How to Verify a Fixed-IP SIM Reaches Your SCADA Host

Confirm the Assigned Address Matches the Record

Read the address the gateway actually holds from its cellular status page and compare it exactly to the fixed address on record for that SIM. A fixed-IP arrangement only works if the gateway receives the specific address you documented, and a mismatch means either the wrong SIM is in the device or the provisioning assigned a different address than you think. The purpose of the arrangement is described in the guide to a fixed-IP SIM, and confirming the SIM is on the private path at all is the subject of verifying private-APN connectivity.

If the address is wrong, stop and fix the provisioning or the SIM before chasing anything downstream, because every firewall rule and every route you build assumes the documented address. Troubleshooting a routing problem against the wrong address wastes the whole session. Only once the gateway holds exactly the address on record does the rest of the verification mean anything.

Prove the Route Both Ways

Connectivity is directional, so test it both ways. From the gateway, reach the host and confirm a response, which proves the outbound path from the field to your server. Then, from the host side, reach the gateway at its fixed address, because a fixed IP exists precisely so your host or management system can initiate a connection to the device, and that inbound path can be broken even when the outbound one works. A site where the gateway can reach the host but the host cannot reach the gateway has a one-way problem that a single-direction test would miss.

When a direction fails, the fixed address itself is rarely the culprit if it matched the record. The break is almost always a routing rule or a firewall between the carrier's network and your host that does not pass traffic to or from that address. Walk the path: the carrier's private network, any tunnel or peering to your environment, and your own firewall, and confirm each hop permits the fixed address. This is the same kind of path reasoning used in the guide to secure remote access for SCADA, where deliberate rules decide exactly what may reach the device.

Check the Firewall Rules and Record the Path

Inspect the firewall rules that reference the fixed address, because a fixed IP is only useful if your rules actually name it correctly. A rule that permits the wrong address, or a rule order that blocks the intended traffic before the permit is reached, will drop connections to an address that is otherwise perfectly routed. Confirm the rule matches the exact fixed address, allows the specific traffic your SCADA link needs, and sits in the rule order where it will actually take effect.

Record the verified fixed address, the confirmed bidirectional route, and the firewall rules that permit it, so the fixed-IP arrangement is documented rather than tribal knowledge. When a fixed-IP site later stops connecting, the first question is always whether the address changed or a rule was edited, and a recorded path answers it immediately.

Once live, a platform such as Merobix sees the gateway reachable at its fixed address and trends its connectivity, so a fixed-IP site that suddenly becomes unreachable while still holding its address points straight at a routing or firewall change rather than a field fault. The verification proves the path today; the record and the trend are how you tell what changed if it breaks.

Frequently Asked Questions