How to Verify Private-APN Connectivity on a SCADA SIM
A private APN is supposed to drop your cellular gateway into a walled network that reaches your SCADA host and nothing else, but a SIM that silently falls back to a public APN looks online while quietly bypassing every protection you paid for. Verifying private-APN connectivity means proving three things: the gateway registered on the right APN, it received an address in your private range, and it can reach your host while the open internet stays closed. This procedure is for the technician commissioning a SIM who needs to confirm the private path actually took.
Verify private-APN connectivity on a SCADA SIM in one line: To verify private-APN connectivity, confirm the modem registered on the exact APN name you provisioned, check that the assigned IP falls in your private range rather than a public carrier address, then prove the gateway reaches your SCADA host and cannot reach the open internet. If the APN name is wrong or the address is public, the SIM fell back to a default APN and the private path did not take.
Confirm the Modem Registered on the Right APN
Start at the modem, not the application. Read the active APN from the gateway's cellular status page and compare it character for character against the private APN name you were issued, because a single typo or a leftover default APN will register the SIM on the public network instead. A SIM that connects on the wrong APN still shows a signal and an IP, so a green connection light proves nothing about whether the private path took. The concept of the APN as the setting that decides where your data lands is covered in the explainer on the cellular APN.
If the APN name is blank or wrong, fix it in the gateway configuration and re-register, then reread. Some SIMs are locked to a single APN by the carrier and will only ever attach to the private one, while others accept whatever the gateway sends, so confirming the name at the modem removes the ambiguity. Do not proceed until the active APN matches exactly.
Check the Assigned Address and the Route to Your Host
Read the IP address the carrier assigned the gateway. On a correctly attached private APN it lands in the private range your carrier or integrator defined for your account, and a public, routable carrier address is the tell that the SIM fell back to a default APN. If your account uses a fixed address per SIM, confirm it matches the one on record, since a mismatch means the wrong SIM or the wrong provisioning; the fixed-address arrangement is described in the guide to a fixed-IP SIM.
With the address confirmed, prove the route. From the gateway, reach your SCADA host by its private address and confirm a response, then confirm the gateway cannot reach an arbitrary public destination, because a true private APN blocks the open internet by design. A gateway that reaches both your host and the public internet is not on the private path you intended, even if the APN name looked right. If the host is unreachable but the address is correct, the gap is usually a firewall or routing rule between the carrier's private network and your host rather than the SIM.
Document the Verified Path and Hand It Off
Record the verified APN name, the assigned address or range, the reachable host, and the confirmation that the public internet is blocked. This turns a working SIM into a documented one, so the next person who sees the site online knows it is online through the private path and not by accident on the public network. Note the carrier and any account identifiers so a connectivity ticket can be raised against the right provisioning if the path ever breaks.
A verified private APN is one layer of a hardened site, and it pairs with restricting which destinations the SIM may reach at all, which is the subject of the APN whitelist for SCADA SIMs. Verification proves the path today; the whitelist keeps it narrow.
Once traffic flows, a platform such as Merobix sees the gateway online through the private path and trends its connectivity, so a SIM that later drops its private attachment and fails over to a default APN shows up as a change in the connection rather than a silent security gap. Verifying at commissioning and monitoring afterward is how a private APN stays private.
Frequently Asked Questions
How do I know if my SIM fell back to a public APN?
Two tells: the active APN on the modem status page does not match the private name you provisioned, and the assigned IP is a public, routable carrier address rather than one in your private range. Either sign means the SIM registered on a default public APN, so it looks online while bypassing the private network you intended.
The SIM connects but cannot reach my SCADA host - is the APN wrong?
Not necessarily. If the active APN name and the assigned private address are both correct, the SIM is on the right APN and the gap is usually a firewall or routing rule between the carrier's private network and your host. Verify the APN and address first, then chase the route between the private network and the SCADA server.
Does a green connection light mean the private APN worked?
No. A SIM that falls back to a public APN still registers, shows signal, and lights the connection indicator. The only way to confirm the private path is to read the active APN name at the modem, check the assigned address is in your private range, and prove the gateway reaches your host but not the open internet.
Automation services
Need help turning this into a working system?
Merobix integrates SCADA, programs Allen-Bradley and Siemens PLCs, and designs and fabricates industrial control panels.
Meeting requests are reviewed before confirmation.