Private 5G That Works: A Hands‑On CBRS Guide for Small Warehouses and Campuses

Wi‑Fi is great until forklifts start moving, racks block signal, or you need predictable uplink from handheld scanners and cameras. That’s where a small private 4G/5G cellular network shines. In the United States, CBRS (Citizens Broadband Radio Service) opens licensed‑grade spectrum to enterprises without carrier contracts. With the right plan, you can deploy a private 5G network that is reliable, secure, and maintainable—even on a modest budget.

This guide walks you through a practical CBRS rollout for small warehouses, campuses, and production floors. You’ll learn what to buy, how to register with a SAS, how to provision SIMs, which core to run, and what to monitor—without getting lost in telco acronyms.

Why Private 5G for Small Sites

Private cellular isn’t just a bigger, more expensive Wi‑Fi. It solves a different set of problems:

Mobility that holds: UEs (phones, tablets, scanners, AGVs) keep sessions across cells without sticky roaming issues.
Deterministic uplink: Time‑division scheduling preserves uplink even when devices crowd a channel.
SIM‑based security: Access is cryptographically bound to provisioned SIMs, not passwords.
Coverage with fewer radios: Lower frequencies and higher power per cell extend reach in aisles and yards.
Traffic isolation: Keep warehouse traffic off guest networks and out of the public internet.

If you need handheld scanners to work everywhere, carts to stay online while moving, or uplink from cameras and sensors that Wi‑Fi can’t reliably service, CBRS is worth your time.

CBRS in Plain Language

CBRS lives in 3550–3700 MHz (Band 48 for LTE, n48 for 5G NR). It’s shared spectrum managed by a Spectrum Access System (SAS) that coordinates three tiers of users—from incumbents to licensed PAL holders to general access (GAA). For most small sites, GAA works well and costs a modest annual fee per radio.

Key takeaways

You must register every radio (CBSD) with a SAS provider.
Category B CBSDs (usually high‑power or outdoor) require CPI (Certified Professional Installer) sign‑off. Many Cat A indoor units also need CPI certification of location/height if those parameters can’t be verified automatically. Budget for it.
CBRS supports both LTE and 5G NR. LTE Band 48 has excellent device support today; 5G n48 support is improving but still varied—check your fleet.

Your Minimal Viable Private Network

Here’s the smallest setup that still runs well and scales later:

One indoor small cell (gNodeB/eNodeB) with integrated or external GPS/1588 sync.
One server (Intel NUC or 1U) hosting a 4G/5G core (Open5GS or commercial) and basic monitoring.
A SAS subscription (Google, Federated Wireless, CommScope, Amdocs) and CPI sign‑off.
10–50 SIMs provisioned with your private PLMN and APN.
Backhaul to your LAN with a well‑defined VLAN for UE traffic and firewall rules.

What it costs (ballpark)

Indoor small cell: $1,500–$7,000 (MIMO, power class, and vendor support drive price)
SAS fee: $300–$600 per radio per year
CPI service: $300–$1,000 per site (one‑time, varies by provider)
Core software: Open source (time investment) or commercial subscription ($$$/year)
SIMs: $5–$15 each (physical) or eSIM profile services (varies)

Plan Before You Buy

1) Define the job your network must do

Write down real needs. Replace “fast” with specifics:

Mobility: Handhelds and forklifts keep sessions through cell borders with no drops.
Uplink budget: Scanners send 5–20 kB per event; 1080p cameras need 3–6 Mbps each uplink baseline.
Latency: AGV control needs sub‑50 ms end‑to‑end; scanners are fine with 100–200 ms.
Coverage: 40,000 sq ft warehouse with 24 ft racks; yard coverage along loading dock.
Devices: Which models, how many, Band 48/n48 support?

2) Check device support first

Many iPhones (11 and newer), modern Pixels, and enterprise handhelds support LTE Band 48. 5G n48 support is growing but not universal. Before you commit to 5G‑only RAN, inventory your endpoints and confirm support in their spec sheets or certification lists.

3) Start with LTE or mixed mode

For maximum compatibility on day one, consider an LTE‑first or mixed LTE/NR deployment. You can still run a 5G core and migrate devices to n48 later without forklift upgrades to everything else.

Pick the Building Blocks

Radios (CBSDs)

Look for indoor Cat A small cells with:

2×2 or 4×4 MIMO and 10–20 MHz carrier support in CBRS
TDD profiles that can be aligned across your cells
Integrated GPS with an external antenna option or support for IEEE 1588 PTP clock sync
OnGo certification where possible, to smooth device compatibility

Don’t overbuy power for indoor. More power isn’t always more coverage—uplink from client devices often becomes the limit. You’ll get farther with good placement and proper antenna patterns.

