How Cambium Networks, GFiber, and Quext delivered a first-of-its-kind X7-35X Wi-Fi 7 MDU deployment
Some projects arrive and you immediately recognize them for what they are: not just a deployment, but a defining moment. When the opportunity to co-architect GFiber’s first managed MDU Wi-Fi deployment came across my desk, I knew within the first technical briefing that this would be one of those projects: complex, ambitious, and without a precise precedent at scale, pushing the boundaries of what is possible in enterprise wireless networking.
I am proud and fortunate to have served as the key technical interface between GFiber, Quext, and Cambium Networks throughout this engagement. The result is a live, production deployment at Pacifica Place, an 896-unit luxury apartment complex in Irvine, California, that represents a new benchmark for managed MDU Wi-Fi in the United States, and a testament to what strong cross-organizational collaboration and disciplined engineering can accomplish.
As covered by Fierce Network in their recent article “GFiber Gets into Bulk-Billing, Managed Wi-Fi Business for MDUs,” this deployment is already attracting industry-wide attention. This blog goes behind the headlines to share the technical architecture, the real engineering challenges we overcame, and the collaborative spirit that made it possible.
The Deployment: Pacifica Place at Irvine Spectrum
Pacifica Place is a newly constructed, 896-unit luxury residential community located within the Irvine Spectrum corridor in Irvine, California. GFiber, in partnership with The Irvine Company, selected this property as the launch site for its managed MDU Wi-Fi offering, a product that delivers dedicated 3 Gbps symmetrical fiber broadband to every individual unit rather than relying on a single shared pipe distributed across the property.
Each unit is served by a home-run fiber connection terminating in a Google Optical Network Terminal (ONT). A Cambium X7-35X Wi-Fi 7 access point, ceiling-mounted in every unit, provides the in-unit wireless layer. Quext, a smart-apartment technology provider, integrates the network with the property’s IoT ecosystem, enabling residents to manage thermostats, lighting, door locks, and access control systems directly over their unit’s Wi-Fi network.
The scope extended beyond individual units. GFiber, Quext, and Cambium also blanketed all community spaces, including the pool area, parking garage, corridors, and amenity zones, with managed Wi-Fi, ensuring residents remain seamlessly connected throughout the property.
The Architecture: Solving for Scale and Security from Day One
From the outset, this deployment presented a set of architectural requirements that, in combination, had no off-the-shelf answer. The engineering team, spanning Cambium, GFiber, and Quext, had to design for three simultaneous imperatives: per-unit network isolation, IoT device integration at the apartment edge, and enterprise-grade security compliance for the 6 GHz band.
Challenge 1: Per-Unit Micro-Segmentation and Re-Architecting the Tunnel Model
A core requirement from GFiber was true per-tenant wireless isolation: ensuring that every resident’s connected devices are logically separated from their neighbors’, even across a shared access infrastructure. To meet it, a conventional tunneling approach would not suffice. The Cambium engineering team had to rethink and re-architect the traditional tunnel model to fit the unique demands of this deployment.
The result is true micro-segmentation at the wireless edge: each resident’s devices operate within their own isolated network segment, with no lateral visibility to other tenants, regardless of the underlying access infrastructure.
The architecture we built is robust, scalable, and purpose-fitted to GFiber’s deployment requirements, and it does not depend on the physical access topology beneath it.
Challenge 2: WPA3-ePSK at Scale Across an 896-Unit Property
Wi-Fi 6 GHz operation mandates WPA3 as a security requirement, with no option to fall back to WPA2 on 6 GHz radios. For a large-scale MDU deployment where every unit has its own provisioned access point and potentially dozens of connected devices, this creates a non-trivial operational challenge: how do you provision, manage, and scale WPA3-ePSK (Enterprise Pre-Shared Key) credentials across hundreds of units without creating an administrative nightmare?
Our solution was to architect the ePSK management workflow entirely within Cambium’s cnMaestro cloud management platform. cnMaestro provides a centralized provisioning pipeline that allows per-unit ePSK credentials to be generated or configured, assigned, and managed at scale. Each unit’s AP is provisioned with a unique ePSK profile, ensuring that even on a shared SSID, each tenant’s connection is cryptographically isolated.
Challenge 3: Solving the SAE-Only Client Problem
One of the most technically nuanced challenges in this deployment surfaced in how wireless clients behave when associating to 5 GHz or 6 GHz BSSIDs on a WPA3-ePSK network. The reality of a large-scale MDU environment is that the wireless client population is highly heterogeneous: smartphones, laptops, smart TVs, IoT sensors, and legacy consumer electronics all coexisting on the same network. And not all of them speak the same security dialect.
The specific problem: a subset of wireless clients, particularly those with specific WPA3 implementations, send only SAE (Simultaneous Authentication of Equals) authentication frames when attempting to associate. On a WPA3-ePSK network, this causes the authentication to fail outright. The client attempts to connect, the AP cannot reconcile the SAE-only request with the ePSK policy, and the association is rejected. For a resident whose device falls into this category, the result is simply: no connection.
