3G/4G Cellular Failover with USB Modems

Last updated
Save as PDF

The USB port in a MX device can be used for connecting a 3G / 4G USB modem. Traffic will be automatically redirected to the 3G / 4G interface in the event of a connectivity failure with the WAN interfaces.

USB modems with MX/Z series devices running firmware MX 18 or newer will be limited to best effort support and will not be receiving any future firmware fixes or improvements.

If you have 2 active WAN interfaces, 3G / 4G failover will kick in when both WAN connections fail.

Cellular modems are not compatible with M-Z devices in passthrough mode.

Information regarding the built-in cellular modem behavior on the MX67C, MX68CW, and Z3C can be found in the MX67 and MX68 Overview and Specifications as well as the Z3C Overview and Specifications.

Preparing the USB modem

Please follow the guidelines provided by your wireless carrier to enable and test the USB modem. Once you've validated that you can use the USB modem to connect to Internet from your own PC or Mac, you can directly plug the USB modem into the MX-Z appliance.

For example, use the VZAccess Manager software on a PC or Mac to activate and test a Verizon USB modem.

Setting Up a Cellular Modem as an Uplink

Please note that upon first-time bootup and connection to the Meraki Cloud, an ethernet WAN connection must be used to download the initial configuration and get the device online the first time.

Having an MX-Z appliance use a cellular modem to attempt to make its first connection to the Meraki Cloud is not a supported configuration. Additionally, upon first connection to the Meraki dashboard, MX devices should not be connected to USB modems / internal SIMs at all. This is because the cellular service will restart constantly if a connection cannot be established, leading to MX instability which will prevent the initial firmware upgrade from completing successfully.

It is considered best practice to do the following in order:

First connect the MX-Z appliance to the Meraki Cloud and make sure it comes up online.
Test the USB modem to ensure it can connect to the Internet/provider.
Connect the cellular modem and verify that the cellular modem WAN uplink comes online in dashboard.
To test failover to the cellular modem, disconnect the ethernet WAN connection and verify connectivity.

Username and Password

The MX-Z Security Appliance series does not support usernames and passwords for cellular modems at this time. If the modem requires a username and/or password, then the MX-Z will not successfully connect. Ensure that this feature is disabled on the modem during setup.

Cellular Modem States

The cellular modem states can be seen on the Security & SD-WAN > Monitor > Appliance status page.

Connecting: This state means that the modem has been recognized and the MX-Z is trying to establish a persistent connection with the 3G/4G provider.
Ready: This state means that the MX-Z has established the connection with the 3G/4G provider was able to successfully send/receive data with Meraki dashboard with the cellular interface. The MX-Z is ready for failover to the 3G/4G connection.
Active: This state means that the MX-Z has detected a WAN failover and switched the internet connection to the 3G/4G card.

If none of these states are displayed on the Appliance status page, the modem is not recognized by the MX. Cellular modems are identified by the USB IDs they present when connected. In some cases it is possible for compatible modems to not be recognized by the MX due to specific manufacturing practices that result in a different, unexpected USB IDs being used by the modem in question.

Signal Strength Indicator

If a cellular modem is capable of reporting signal strength to the appliance it is attached to, the dashboard will display it in a count of one to five bars, corresponding with the following values:

Bars	Signal Strength (dBm)
1	≤ -102
2	-93
3	-87
4	-78
5	≥ -40

Cellular Firewall Rules and Bandwidth Limits

In addition to existing firewall rules and bandwidth restrictions, MX-Z supports specific firewall rules and bandwidth limit that apply only when the cellular connection is active. These rules are applied in addition to existing firewall rules and bandwidth limits, rather than replacing them. Cellular firewall rules are configured on the Firewall page, while cellular bandwidth limits are configured on the Traffic Shaping page.

The bandwidth limit for cellular connections applies to the total network throughput limit and not per-client throughput limit.