Core options

Open5GS: Lightweight, production‑proven 4G/5G core you can run on a single server. Great for labs and MVPs.
Commercial cores: Vendors like HPE (Athonet), Nokia DAC, and others offer turnkey packages with support and device onboarding tools.
Magma: Useful for LTE EPC‑centric deployments with growing 5G support; consider it if you want strong edge gateway features.

For small teams, a managed private 5G package (which bundles radios, core, SIM lifecycle, and SAS) can reduce risk. For tinkerers or cost control, Open5GS on a NUC is a capable start.

SIMs and eSIMs

You need a PLMN (MCC/MNC), keys, and an APN for your network. For pilots, order programmable SIMs from specialist vendors. For at‑scale deployments, use a vendor‑hosted eSIM SM‑DP+ service to provision profiles over the air.

Physical SIMs are simplest to start. Keep a table of IMSI ↔ device owner and a secure store for keys (K, OPc).
eSIM is great for field devices—no plastic swaps—but requires agreement with an eSIM provider to host profiles.

SAS providers

Pick a SAS with good tooling and support. Expect per‑radio annual fees and a CPI process to certify locations and parameters. Many SAS vendors offer remote CPI services to keep logistics simple.

Network Design: Keep It Boring

IP addressing and routing

Keep your UPF/EPC on a dedicated VLAN and NAT UE traffic into your enterprise network. Allocate a /24 (or more) for UE IPs; you can expand later. Expose necessary services to UEs via ACLs and avoid full east‑west trust.

QoS and slices

In LTE, map traffic classes with QCI to support low‑latency flows vs. best‑effort. In 5G, assign QoS flows for priority apps. On your LAN, honor DSCP marks or rewrite at the UPF to maintain end‑to‑end behavior.

Time sync matters

CBRS uses TDD and benefits from synchronized cells. If GPS isn’t possible indoors, deliver IEEE 1588 PTP with boundary or grandmaster clocks on your switch fabric. Align TDD patterns across all cells to avoid self‑interference.

Site Survey and Radio Placement

Do a quick predictive plan

You don’t need a full RF consultancy for a small site. Use a floor plan, ceiling heights, and expected aisles to place radios above or between rack blocks. Avoid metal obstructions and place mid‑aisle for better uplink return.

Test before you hang everything

On a portable stand, power a single radio and walk the floor with a test handset. Record RSRP/RSRQ/SINR and throughput at key spots (receiving, end of aisles, dock doors). Adjust height and tilt for best uplink consistency. Uplink is king for scanners and cameras.

Step‑by‑Step Deployment

1) Prepare the core

Deploy Open5GS or a commercial core on a dedicated server (two NICs is nice but not required).
Create your PLMN and APN, define UE IP pool, and enable logs/metrics.
Secure the box: patch OS, limit SSH, and set up backups for your config and SIM data.

2) Provision SIMs

Generate IMSIs and keys (K, OPc). Store them in a password manager or HSM if available.
Write profiles to SIMs with an appropriate programmer, or arrange eSIM profiles with your provider.
Document: IMSI, device owner, device IMEI (optional), and allowed services.

3) Set up the small cell

Mount where you did your test pass. Connect power, network, and GPS/1588 as needed.
Enter or verify precise latitude/longitude and antenna height for SAS registration.
Pick initial channel bandwidth (10 or 20 MHz) and a conservative DL:UL ratio that matches your uplink needs (e.g., 2:1 DL:UL for scanner‑heavy sites).

4) Register with SAS

Create an account with a SAS vendor and register your CBSD details.
Complete the CPI certification step—some vendors facilitate a remote CPI process.
Wait for grant and authorization; confirm the cell is “On Air.”

5) Attach your first devices

Insert a provisioned SIM into a known Band 48‑capable handset or handheld.
Verify it camps on your private PLMN and gets a UE IP from your core.
Run iperf uplink/downlink tests and note RSRP/RSRQ/SINR in field test mode.

6) Integrate applications

Whitelist application servers on your firewall so UEs can reach them.
Map QoS for scanner traffic vs. camera traffic; ensure your LAN respects DSCP/QCI where possible.
Create a simple runbook for device onboarding and replacement.

Device Onboarding That Doesn’t Break

Make the path from box to production painless:

Standardize devices. Stick to two or three handset or handheld SKUs with proven Band 48 support.
Pre‑label SIMs. Associate IMSI ↔ asset ID in your inventory system.
Use MDM. Push APN settings, lock down tethering, and control OS updates that might alter RF behavior.
Test one per batch. When new firmware lands, run it through a walk test before wide release.

Performance Tuning in the Real World

Channels and TDD framing

Start with a single 10–20 MHz carrier and a DL:UL split matched to your traffic. Scanner‑heavy workflows want more UL; camera‑heavy downlink wants the reverse. Keep TDD patterns consistent across cells.

Power and neighbor relations

Too much power can make handovers sticky and hurt uplink. Dial transmit power so cells overlap lightly. Configure neighbor lists so devices hand over proactively down long aisles.

