Home > Security Appliances > Cellular > 3G - 4G Cellular Failover

3G - 4G Cellular Failover

The USB port in an MX-Z device can be used for connecting a 3G / 4G USB modem. Traffic will be automatically redirected to the 3G / 4G interface in the event of a connectivity failure with the WAN interfaces.

If you have 2 active WAN interfaces, 3G / 4G failover will kick in when both WAN connections fail.

Cellular modems are not supported with MX-Z devices in passthrough mode.

Preparing the USB modem

Please follow the guidelines provided by your wireless carrier to enable and test the USB modem. Once you've validated that you can use the USB modem to connect to Internet from your own PC or Mac, you can directly plug the USB modem into the MX-Z appliance.

For example, use the VZAccess Manager software on a PC or Mac to activate and test a Verizon USB modem.

Using a Cellular Modem as a Primary or Single Uplink

Please note that upon first-time bootup and connection to the Meraki Cloud, an ethernet WAN connection must be used to download the inital configuration and get the device online the first time. Having an MX-Z appliance use a cellular modem to attempt to make its first connection to the Meraki Cloud is not a supported configuration.

It is considered best practice to do the following in order:

  1. First connect the MX-Z appliance to the Meraki Cloud and make sure it comes up online
  2. Test the USB modem to ensure it can connect to the internet/provider
  3. Connect the cellular modem and verify that the cellular modem WAN uplink comes online in dashboard
  4. Disconnect the ethernet WAN connection and verify connectivity
  5. Move the MX-Z appliance to the desired location and bring the MX-Z appliance online using only the cellular modem WAN uplink

Username and Password 

The MX-Z Security Appliance series does not support usernames and passwords for cellular modems at this time. If the modem requires a username and/or password, then the MX-Z will not successfully connect. Ensure that this feature is disabled on the modem during setup.

Cellular Modem States

The cellular modem states can be seen on the Security Appliance > Monitor > Appliance status page.

  • Connecting: This state means that the modem has been recognized and the MX-Z is trying to establish a persistent connection with the 3G/4G provider.
  • Ready: This state means that the MX-Z has established the connection with the 3G/4G provider was able to successfully send/receive data with Meraki dashboard with the cellular interface. The MX-Z is ready for failover to the 3G/4G connection.
  • Active: This state means that the MX-Z has detected a WAN failover and switched the internet connection to the 3G/4G card.

Signal Strength Indicator

If a cellular modem is capable of reporting signal strength to the appliance it is attached to, the dashboard will display it in a count of one to five bars, corresponding with the following values:


Bars Signal Strength (dBm)
1 ≤ -102
2 -93
3 -87
4 -78
5  ≥ -40

Cellular Firewall Rules and Bandwidth Limits

In addition to existing firewall rules and bandwidth restrictions, MX-Z supports specific firewall rules and bandwidth limit that apply only when the cellular connection is active. These rules are applied in addition to existing firewall rules and bandwidth limits, rather than replacing them. Cellular firewall rules are configured on the Firewall page, while cellular bandwidth limits are configured on the Traffic Shaping page.


The bandwidth limit for cellular connections applies to the total network throughput limit and not per-client throughput limit.

  1. The cellular firewall rules and bandwidth settings do not override the existing firewall rules and bandwidth settings.
  2. The cellular bandwidth settings do not affect the bandwidth for the communication between the MX-Z and the Meraki dashboard. The MX-Z will continue to receive periodic updates from the dashboard for firmware updates and security signatures.

Verifying Connectivity

You'll also be able to confirm the 3G / 4G connectivity status through the Dashboard, on the Security Appliance > Monitor > Appliance Status page.

Supported USB Modems

Region Wireless Carrier USB Modem Interfaces MX Z-Series Supported USB IDs
USA Verizon Novatel 4G LTE USB Modem USB620L 4G only -
Novatel 4G LTE USB Modem USB730L 4G only -

Connected IO LT1000

4G only -
Connected IO EM1000T-VZ-CAT1 4G only -
Feeney Skyus-DS 4G XLTE (MC7354) 4G only -
Feeney Skyus 4G XLTE (MC7354) 4G only -
Pantech 4G LTE USB Modem UML295 3G and 4G -
Pantech 4G LTE USB Modem UML290 3G and 4G -
Feeney Skyus-DS 4G XLTE (MC7354) 4G only -

Feeney Skyus 4G LTE (MC7354)

4G only -
NetGear AirCard 340U (AT&T Beam) 3G and 4G -
Sierra Wireless AirCard® 313U 3G and 4G -
Connected IO EM1000T-NA 3G and 4G -
Connected IO EM1000T-NA-CAT1 3G and 4G -
Velocity USB Stick MF861 3G and 4G  
Netgear Unite Explore 815S 3G and 4G  


