Cambium cnMaestro On-Premises

Overview

The free on-premises edition of cnMaestro has no API, so MyPlace connects to it the way you would: by signing in with an administrator account. We use that session to read your access points and write the guest configuration.

This page is for the free edition only. On-premises cnMaestro X and cnMaestro Cloud both expose an API and are set up differently — see cnMaestro Cloud, or the Cambium overview if you are not sure which you run.

What You Need

• cnMaestro Host — a public address for your on-premises cnMaestro
• Username and password of a cnMaestro administrator
• Outbound UDP 1812 from the venue network to the internet. On this edition it is mandatory — the next section explains why
• An SSID you can dedicate to guests

How Guests Get Online on cnMaestro On-Premises

This is the part that differs from every other vendor in our documentation, and it is worth two minutes.

On most platforms the captive portal does two jobs: it collects the guest’s details, then tells the access point to let them online. Here it can only do the first. The access point never tells the portal where to send that confirmation, so the portal has no way to release anyone.

The release happens on a separate channel. When a device joins the network, the access point asks the MyPlace authentication servers about it over RADIUS. A device we have never seen is refused, and the guest is sent to the portal. Once they have registered, the next question about that device is answered yes and they go online.

Note: Cambium access points re-ask about a refused device several times a second, so a guest who has just finished the portal is online within about a second. There is nothing for them to do — no reconnecting, no waiting.

Important: Because RADIUS is the only route online, outbound UDP 1812 is a requirement on this edition, not a recommendation. Block it and the portal still works perfectly — it collects every guest’s details — while nobody ever gets internet access. That failure looks like a broken portal and is not one.

Connecting cnMaestro On-Premises to MyPlace

1. Open MyPlace Admin Panel → Networks → Network Controller tab
2. Click Add New Controller, select Cambium, then cnMaestro On-Premises (Free)

3. Enter the cnMaestro Host, Username and Password of an administrator, then click Finish. MyPlace signs in before saving anything

4. Click the + icon on the new controller’s row, pick the MyPlace location and the SSID guests will join, then click Add Location

What MyPlace Configures

Adding a location writes the guest configuration for you:

• The guest portal on the chosen WLAN, pointed at your branded MyPlace login page and carrying your venue’s identifier
• The WLAN’s security adjusted for captive-portal use
• The walled garden, so the login page loads before the guest is online
• MAC authentication set to RADIUS on the access control policy, pointed at the MyPlace authentication servers. This is the switch that makes guests able to get online at all

Important: If that last setting is changed in cnMaestro afterwards, the portal keeps collecting guest details and nobody gets online. Re-applying the configuration from MyPlace puts it back.

Checking It Worked

Open Settings → Local Network → Guest Portal Configuration for the location. It reads the live configuration back from cnMaestro, so what you see there is what the WLAN actually has. The Health Check button on the same page validates the whole set-up against what MyPlace expects.

Then connect a phone to the guest SSID and walk through the portal once. A successful sign-in shows up in Guests within a few seconds — and the phone itself should have internet about a second after that.

Walled Garden

Before a guest is authorised, their device has to reach the login page and a short list of MyPlace and social-login hosts. MyPlace writes those entries for you when the location is added.

You need the list yourself only if your venue filters outbound traffic upstream of the access points. Open Networks → Network Controller and use the “Click here for a list of IP addresses” link under the controller table — it always shows the current list. We do not print it here on purpose: these addresses change as our platform moves, and an allow list copied from an old page looks correct and blocks guests anyway.

Troubleshooting

Issue	Resolution
Guests fill in the portal but never get internet	The signature failure of this edition. Allow outbound UDP 1812 from the venue network, then re-apply the configuration so MAC authentication is set back to RADIUS
Sign-in to cnMaestro is refused	Confirm the account is a cnMaestro administrator, and that the host is reachable from the internet
You were asked for a Client ID and Secret	You picked a cnMaestro edition with an API. Go back and choose cnMaestro On-Premises (Free), or follow the cnMaestro Cloud guide if that is what you actually run
Guests see “Venue does not exist”	The portal address was edited in cnMaestro. Re-apply the configuration
The portal never appears	The SSID still has a password, or the walled garden entries are missing

Known Limitations

• The portal cannot release a guest by itself on this edition. RADIUS is the only route online, which is why outbound UDP 1812 is a hard requirement here and not on the API editions.
• One Cambium network maps to one MyPlace location. A venue with several networks needs a MyPlace location for each.
• The connection depends on the administrator account. Disable or rename it in cnMaestro and MyPlace can no longer read devices or apply configuration.

Support

For assistance with setup issues or questions about cnMaestro On-Premises, contact the support team via the Contact Us page.