Check out our data plans here!
Cellular failover solves one problem — keeping a site online when the primary ISP goes down. But it creates another one that most MSPs don’t discover until the first outage: when the wired ISP drops and the UniFi 5G Max takes over, how do you reach the site? If the cellular SIM has a dynamic private IP behind carrier-grade NAT, the answer is: you don’t. The site has internet. Your client’s staff is working. But you — the MSP responsible for that network — are locked out. No SSH, no remote desktop to the UniFi controller, no VPN tunnel to the site’s equipment. A public static IP on the cellular SIM is the fix, and it’s the single most important SIM plan feature for MSPs deploying UniFi cellular at client sites.
Why MSPs Need a Public Static IP on Cellular
When a UniFi network fails over to cellular WAN, the gateway receives a new IP address from the carrier. On a standard consumer or business cellular plan, that IP is typically:
- Private (CGNAT): The carrier assigns a 100.64.x.x address behind carrier-grade NAT. The site can reach the internet, but nothing on the internet can reach the site. VPN tunnels that require inbound connections fail. RMM agents may lose their heartbeat. Direct SSH or HTTPS access to the gateway is impossible.
- Dynamic: Even on plans that do provide a public IP, the address changes every time the modem reconnects. Any firewall rules, DNS records, monitoring checks, or VPN endpoints configured with the old IP break silently — and the MSP doesn’t know the new IP until they can somehow reach the site to check.
A public static IP eliminates both problems. The cellular WAN interface gets a fixed, publicly routable IP address that never changes. The MSP can reach the site directly over the cellular connection, using the same IP every time, regardless of how many times the modem reconnects or how long the cellular failover event lasts.
What a Static IP Enables for UniFi Cellular Deployments
With a public static IP on the UniFi 5G Max’s cellular SIM, the MSP retains full remote access to the client site during cellular failover — and in many deployments, during normal operation as well.
Out-of-Band Management
The entire point of cellular failover for MSPs is out-of-band access. When the primary ISP goes down — fiber cut, ISP billing issue, equipment failure — the cellular connection becomes the only path to the site’s network equipment. With a public static IP, the MSP connects directly to the UniFi gateway via the cellular WAN to diagnose the primary ISP issue, reboot equipment, check logs, and coordinate with the ISP for restoration — all without dispatching a technician.
Without a public IP, the MSP’s only option during an ISP outage is to call someone on-site and walk them through troubleshooting, or drive to the location. For MSPs managing 20, 50, or 100+ client sites, that’s the difference between a 5-minute remote fix and a multi-hour truck roll.
Site-to-Site VPN Continuity
Multi-location businesses often run site-to-site VPN tunnels between offices for shared file servers, ERP systems, security cameras, and internal applications. When one site fails over to cellular, the VPN tunnel drops if the cellular IP is behind CGNAT (no inbound connections) or if the dynamic IP changes and the remote end can’t find the new endpoint.
With a static IP on the cellular SIM, the VPN tunnel re-establishes automatically to the same IP address. WireGuard, IPsec, and OpenVPN endpoints configured with the static cellular IP stay valid through every failover event. For businesses running real-time applications across sites — VoIP, inventory sync, database replication — this continuity is critical.
RMM and Monitoring Agent Connectivity
Most MSPs deploy RMM agents (ConnectWise Automate, Datto RMM, NinjaRMM, etc.) on client workstations and servers that check in to a central management server. These agents are typically outbound-only and survive failover events. But RMM features that require inbound access — remote desktop, remote shell, agent push installs, wake-on-LAN — depend on the MSP being able to reach the site’s network. A public static IP keeps these features functional during cellular failover.
Similarly, monitoring platforms that check service availability via external probes (PRTG, Nagios, Zabbix, Uptime Robot) need a stable IP to monitor. A static cellular IP means monitoring continues seamlessly during failover — the MSP’s NOC sees the site is up on cellular rather than flagging it as offline.
Security Camera and NVR Access
Client sites running UniFi Protect or third-party NVR systems with remote viewing need inbound access for direct camera feeds. Behind CGNAT, remote camera access either fails completely or falls back to cloud relay services that add latency and reduce video quality. A public static IP provides direct, low-latency access to the NVR from the MSP’s NOC or the client’s mobile app — maintaining security monitoring continuity during the exact events (power outages, ISP failures) when camera access matters most.
Firewall and Access Control Consistency
MSPs that use IP-based access controls — allowing management traffic only from known IP ranges — need a predictable IP on the cellular WAN. A dynamic IP requires either opening management access to all IPs (a security risk) or constantly updating firewall rules (an operational burden). A static IP gets added to the allow list once and stays valid permanently.
