How to Configure Cambium Policy Based Automation (PBA Auto-VLAN)

A practical Elmdale IT Services guide to using Cambium Policy Based Automation with cnMatrix switches and cnPilot access points, including LLDP validation screenshots and troubleshooting checks.

Cambium Policy Based Automation, also known as PBA Auto-VLAN or Auto-Attach, can reduce manual switch port configuration by allowing a cnMatrix switch to dynamically learn VLAN requirements from a directly connected cnPilot access point.

Before you start

Use supported cnMatrix and cnPilot firmware.
Confirm LLDP is enabled.
Confirm Auto-Attach is enabled on the switch.
Put the AP Ethernet interface into trunk mode.
Prepare a clear VLAN and SSID design before rollout.

Step 1 – Confirm the topology

The AP should be directly connected to the cnMatrix switch port that will receive and apply the dynamic policy.

Topology diagram: cnMatrix switch connected to cnPilot access points, showing authentication TLV and device setting TLV exchange.

Step 2 – Understand the LLDP workflow

The switch sends a PBA authentication TLV. The AP responds with a device settings TLV containing the VLAN list. The switch authenticates and processes this information before applying a dynamic policy to the ingress port.

LLDP workflow: discovery, cnMaestro/AP configuration, PBA authentication TLV and device setting TLV sequence.

LLDP packet capture from the cnMatrix switch showing the Cambium-specific authentication TLV.

LLDP packet capture from the cnPilot AP showing the device setting TLV and VLAN list.

Step 3 – Check Auto-Attach on cnMatrix

Verify that Auto Attach Global Status is enabled and that the target AP port is operational.

cnMatrix Auto Attach settings showing Auto Attach Global Status enabled.

Step 4 – Check LLDP on cnPilot

Confirm LLDP is enabled on the AP. The source guide notes that LLDP is enabled by default on cnPilot APs, but it should still be checked during commissioning.

cnPilot AP system settings showing LLDP enabled.

Step 5 – Configure the AP Ethernet interface

The AP Ethernet interface must be in trunk mode for the PBA Device Settings TLV to be generated. Add the VLANs required by the SSIDs and services being carried by the AP.

If Native VLAN Tagged is used, include the native VLAN ID in the allowed VLAN list.
Keep the VLAN list within the supported maximum of 20 VLANs per Ethernet port.
Document the intended VLAN list before deployment.

Step 6 – Connect the AP and validate LLDP

Patch the AP into the target switch port and allow LLDP to exchange. Then confirm the AP appears as an LLDP neighbour.

cnMatrix GUI LLDP traffic information screen used during validation.

show lldp neighbors

CLI output for show lldp neighbors confirming directly connected devices.

Step 7 – Confirm learned VLANs

Use LLDP neighbour detail output to confirm that the switch has learned the VLAN list from the AP.

show lldp neighbors gigabitethernet 0/6 detail
show lldp neighbors gigabitethernet 0/7 detail

CLI LLDP neighbour detail output showing learned VLAN list from a connected AP.

Second CLI LLDP neighbour detail output showing another learned VLAN list.

Step 8 – Confirm Auto-Attach policy applied

The switch should create a generated policy and apply it to the ingress port where the AP is connected.

cnMatrix GUI Auto Attach interface statistics showing generated policies attached to ports.

show auto-attach policy
show auto-attach interface

CLI output for show auto-attach policy showing generated policy names and status.

CLI output for show auto-attach interface showing active policy per interface.

Step 9 – Review policy detail and statistics

Check the detailed policy output and statistics to confirm the correct port mode, VLAN list and TLV processing state.

show auto-attach policy detail
show auto-attach interface statistics
show auto-attach policy statistics
show lldp traffic

CLI output for show auto-attach policy detail showing action port mode and VLAN list.

CLI output for show auto-attach interface statistics showing TLVs received, processed and authentication failures.

CLI output for show auto-attach policy statistics showing applied, expired and error counters.

CLI output for show lldp traffic showing global LLDP counters and device settings TLV authentication failures.

Step 10 – Optional authentication key change

If changing the PBA authentication key, use the same key on both the switch and AP. If the keys do not match, LLDP authentication fails and the policy will not apply.

cnPilot CLI command prompt for changing the LLDP PBA authentication key.

cnMatrix CLI command for changing the auto-attach message authentication key.

Troubleshooting quick checks

AP not visible: check cabling, PoE, LLDP and supported firmware.
No VLAN list: check the AP Ethernet interface is in trunk mode and has allowed VLANs configured.
TLV authentication failures: check the shared authentication key on both devices.
Policy not attached: check Auto-Attach global and port-level status.
SSID clients cannot reach services: validate VLANs, DHCP, routing and firewall rules end to end.

How Elmdale IT can help

Elmdale IT Services can support Cambium switching, WiFi design, VLAN segmentation, Policy Based Automation validation, post-install wireless surveys and ongoing managed IT support.