A cellular backup link that won't dial, or dials and then keeps dropping, is the kind of fault you only notice on the one day the primary WAN is already down. This is the diagnostic order that finds it fastest — modem, SIM, signal, profile and authentication, in that order — plus the exact commands and the field cases behind them.
By the AtlasCommTech engineering team — 13 years of carrier & enterprise network deployments · Updated July 2026
Cellular backup is invisible right up until the primary WAN goes down — and that's exactly the moment you don't want to be improvising a diagnosis order.
A 4G/5G cellular link that won't call out, or connects and then flaps, comes up constantly on branch routers, unattended cabinets, and — increasingly — solar-powered off-grid sites where a cellular modem is the only uplink there is at all. The dial parameters can look completely correct and the call still fails, because the fault sits earlier in the chain: whether the modem is actually detected, whether the SIM is actually ready, whether there's usable signal at all, whether a dial profile even exists, and only then whether the authentication the profile carries matches what the operator expects.
What follows is the fault tree this is built on, the checks for each stage with the exact commands to run, six root causes pulled from real field cases — including the classic case where a link-health probe itself is what causes the flapping — and six FAQ answers pulled from actual deployments.
Cellular backup failures split into exactly two shapes: the link never dials at all, or it connects and then something's still wrong.
Placing the symptom on this tree first tells you which stage below actually applies — there's no point checking APN authentication if the modem itself isn't even present.
Diagram labels are kept in English for engineering clarity.
Signal, SIM and profile issues account for almost every dial failure; once the link is up, flapping and throughput complaints are usually a probing or power-save interaction rather than the radio link itself. If you're deploying this for the first time rather than debugging one already in the field, our wired-primary with 4G-backup deployment guide covers the planning and failover side of the same setup.
Five stages, five different things to check — in this order, because a later stage can look broken when it's really an earlier one.
Before anything else, confirm the router even sees the modem — everything downstream depends on Modem State reading Present.
<Huawei> display interface cellular 0/0/0
Cellular0/0/0 current state : UP
Line protocol current state : UP (spoofing)
Description:HUAWEI, AR Series, Cellular0/0/0 Interface
Route Port,The Maximum Transmit Unit is 1500
Internet Address is negotiated, 192.168.70.94/32
Link layer protocol is PPP
LCP opened, IPCP opened
Modem State: Present
// Not present -> the modem is not seated; reseat or replace itSIM cards on these modules don't support hot-plugging — a card inserted after the router is already powered won't be recognized without a modem restart.
[Huawei]display Cellular 2/0/0 security
Modem State:
Modem Security Information.
==========================
SIM ID = 2
PIN Verification = Unknown
PIN Status = Unknown
SIM Status = Not insert
// physically seated but still shows Not insert -> SIM cards are not hot-pluggable
[Huawei]interface Cellular 2/0/0
[Huawei-Cellular2/0/0]modem reboot
Warning: The module will reboot. Continue? [Y/N]:yConfirm there's actually usable network coverage before touching any dial configuration at all.
[Huawei] display Cellular 2/0/0 all
Network Information.
====================
Current Service Status = Service available
Packet Service = Attached
Current Network Connection = LTE(LTE)
Radio Information.
==================
Current Band = B3
Current RSSI >= -51 dBm
Current RSRP = -70 dBm (strong)
Current RSRQ = -4 dB
Current SINR = 24 dBOn WCDMA networks in particular, the APN profile has to be created explicitly — it isn't generated for you.
[Huawei] display Cellular 2/0/0 all
Profile Information.
====================
Profile 1 = UNDEFINED
--------
* - Default profile
// UNDEFINED -> no profile configured yet, needs to be created
[Huawei] apn profile 3gprofile1
[Huawei-apn-profile-3gprofile1] apn 3GNET
[Huawei-apn-profile-3gprofile1] user name 3guser1 password cipher <password> authentication-mode autoA profile that exists but authenticates with the wrong method, username or password fails silently at the authentication step, not at the dial step.
<Huawei> display apn-profile configuration
--------------------------------------------------------------------------------
profile-name :ctvpdn
apn :ltenet1
user-name :user1
authentication-mode:chap
sim-id :1
[Huawei-diagnose] clear wwan-t 2 0
[Huawei-diagnose] at 2 0 "+QICSGP=1"
[Huawei-diagnose] display wwan-t 2 0
+QICSGP: 1,1,"ctvpdn","user1","12345678",1
OK
// compare the APN/user/password actually sent against the profile you configuredIf the stages above all check out and dialing still fails, the failure-reason log usually names the exact rejection cause.