NetGear AirCard 341U

3G and 4G -
Sierra Wireless 3G / 4G USB Modem 250U 3G only   -
Feeney Skyus-DS 4G XLTE (MC7354) 4G only -
T-Mobile Feeney Skyus-DS 4G XLTE (MC7354) 4G only -
Feeney Skyus 4G LTE (MC7354) 4G only -
Connected IO EM1000T-NA 3G and 4G -
Connected IO EM1000T-NA-CAT1 3G and 4G -
U.S. Cellular Feeney Skyus-DS 4G XLTE (MC7354) 4G only -
Canada Rogers Feeney Skyus-DS 4G XLTE (MC7354) 4G only -

Sierra Wireless AirCard 330U

3G and 4G -
Bell Feeney Skyus-DS 4G XLTE (MC7354) 4G only -
Australia Telstra Sierra Wireless AirCard 320U 3G and 4G   -
Optus Sierra Wireless AirCard 320U 3G and 4G   -
Global Any Feeney Skyus-DS 4G (MC7304 - Europe Only) 4G only -
Any Huawei E372 3G only




Any Huawei E367 3G only




Any Huawei E392 3G and 4G




Any Huawei E3276s-150 and E3276s-500 3G and 4G



Any Huawei E3372s-153 3G and 4G





About Pantech 4G LTE USB Modem UML295

The setup process for the Pantech UML 295 is considerably different than for prior Verizon cellular modems. First, connect the UML 295 to a PC or Mac and wait until you get a DHCP lease on your computer (this may take some time). Once you have a DHCP lease from the UML 295 modem, follow these steps to connect to the internet:

  1. Go to http://mbb.vzw.com/ or
  2. Open the Menu.
  3. Go to the Settings tab, and enable "Auto connect except roaming" for the Device connection preference option under the Connectivity > 4G LTE tab.
  4. Confirm you can browse the Internet (hint: http://speedof.me/ is a great modem speed test site).

About Huawei Modems

With Huawei modems it is important that the hardware inside the modem (USB ID) matches one of the USB ID's in the list above (regardless of the model number itself) as Huawei tends to package different hardware inside different models (ie. you could have two 3372 modems each with different USB ID's/hardware inside).

To find the USB ID connect the modem to a Mac laptop.  Click on the apple icon in the upper left > About This MAC > System Report > Hardware > USB > [select USB card]

The format of the above USB IDs is <Vendor ID>:<Product ID>.  Ex.  12D1 is the Vendor ID for Huawei and 1506 is the product ID of the hardware inside the modem

Huawei modems have been tested with a number of carriers worldwide and should work with any cellular carrier.

Make sure that the SIM card PIN is deactivated. You may need to put the SIM card on a mobile phone and manually disable the pinlock, before inserting it back into the Huawei modem.

Please reach out to Meraki support in case your local wireless carrier is not recognized.

About AT&T Beam (AC340U) Modems 

Due to the design of the AC340U, it is recommended that the included USB extension cable be used to connect the AC340U to the MX or Z1. This helps to avoid intermittent issues that can result from poor physical connectivity.

About Custom APNs

If a custom APN is required by your carrier, please contact support to have the APN applied.

Data Usage on Standby Cellular Uplink

When using a cellular modem as a redundant uplink connection on an MX-Z Security Appliance, there will still be a small amount of traffic over that connection, even though it is not being used for client traffic. 

When the Modem Isn't Active (Not Used for Client Traffic)

An ICMP ping will be sent over the cellular connection every 60 seconds to ensure the modem remains available, should it be needed in the event of wired uplink failure. This keep-alive traffic should be less than 9MB total per month. Signal strength and status are determined locally by the modem with no traffic sent over the cellular network.

Note: Dependent on modem and carrier, other communication may occur between the modem and the tower/network. However, this traffic is not generated by the MX-Z.

As of MX 10.11+ firmware, the 60 second ping has been turned off due to usage concerns on the cellular network.

When the Modem is Active (Used for Client Traffic)

Any client traffic and general communication with the Cloud Controller will be sent over the cellular link. Any Dashboard tools that require loading live data from the device, such as traffic graphs, will also produce increase cellular usage.


Last modified



This page has no classifications.

Other Languages

Explore the Product

Click to Learn More

Article ID

ID: 4130

Explore Meraki

You can find out more about Cisco Meraki on our main site, including information on products, contacting sales and finding a vendor.

Explore Meraki

Contact Support

Most questions can be answered by reviewing our documentation, but if you need more help, Cisco Meraki Support is ready to work with you.

Open a Case

Ask the Community

In the Meraki Community, you can keep track of the latest announcements, find answers provided by fellow Meraki users and ask questions of your own.

Visit the Community