13.1ft (4m)
– 0.837miles (1.347km): 8.2ft (2.5m)
Lab 1: Add SMs to AP
14. Review the performance of both links
15. Customers require a minimum of RSSI -60dB and 6x (64QAM MIMO B) in Downlink operation.
16. Adjust antenna heights and SM equipment appropriately to achieve requirements
– Hint: Use Antenna Configuration and Performance Details
– Enable Automatic Calculation or Click Recalculate when changes are made
Lab 1: Lab Solution

1. Raise Billing Street SM to 30 feet (9 meters)

2. Add Clip or Dish to PMP450 or change radio to PMP450b or 450d
Network Planning

Lab 1 – LINKPlanner
End of PMP 450
Lab 1


PMP 450 Training

Lab 2 – Frame Calculator

and Co-location Tools
Network Planning

Lab 2 – Frame Calculator

Lab 2a: Frame Calculator

• Current Deployment
– 4 PMP 130 APs in a cluster (5.7 GHz), 20MHz Channel
– Range: 10 miles (Customers at max 6 miles)
– Contention Slots: 3
– Downlink: 75%
• Planned Addition Nearby Tower
– 4 PMP 450i APs in a cluster (5.7 GHz), 20MHz Channel
– Expected Customers: up to 60 per AP
– Desired settings similar to PMP 130
• Use PMP100/450 co-locate spreadsheet to work
out required settings

Lab 2a: Frame Calculator
Lab Worksheet
PMP 130 APs
Range Percent Contention AP Receive
Slots Start
10 75 3

PMP 450 APs

Range Percent Contention AP Receive
Slots Start

Lab 2b: Frame Calculator

• Current Deployment
– 4 PMP 450 Aps in a cluster (5 GHz)
– 30MHz Channel
– Downlink: 75%, Max Range 10 miles, 3 contention slots
• Planned Migration on existing Tower
– 4 PMP 450i APs in a cluster (5 GHz)
– 20MHz Channel
– Expected Customers: up to 60 per AP
– Customers all within a 20 mile Range
– Downlink: As close to 60% as possible
• Use PMP450/450 Co-locate spreadsheet to
determine what new settings are possible

Lab 2b: Frame Calculator
Lab Worksheet
PMP 450 APs
Channel Size Percent DL end UL start

10 75

PMP 450i APs

Range Percent Contention DL end UL start

Network Planning

Lab 2 – Frame Calculator


End of PMP 450
Lab 2

PMP 450 Training

Instructor Lead
Lab 3 – VoIP QoS
VoIP QoS Lab – Preliminary Setup
Grandstream VoIP Gateway cnPilot R200 – 1 (SM1, already configured, verify SIP QoS Settings)
(already configured, verify ToS Settings)
IP Address:
IP Address:
Username/Password: admin/admin
SIP QoS: 0
Username/Password: admin/admin
RTP QoS: 0
Network Mode: Switch (both LAN and WAN port are the
same). This can be changed to NAT as necessary
Proxy Server:
Outbound Server:
1001: Analog - FSX port 1
Display Name: Phone31
1002: Analog - FSX port 2
Phone Number: 1031
1031: SIP –cnPilot R200
Account: 1031
1032: SIP - cnPilot R200
Password: SuperSecret
1111: Page All
6300: Conference Room
cnPilot R200 – 2 (SM2, already configured, verify SIP QoS Settings)
PBX/SIP/ToS Settings
IP Address:
ToS for SIP: None
Username/Password: admin/admin
ToS for RTP: None
ToS for RTP Video: None
SIP QoS: 0
RTP QoS: 0
AP: IP Address:
Proxy Server:
SM1: IP Address:
Outbound Server:
High Priority: Off
Display Name: Phone32
Phone Number: 1032
SM2: IP Address:
Account: 1032
High Priority: Off
Password: SuperSecret
VoIP QoS Lab – Preliminary Setup


SM 1 SM 2
Ext: 1031 Ext: 1032

cnPilot R200 cnPilot R200

Gateway VoIP PBX Power Supply
Lab 3: VoIP QoS Lab

• Demonstrate
the use of the cnPilot R200 device using a VoIP PBX

• Demonstrate QoS settings and High Priority Channel on PMP products

• Demonstrate QoS information within an Ethernet packet
Lab steps show VoIP setup using no QoS through to End to End QoS
Lab 3a: VoIP Setup without QoS

1. Explain cnPilot R200 device ports and operation

2. Explain VoIP PBX ports and basic operation
This unit is based on Asterisk, a popular public domain PBX system.
The unit incorporates the Asterisk system with 2 FXO ports
(connections to phone lines) and 2 FXS ports (analog phones or Fax).
In addition it supports SIP devices as well as SIP trucks. For this lab, it
is configured as a business style PBX system with office extensions)
3. Replace SM power supplies with cnPilot R200 devices and
4. Install phones into port FSX1
5. Power up units and log into one of the C3 devices
6. Briefly show interface, particularly SIP and FXS settings
Lab 3a: VoIP Setup without QoS

7. Log into VoIP PBX and show Extensions and PBX status
8. Place call from one phone to the other (On 1031, call 1032)
9. On AP, go to Statistics / DataVC and show that all data is in
one VC (normal priority) on each SM
10. Discussion
a. Is there currently any QoS on the SM’s, AP, phones etc.
Answer: No, although one of the C3 devices has DSCP turned on, High
Priority is not enabled on the SM, therefore all traffic is Low priority.
b. Where does QoS need to be turned on?
Answer: On all devices in the link, C3s, SMs, APs, PBX, and any
switch/router in between.
Lab 3b: VoIP add QoS

1. Turn on QoS on both cnPilot R200 devices

SIP/VoIP QoS *Note: SIP is just the session setup, RTP is the actual data
SIP QoS: 46
RTP QoS: 46
2. Turn on High Priority on High Priority on both SM’s
3. AP settings are not required.
4. On AP, go to Statistics / DataVC and show that data is now
flowing on HP VC, however some data is also flowing on
the Low Priority VC as well. Why?
Answer: VoIP packets from the phones are DSCP 46 but packets from the VoIP
gateway are not coded for DSCP 46
Lab 3b: VoIP add QoS

5. (Optional) Go to VoIP PBX device,

Maintenance/Troubleshooting/Ethernet Capture
5a. Make another call between phone and start capture
5b. Download pCAP file and open with Wireshark
5c. Show IP Header with and without DSCP code point
6. Go to Grandstream and add DSCP
ToS for SIP: EF (Note: EF is a DSCP classifier equivalent to code point
ToS for RTP: EF
7. On AP, go to Statistics / DataVC and show that all VoIP data
is now flowing on HP VC. Minor data on Low Priority is
beacons and control data.
Lab 3c: VoIP Gateway (optional)
If VoIP gateway has internet access, you will be able to dial a
students cell phone.
Possible Methods
a. MAC - Share WiFi internet connection on Laptop with
ethernet connection
b. ePMP SM -(If 5GHz 802.11n is available) Set SM to
WiFi mode and connect to Hotel etc WiFi. Set SM for
NAT and make sure LAN IP is
c. Available Ethernet: Change Grandstream Network
mode to NAT and connect WAN port to internet
End of PMP 450
Lab 3

PMP 450 Training

Lab 4 – cnMaestro Lab


Lab 4 – In Class Demo

End of PMP 450
Lab 4