This was not an edge case we could dismiss. Across 896 units with potentially thousands of diverse devices, SAE-only clients were an unavoidable reality. The Cambium engineering team developed a solution that gracefully handles SAE-only client authentication on a WPA3-ePSK network. Clients that send only SAE authentication frames are now able to connect successfully, without compromising the security posture or micro-segmentation integrity of the overall deployment. I’m proud that we identified, engineered, and validated this solution in alignment with the GFiber and Quext deployment timeline, without a single day of delay.
The Partnership: What Great Collaboration Looks Like
Technical complexity is, in some ways, the easier part. The harder part, and the part that truly determines whether a project of this scale succeeds, is the quality of collaboration between the organizations involved. I am genuinely proud to say that the partnership between Cambium, GFiber, and Quext on this project set a standard I will carry into every future engagement.
Working alongside the GFiber team was, simply put, a pleasure. Their engineers are sharp, their expectations are high, and their commitment to building a product that genuinely serves residents is evident in every technical conversation. There is something energizing about working with a team that asks hard questions and won’t settle for “good enough.” Every architecture review, every edge case discussion, every whiteboard session pushed the solution to be better. That intellectual rigor from the GFiber side made our engineering work stronger.
Quext brought far more than smart-apartment integration expertise to this engagement; they brought genuine, hands-on capability in wireless deployment and ePSK provisioning within MDU environments. Their team demonstrated a deep understanding of how WPA3-ePSK behaves at the residential edge: the nuances of per-unit credential management, the real-world variability in how residents’ devices onboard to an ePSK-provisioned network, and the practical considerations that only surface when you have deployed at scale across multi-family properties. That operational knowledge was a force multiplier for the overall team. Their understanding of how residents actually interact with connected home technology, including the non-obvious failure modes that arise in production, was invaluable in ensuring that the wireless and IoT integration was not just technically correct, but genuinely seamless from the resident’s perspective. Quext’s deployment experience in MDU wireless is a real differentiator, and it showed throughout this project.
Serving as the central technical interface across all three organizations was one of the most professionally rewarding experiences of my career. It required translating deeply technical wireless networking concepts into product decisions, aligning timelines across teams with different internal pressures, and maintaining clarity of purpose even when the engineering path was uncertain. I am grateful to have had the opportunity to play that role.
Why This Matters for the MDU Industry
Pacifica Place is not just one building. It is a proof point: a repeatable, scalable architecture for managed MDU Wi-Fi.
The architecture we built at Pacifica Place, including the tunnel-based micro-segmentation model, the scalable WPA3-ePSK provisioning pipeline, and the SAE client compatibility solution, is designed to be repeatable and scalable.
For the MDU Wi-Fi industry more broadly, this deployment signals several important directions: the move from best-effort shared Wi-Fi to per-unit dedicated fiber with managed wireless; the operationalization of WPA3 and 6 GHz at residential scale; and the growing importance of IoT-aware network design in multi-family residential environments.
Cambium Networks’ X7-35X Wi-Fi 7 access points and cnMaestro management platform were purpose-built for exactly this kind of deployment: high-density, high-security, and centrally managed at scale. I believe this is a model that will define how managed MDU Wi-Fi is delivered across the country.
Closing Thoughts
I began this project knowing it would be complex. What I didn’t fully anticipate was how much I would learn from the teams I worked alongside, and how much satisfaction would come from solving problems that, at the outset, had no obvious answers. The WPA3-ePSK SAE client challenge alone pushed our team to innovate in ways that I believe will benefit future deployments far beyond Irvine.
To the GFiber and Quext teams: it was an honor and a genuine pleasure. I look forward to what we build next.
For further reading on the commercial context of this deployment, I recommend the Fierce Network article: “GFiber Gets into Bulk-Billing, Managed Wi-Fi Business for MDUs” (Fierce Network, June 22, 2026).
Key Takeaways
- First managed MDU build for GFiber — A live, production Wi-Fi 7 deployment across 896 units at Pacifica Place in Irvine, California.
- Per-unit isolation — A re-architected tunnel model delivers true micro-segmentation at the wireless edge, with no lateral visibility between tenants.
- WPA3-ePSK at scale — cnMaestro centralizes per-unit credential provisioning so every unit receives a unique, cryptographically isolated profile.
- SAE-only client fix — A purpose-built solution lets SAE-only WPA3 clients connect without weakening security or segmentation.
- Repeatable model — The architecture is designed to scale beyond one property to managed MDU Wi-Fi nationwide.
Building managed Wi-Fi for multi-dwelling units?
See how the Cambium X7-35X Wi-Fi 7 access point and cnMaestro deliver secure, per-unit connectivity at scale.
Explore the X7-35XAbout the Author
Azif Abdul Salam is a Director of Solutions Engineering at Cambium Networks, specializing in cnMaestro, Intent-Based Networking (IBN), and MDU/Hospitality Wi-Fi solutions. He holds multiple Wi-Fi patents and works across technical architecture, customer deployments, product design, and cross-functional collaboration with engineering and field teams.