The Cost of Not Having a Static IP
MSPs who deploy cellular failover without a public static IP discover the problem during the first real outage. The client calls to report their internet is down. The MSP checks remotely — the site’s monitoring shows it as offline because the dynamic cellular IP changed, or CGNAT blocks the monitoring probe entirely. The MSP can’t SSH into the gateway, can’t access the UniFi controller, can’t check if the primary ISP is showing any signs of recovery.
The MSP dispatches a technician. The technician arrives, logs into the gateway locally, and discovers the primary ISP had a brief outage that already resolved itself — the site failed over to cellular and was working the entire time. The MSP just paid for a truck roll that remote access would have prevented.
At 20+ client sites with cellular failover, the annual cost of unnecessary truck rolls far exceeds the cost difference between a standard cellular plan and one with a public static IP.
How ISPTek Solves This for MSPs
ISPTek’s cellular SIM card data plans include a public static IP on every SIM at every plan tier — not as an add-on, not as a premium feature, and not limited to business accounts. Every ISPTek SIM for the UniFi 5G Max, Dream Router 5G Max, or any UniFi cellular device ships with a fixed public IPv4 address that activates the moment the SIM goes live.
- Public Static IP Included on Every Plan: No separate request, no extra monthly charge, no carrier negotiation. The static IP is part of the plan from day one — the MSP adds the IP to their management tools once and never updates it.
- Multi-Carrier Availability: ISPTek static IP SIMs are available on Verizon, AT&T, and T-Mobile. Match each client site to the carrier with the best local coverage — every SIM gets a static IP regardless of carrier.
- Data Pooling Across the MSP Portfolio: Every SIM on the MSP’s ISPTek account shares a single data pool. Client sites using cellular only during rare outages barely touch their allocation — sites with heavy cellular usage absorb the surplus. No per-SIM overage charges, no wasted allocation across the portfolio.
- No Activation or Cancellation Fees: Onboard new client sites instantly — activate a SIM when the UniFi 5G Max Outdoor or indoor unit gets installed, deactivate it if the client churns. No contracts, no minimum terms, no carrier friction slowing down client deployments or decommissions.
- Zero Touch Advanced Security: ISPTek’s network-level protection applies to every SIM automatically — the MSP doesn’t need to configure per-site cellular firewall rules or maintain additional security layers on the cellular WAN interface.
Static IP + Dual-SIM: Full Redundancy With Full Access
The UniFi 5G Max supports two Nano-SIM cards with automatic failover. For MSP deployments where maximum uptime and maximum remote access are both required, populate both SIM slots with ISPTek SIMs on different carriers — each with its own public static IP. If the primary carrier has an outage, the 5G Max switches to the backup SIM, and the MSP reaches the site via the backup SIM’s static IP.
This creates three layers of WAN redundancy: primary wired ISP, cellular carrier A, and cellular carrier B — with the MSP maintaining direct remote access on all three paths. Both ISPTek SIMs share the same data pool, so the backup SIM’s allocation isn’t wasted during the 99% of the time it sits idle.
Which UniFi Cellular Devices Support This?
Every UniFi cellular device works with ISPTek’s static IP SIM plans:
- UniFi 5G Max: Dedicated 5G modem, dual Nano-SIM, pairs with any UniFi gateway. The most common MSP deployment — adds cellular WAN to an existing UniFi stack.
- Dream Router 5G Max: All-in-one gateway with built-in 5G modem, WiFi 7, and UniFi console. Ideal for small client sites where one box handles everything — the static IP on the cellular SIM keeps the entire site manageable remotely.
- UniFi 5G Max Outdoor: Weatherproof outdoor 5G modem for sites with poor indoor signal. Same dual-SIM failover, same ISPTek static IP — mounted outside for maximum cellular performance.
- U-LTE Backup Pro: Budget LTE failover option (AT&T only). If the client site is in an AT&T coverage area and needs basic LTE failover at a lower price point, the U-LTE Backup Pro with an ISPTek static IP SIM provides the same remote access capability on a Cat 4 LTE connection.
Stop Deploying Cellular Without a Static IP
Cellular failover without a public static IP is a half-measure — the client stays online, but the MSP loses visibility and control during the exact events that demand remote access. A static IP turns cellular failover from a client convenience feature into an MSP operational tool: out-of-band management, VPN continuity, RMM access, and monitoring — all maintained through wired ISP outages without truck rolls or on-site intervention.
ISPTek’s cellular SIM card data plans include a public static IP on every SIM, on every carrier, at every plan tier. For MSPs deploying UniFi cellular across client sites, it’s the plan feature that makes cellular failover actually work the way it’s supposed to.
View ISPTek’s static IP data plans and activate your UniFi cellular deployment today.
