IoT SIM with private APN, contractable today

Dedicated APN with your CIDR range and an IPSec or WireGuard tunnel into your VPC, offered as a standard layer over any plan. No need to go through enterprise sales: pilot on 5 SIMs, scale once the case is validated. Combinable with private static IP in the same plan.

When private APN stops being optional

There are architectures where private APN isn't a comfort upgrade but a functional or regulatory requirement. The most frequent in Spain:

The cloud or DC operator determines the options: AWS recommends policy-based or BGP-based IPSec; Azure supports route-based IPSec; GCP Cloud VPN offers HA-VPN with BGP. We've integrated with all the majors; the technical team configures the tunnel from your side during onboarding.

Typical use cases in Spain

• Electricity SCADA (DSO, telemanagement)
• Municipal water metering
• SD-WAN routers for multi-store retail
• Video surveillance cameras with on-prem VMS
• Bank POS and payment terminals with central back-office
• EV charging stations with inbound OCPP
• Alarms connected to monitoring center (CRA)
• Industrial sensing with proprietary platform

Frequently asked questions about private APN for IoT SIM

Is there a volume minimum to contract private APN?

No. A single SIM can carry shared APN as an add-on. For dedicated APN, the recommended minimum is 25–50 SIMs for operational economy, but not as a technical or commercial restriction; we also configure it for smaller fleets if the case justifies. This is the difference vs enterprise competitors (Telefónica Tech, 1NCE) that require 500+ SIMs and an annual contract.

Which clouds do you support (AWS / Azure / GCP / OVH)?

We've integrated IPSec tunnels against AWS (Site-to-Site VPN policy-based or BGP-based), Azure (VPN Gateway route-based), Google Cloud (Cloud VPN or HA-VPN with BGP), OVH and on-prem (pfSense, FortiGate, Cisco ASA, Mikrotik). If your DC runs something different, we likely support it — drop us an email.

IPSec or WireGuard, which do we pick?

IPSec if your corporate DC or cloud requires site-to-site IPSec (the most common in enterprise). WireGuard if you want simplicity and performance (and your side supports it). Functionally equivalent for most cases; the decision depends more on what your firewall supports than on our technical preference. We discuss it during technical onboarding.

How long does tunnel provisioning take?

For shared APN, first provisioning in 24 h once we receive your side's technical documentation (peer IP, CIDR to advertise, IPSec policy). For dedicated APN, 48–72 h. For enterprise with BGP-over-IPSec and custom config, up to a week. Compared to the typical 3–4 weeks of enterprise competitors, it's the difference between a fast pilot and a quarterly integration.

How do I integrate the APN with my corporate VPN?

The IPSec/WireGuard tunnel is established between your peer (corporate firewall or cloud VPN gateway) and our GGSN. The SIMs receive IPs from the CIDR you indicated; your corporate firewall rules treat that range as its own subnet. If you already have site-to-site VPN between cloud and on-prem, the SIMs are just another branch of the IGP routing.

Compatible with private static IP?

Yes, and it's the standard combination for industrial deployments. The private APN tunnels traffic, the static IPs inside the APN give each SIM stable, predictable addressing. Both add-ons contracted per SIM on the same base plan. Detail at /productos/sim-ip-fija.

Does it support tunnel failover?

Yes, on enterprise plans. We configure two active-passive or active-active tunnels against two peers of yours (typically cloud + on-prem, or two cloud regions). If one drops, SIMs route through the other without disruption. On shared or dedicated-basic APN, single tunnel.

Monthly cost of dedicated APN?

Fixed monthly fee that scales smoothly with the number of SIMs and the mode (shared/dedicated/enterprise). Calculable on-demand from the portal: enter your estimated volume and mode, and you see the cost before contracting. No lock-in.

Difference vs the enterprise APN of a single carrier?

Three things. (1) Multi-IMSI: even with private APN, the SIM keeps failover across the three national carriers (Movistar, Vodafone, Orange) in Spain, with no single point of failure. (2) Commercial model: on-demand from pilot, not enterprise bottleneck. (3) Cost: at equivalent functionality, typically 30–60 % cheaper than Telefónica Tech or Vodafone Business dedicated APN for medium-sized fleets.