The cellular firewall rules and bandwidth settings do not override the existing firewall rules and bandwidth settings.
The cellular bandwidth settings do not affect the bandwidth for the communication between the MX-Z and the Meraki dashboard. The MX-Z will continue to receive periodic updates from the dashboard for firmware updates and security signatures.

Verifying Connectivity

You'll also be able to confirm the 3G / 4G connectivity status through the Dashboard, on the Security & SD-WAN > Monitor > Appliance Status page.

The MX does not support IPv6 through a USB cellular modem.

Compatible USB Modems

Note: Note that if a cellular modem has a USB ID different than the one listed here, it will not be compatible.

Current Modems

USB modems with MX/Z series devices running firmware MX 18 or newer will be limited to best effort support and will not be receiving any future firmware fixes or improvements.

We recommend upgrading to the integrated/MG models for cellular connectivity and reaching out to your sales contact.

End of Sale Modems

These modems are compatible on MX and/or Z-Series appliances, but are no longer available for sale from their respective carriers or manufacturers.

Note: Meraki Support continues to provide assistance for End of Sale modems, but ultimately, if the modems are no longer supported by their vendor, Meraki is limited to basic troubleshooting.

Region	Wireless Carrier	USB Modem	Interfaces	MX	Z	USB ID
USA	Verizon	Connected IO LT1000	4G only	✔	✔	1199:68c0
		Inseego Skyus-DS 4G XLTE (MC7354)	4G only	✔	✔	1199:68c0
		Inseego Skyus 4G LTE (MC7354)	4G only	✔	✔	1199:68c0
		Connected IO EM1000T-VZ-CAT1 *	4G only	✔	✔	1bc7:0036
	AT&T	Inseego Skyus-DS 4G XLTE (MC7354)	4G only	✔	✔	1199:68c0
		Inseego Skyus 4G LTE (MC7354)	4G only	✔	✔	1199:68c0
		Connected IO EMT1000T-NA-CAT1 *	3G and 4G	✔	✔	1bc7:0036
		ConnectedIO EM1000T-NA*	3G and 4G	✔	✔	1bc7:1201
		Velocity USB Stick *	3G and 4G	✔		19d2:1225
		Unite Explore *	3G and 4G	✔		0846:68e1
	Sprint	Inseego Skyus-DS 4G XLTE (MC7354)	4G only	✔	✔	1199:68c0
	T-Mobile	Inseego Skyus-DS 4G XLTE (MC7354)	4G only	✔	✔	1199:68c0
		Inseego Skyus 4G LTE (MC7354)	4G only	✔	✔	1199:68c0
		Connected IO EMT1000T-NA-CAT1 *	3G and 4G	✔	✔	1bc7:0036
		ConnectedIO EM1000T-NA*	3G and 4G	✔	✔	1bc7:1201
	US Cellular	Inseego Skyus-DS 4G XLTE (MC7354)	4G only	✔	✔	1199:68c0
Canada	Rogers	Inseego Skyus-DS 4G XLTE (MC7354)	4G only	✔	✔	1199:68c0
	Bell	Inseego Skyus-DS 4G XLTE (MC7354)	4G only	✔	✔	1199:68c0
Europe	Any	Inseego Skyus-DS 4G (MC7304)	4G only	✔	✔	1199:68c0
	Any	ConnectedIO EM1000T-EU*	3G and 4G	✔	✔	1bc7:1201
Global	Any	Huawei E3276s-150 and E3276s-500	3G and 4G	✔	✔	12D1:14DB 12D1:1F01
		Huawei E3372s-153	3G and 4G	✔	✔	12D1:1506 12D1:14AC 12D1:14C1