Metrics that matter

Attach success rate and time to attach
Handover success rate and drop causes
PRB utilization (per direction) and CQI distribution
BLER (block error rate), especially uplink
RSRP/RSRQ/SINR heatmaps for coverage validation

Expose core and RAN metrics to Prometheus if your stack supports it, or use vendor dashboards. Keep logs long enough to correlate issues with time of day and workflow spikes.

Security You Can Explain

Private 5G is already strong on access control, but there’s more to do:

SIM secrets: Treat K/OPc like passwords. Rotate if you suspect exposure. Keep enrollment restricted.
Network segregation: Put the core and UE subnets behind ACLs. No blind bridging into enterprise VLANs.
Patch cadence: Core components and radios need periodic updates. Schedule them like you would switches and firewalls.
Audit trails: Preserve attach/detach, SM messages, and APN usage logs to investigate incidents.

Expanding Past the Pilot

Add a second cell the right way

Before hanging more hardware:

Align PCI (LTE) or equivalent cell identities to avoid confusion.
Confirm TDD sync and frame alignment (GPS or PTP) between cells.
Define neighbor relations and handover thresholds for long corridors vs. open floors.

Scale SIM and device ops

Move from ad‑hoc SIM programming to a managed SIM/eSIM lifecycle. Standardize device intake, serialize IMEIs, and automate APN and certificate delivery via MDM.

High availability

For the core, consider an active‑standby pair or a VM cluster with redundant UPFs. For radios, space cells so a single loss doesn’t black out critical areas.

Common Pitfalls and How to Dodge Them

Buying 5G‑only radios when your device fleet is mostly LTE Band 48—check compatibility first.
Ignoring uplink requirements. Cameras and scanners are uplink‑sensitive.
Skipping time sync. Unsynchronized TDD cells interfere with each other.
Overpowering indoor cells, causing sticky handovers and uplink holes behind racks.
Mixing too many vendors across RAN/core/SIM without clear integration ownership.
No SAS plan. CBSDs must be registered and authorized; budget time for CPI.

Regulatory Notes Outside the U.S.

CBRS is U.S.‑specific. Many countries offer similar local‑license options for private networks:

UK: Ofcom Shared Access in 3.8–4.2 GHz
Germany: 3.7–3.8 GHz campus networks
Japan: Local 5G allocations

Rules, power limits, and licensing vary. The general design—small cells, core, SIMs—remains the same.

Troubleshooting Playbook

Phones won’t attach

Verify SIM keys match core subscriber entries.
Check PLMN and APN against device profiles. Some phones need a carrier bundle to expose private APNs.
Confirm SAS authorization and that the cell is transmitting.

Great downlink, terrible uplink

Reduce cell power and improve placement to favor uplink return.
Increase UL slots in your TDD frame.
Check antenna orientation and height; avoid close proximity to metal.

Roaming drops between cells

Fix neighbor lists and handover thresholds.
Verify time sync; desynchronized cells can cause HO failures.
Align vendor software versions across your RAN.

A Realistic Rollout Timeline

Week 1: Requirements, device inventory, vendor shortlist
Week 2: Order hardware/SIMs, line up SAS and CPI
Week 3: Stand up core, program SIMs, bench test
Week 4: Mount first radio, register with SAS, first device attaches
Weeks 5–6: Walk tests, QoS tuning, app integration
Weeks 7–8: Add second cell, handover tuning, create runbooks

When to Choose Managed vs. DIY

Pick managed (turnkey private 5G) if:

You have a hard go‑live date and few in‑house RF skills.
You want one throat to choke for RAN, core, SIMs, and SAS.
Integration with existing IT/OT must be vendor‑supported.

Pick DIY (Open5GS, mixed vendors) if:

You’re piloting on a tight budget and can invest time.
Your team is comfortable with Linux, VLANs, and basic RF testing.
You want to learn and iterate before standardizing.

Future‑Proofing Without Guesswork

Plan for n48 later. Choose radios and cores that support easy NR upgrades.
Document everything. Keep as‑built diagrams, SIM maps, and TDD profiles in version control.
Automate builds. Containerize your core where possible; treat config as code.
Train operators. A short runbook saves nights and weekends when alarms ring.

Summary:

CBRS lets small sites run real private 4G/5G with SAS‑managed spectrum and SIM security.
Start with a minimal viable deployment: one small cell, a simple core, SAS registration, and a handful of SIMs.
Check device compatibility first; LTE Band 48 support is broader than 5G n48 today.
Design conservatively: prioritize uplink, align TDD frames, and keep the network segmented.
Use metrics—attach rates, handovers, PRB utilization, CQI/BLER—to tune performance.
Avoid pitfalls: overpowered cells, neglected time sync, and fragmented vendor stacks.
Scale methodically: add cells with proper neighbor relations and move to managed SIM lifecycle as you grow.