Deploy Your First Network
Between a validated design and a network carrying real traffic there are seven stages. What follows is a map rather than a manual: each stage links to the operations guide that documents it in full.
Read it end to end before you begin. Several stages have prerequisites that are painful to discover late.
Before you start
Have these settled. Each one blocks a later stage.
Spectrum access confirmed
On CBRS, radios cannot transmit until the SAS authorises them. Outside the US, a local license must be in hand.
CPI arranged (CBRS only)
A Certified Professional Installer must verify and sign each radio's installation record. Certification is held by an individual: line one up before installation day, not after.
Site prepared
Rack space, power, and cooling for Onyx Edge. Fronthaul cabling to every radio location. Mounting, and for outdoor units enclosures, grounding, and surge protection.
Onyx Portal account activated
Portal access requires account activation and MFA enrolment.
Networking mode decided
NAT or Bridge determines how Onyx integrates with your LAN. Changing it later means reconfiguring the network.
SIMs on hand
Devices cannot attach without provisioned credentials.
Device compatibility verified
Confirm your actual device population supports your band against End Devices.
Decide NAT or Bridge now
This choice shapes everything downstream, so make it deliberately.
NAT mode: Onyx Edge acts as a secure gateway between the private RAN and your enterprise network. It assigns device IP addresses from a local pool, and NAT on the N6 interface means your LAN sees only the Onyx Edge address. Devices, APs, and FHMs are not directly reachable from the enterprise network. Choose this for strong isolation and simple IP management, where you do not need to reach individual devices.
Bridge (APN-on-VLAN) mode: Onyx Edge bridges device traffic directly into enterprise VLANs with no NAT. Each APN maps to a dedicated VLAN, your own DHCP assigns device addresses, and devices appear as native enterprise devices with full visibility and policy control. The N6 interface becomes a VLAN trunk. Choose this for deep integration with existing enterprise routing, security, and management tooling.
Bridge mode is also what makes per-device-group segmentation possible, so if network segmentation matters to your security posture, it is the stronger choice. See the 5G Onyx Portal 4.x Operations Guide.
The sequence
Work through these in order. Each stage depends on the one before it.
Get into the Portal
Activate your Onyx Portal user account, install an authenticator app, and complete MFA enrolment. Store your MFA backup codes somewhere you will still be able to reach them if you lose the device.
Where your organization uses an identity provider, the Portal supports SSO instead, see the 5G Onyx Portal 4.x Operations Guide.
Install the hardware
Rack and power the Onyx Edge. Mount radios at the locations your coverage plan specifies and run fronthaul to each. Where an FHM is in the design, cable the RUs to it and the FHM to the Edge.
Record the exact installed position of every radio as you go: geographic coordinates, height above ground level, azimuth, downtilt, and antenna gain. On CBRS these are the values the CPI certifies and the SAS registers, and they must match physical reality. Capturing them during installation is far easier than deriving them afterwards.
→ Per-model installation guides under Onyx Hardware
Create the network
Create the network under the correct customer account, then configure Core and RAN parameters: including the networking mode you decided above.
NOTE: Network creation requires GXC Administrator, Partner Administrator, or Super Administrator privileges, and networks can only be created under customer accounts. Confirm you have the right role and the right account selected before you start.
Register with the SAS: CBRS only
Radios on CBRS cannot transmit until the SAS authorises them. The full workflow runs: CPI account setup, deployment creation in the SAS portal, CBSD records for each radio, CPI signing, SAS parameter configuration in the Onyx Portal, then grant verification.
Onyx handles SAS communication through an integrated Domain Proxy, so you manage this from the Portal rather than radio by radio. Large or DAS deployments can use bulk registration.
Expect this stage to take longer than the others. It involves an external portal, a credentialed individual, and a regulator's system.
Create subscriber groups, then subscribers
Groups come first: a subscriber account is assigned to a group, and the group carries the QoS and policy that applies to its devices.
Define groups along the lines your workloads actually need. Cameras, handhelds, AGVs, and laptops have genuinely different requirements, and separating them here is what lets you police them independently later. Collapsing everything into one group is the most common day-one mistake, and it removes your ability to protect critical traffic under load.
Then create subscriber accounts and provision SIMs. Bulk assignment is available for larger fleets. Enable IMEI verification where the device population is known: it binds each SIM to authorised hardware and blocks SIM-swap attacks.
Attach a device and verify
Insert a provisioned SIM, confirm the device attaches and gets an address, and run a subscriber speed test from the Portal.
Then verify the network rather than the single device:
Coverage: walk the site and check signal at the planned worst-case points, not just near the radios.
Uplink under load: for most workloads the uplink binds first. Test it with several devices active, not one.
Mobility: move a device across the full coverage area while a session is open. On a Shared Cell deployment there should be no handover interruption at all.
Alerts: confirm alerts are configured and reaching someone.
Apply QoS
With traffic flowing, map each workload to the right 3GPP 5QI so applications share spectrum without competing. This is what keeps a control loop responsive while a firmware download runs.
Give bulk traffic (firmware, backups) a low-priority non-GBR class and a schedule. Left unclassified, it will contend with production traffic at the worst moment.
Use Cases list throughput, latency, and 5QI mapping for common workflows.
Before you call it done
Security posture reviewed: segmentation applied, firewall policy in place, RBAC roles assigned, MFA enforced. See Security and Compliance.
Log export configured, if your compliance regime needs retention beyond the Portal's 60 days.
Alerts routed to someone who will act on them.
An owner named. A private network is infrastructure. Subscriber lifecycle, firmware updates, alert response, and (on CBRS) the SAS relationship all need a person.
Related reading
5G Onyx Portal 4.x Operations: the complete 5G operations guide
4G Onyx Portal 4.x Operations: the LTE equivalent
4G Onyx Edge On-Premises 4.x Installation and Operations: Edge software installation and upgrade
5G Onyx Portal 4.x Alerts Reference: every alert and what it means
Contact GXC
To get in touch with GXC, please visit https://gxc.io/contact-us/.
Last updated
Was this helpful?