USA	Verizon	Inseego (Novatel) 4G LTE USB Modem USB620L	4G only	✔	✔	1410:9020
		Pantech 4G LTE USB Modem UML295	3G and 4G	✔	✔
		Inseego (Novatel) Wireless Global Modem USB730L *	4G	✔	✔	1410:9030
	AT&T	NetGear AirCard 340U (AT&T Beam)	3G and 4G	✔	✔	1199:9051
		Sierra Wireless AirCard® 313U	3G and 4G	✔	✔
	Sprint	NetGear AirCard 341U	3G and 4G	✔	✔
		Sierra Wireless 3G / 4G USB Modem 250U	3G only	✔
Canada	Rogers	Sierra Wireless AirCard 330U	3G and 4G	✔	✔
Australia	Telstra	Sierra Wireless AirCard 320U	3G and 4G	✔		1199:68a3
	Optus	Sierra Wireless AirCard 320U	3G and 4G	✔		1199:68a3
Global	Any	Huawei E372	3G only	✔	✔	12D1:1506 12D1:14AC 12D1:14C1
		Huawei E367	3G only	✔	✔	12D1:1446 12D1:14AC 12D1:150C
		Huawei E392	3G and 4G	✔	✔	12D1:1505 12D1:1506 12D1:14FE

( * ) - Modem is not compatible with MX models released after 2017

Modem Setup Caveats

About Pantech 4G LTE USB Modem UML295

The setup process for the Pantech UML 295 is considerably different than for prior Verizon cellular modems. First, connect the UML 295 to a PC or Mac and wait until you get a DHCP lease on your computer (this may take some time). Once you have a DHCP lease from the UML 295 modem, follow these steps to connect to the internet:

Go to http://mbb.vzw.com/ or http://192.168.32.2/
Open the Menu.
Go to the Settings tab, and enable "Auto connect except roaming" for the Device connection preference option under the Connectivity > 4G LTE tab.
Confirm you can browse the Internet (hint: http://speedof.me/ is a great modem speed test site).

About Huawei Modems

With Huawei modems it is important that the hardware inside the modem (USB ID) matches exactly to the hardware/USB ID matrix above. Huawei tends to package different hardware inside different models (ie. you could have two 3372 modems each with different USB ID's/hardware inside).

To find the USB ID connect the modem to a Mac laptop. Click on the apple icon in the upper left > About This MAC > System Report > Hardware > USB > [select USB card].

The format of the above USB IDs is <Vendor ID>:<Product ID>. Ex. 12D1 is the Vendor ID for Huawei and 1506 is the product ID of the hardware inside the modem.

It is also possible to view the USB ID on Windows computers via the Device Manager. On Windows 10 simply search for and open "Device Manager" on the Start menu.
Find the USB modem in the list > Right-click on the modem > Select Properties > Choose the Details tab > Select Hardware Ids from the property list.
On Windows, the example from above would display as "USB\VID_12D1&PID_1506".

Huawei modems have been tested with a number of carriers worldwide and should work with any cellular carrier.

Make sure that the SIM card PIN is deactivated. You may need to put the SIM card on a mobile phone and manually disable the pinlock, before inserting it back into the Huawei modem.

Please reach out to Meraki support in case your local wireless carrier is not recognized.

About AT&T Beam (AC340U) Modems

Due to the design of the AC340U, it is recommended that the included USB extension cable be used to connect the AC340U to the MX or Z1. This helps to avoid intermittent issues that can result from poor physical connectivity.

About Custom APNs

If a custom APN is required by your carrier, please contact support to have the APN applied.

Data Usage on Standby Cellular Uplink

When using a cellular modem as a redundant uplink connection on an MX-Z Security Appliance, there will still be a small amount of traffic over that connection, even though it is not being used for client traffic.

When the Modem Isn't Active (Not Used for Client Traffic)

As of MX 10.11 + firmware, due to usage concerns on the cellular network, the MX will not perform any uplink connectivity tests until the link becomes active.

When the Modem is Active (Used for Client Traffic)

Any client traffic and general communication with the Cloud Controller will be sent over the cellular link. Any Dashboard tools that require loading live data from the device, such as traffic graphs, will also produce increase cellular usage.