For roof installations,
The drop cable shield must be bonded to the building grounding system at its top entry point (usually on the roof).
The drop cable shield must be bonded to the building grounding system at the entry point to the equipment room.
For more info - refer “Lightning Surge Protection Units (LPU)” section in 60GHz cnWave User Guide Release 1.3.3.pdf (page 67)
(https://support.cambiumnetworks.com/files/60ghz-cnwave/)
Important: If you plan this port to support 1Gbps, then you could use cambium surge suppressor. But if you desire to support >1Gbps then you may want to look at Procet PT-PR01B-10GOT.
Please let me know if you need further clarification (prasanna.tm@cambiumnetworks.com)