[Huawei-diagnose] display call failure reason 0 0 10
Index=0000, start time[0928 2025 12:48:09]end time[0928 2025 12:48:09]
SlotID=00, PortID=00, Channel=00, Apn=[lte]
ErrorCode=4, RSSI=0(0~31), OccurNum=1, RebootNum=0
Reason=[No service]
Index=0001, start time[0925 2025 19:33:27]end time[0928 2025 12:47:56]
SlotID=00, PortID=00, Channel=00,
ErrorCode=1001, RSSI=0(0~31), OccurNum=3, RebootNum=0
Reason=[Rejected by the network(cause:#1)]Once the five stages above have told you where the problem sits, these six account for most of what's actually wrong — including the classic case where the health check itself causes the flapping.
SYMPTOMSIM Status shows Not insert even though a SIM is physically seated in the slot.
CAUSESIM/USIM/UIM cards on these modules aren't hot-pluggable. Inserting one while the router is already powered on doesn't get picked up automatically — the modem needs to reinitialize before it will recognize the card.
FIXRemove the data card, seat the SIM correctly (notch orientation matching the slot), reinsert the data card, then reboot the modem from the Cellular interface view.
[Huawei]interface Cellular 2/0/0
[Huawei-Cellular2/0/0]modem reboot
Warning: The module will reboot. Continue? [Y/N]:ySYMPTOMProfile Information shows Profile 1 = UNDEFINED, and dialing never even attempts authentication.
CAUSEOn WCDMA specifically, unlike some other connection modes, the APN profile has to be created by hand — there's nothing to authenticate the dial attempt against until one exists.
FIXCreate the APN profile with the exact APN value issued by the operator, and apply it to the Cellular interface before expecting a successful dial.
Profile Information.
====================
Profile 1 = UNDEFINED
[Huawei] apn profile 3gprofile1
[Huawei-apn-profile-3gprofile1] apn 3GNETSYMPTOMThe cellular interface goes Up/Down repeatedly, even though the physical link and the router are both fine.
CAUSEWith modem auto-recovery track nqa ... probe-cycle 1 paired with fail-times 1, a single failed ICMP probe during a brief signal dip triggers an immediate PLMN re-search. If the NQA test's own automatic run interval (frequency) is shorter than the time that re-search takes, a fresh failure signal arrives before the previous recovery attempt even finished — and the cycle repeats indefinitely.
FIXIncrease probe-cycle so a single blip doesn't trigger recovery, and set the NQA test's frequency comfortably larger than interval times probe-count (interval defaults to 4 seconds; keep probe-count around 3-4 and frequency generously larger) so ICMP tests can't overlap and interfere with each other.
<Router A> system-view
[Router A] interface cellular 0/0/0
[Router A-Cellular0/0/0] modem auto-recovery track nqa admin Cellular1 probe-cycle 4
[Router A-Cellular0/0/0] quit
[Router A] nqa test-instance admin Cellular0/0/1
[Router A-nqa-admin-Cellular0/0/1] frequency 60
// frequency must exceed interval x probe-count, or ICMP tests overlap and interfereSYMPTOMThe APN, profile and signal all look correct, and the dial still fails.
CAUSEauthentication-mode (auto, pap or chap) and the username/password have to match exactly what the carrier's network expects. A mismatch fails silently during authentication — it doesn't show up as a missing profile or a signal problem.
FIXCompare display apn-profile configuration's authentication-mode against what the operator issued, and verify the actual APN/username/password the modem chipset sent using the diagnose-view AT command, rather than trusting the configured value alone.
<Huawei> display apn-profile configuration
authentication-mode:chap
[Huawei-diagnose] at 2 0 "+QICSGP=1"
+QICSGP: 1,1,"ctvpdn","user1","12345678",1SYMPTOMPing over the cellular backup link shows elevated, inconsistent latency, even though RSSI/RSRP/SINR all look fine.
CAUSELTE modules report CDRX capability to the base station; if the base station enables it, the module sleeps intermittently to save power, and packets that arrive during a sleep window wait for the next wake cycle. That adds latency that has nothing to do with radio link quality.
FIXCheck the module model and firmware version with display cellular interface-number hardware; most current modules default to CDRX disabled once on the right firmware/patch combination, but the exact version required varies by module (ME909s is off by default; EC25/EP06/EC200-series modules need specific firmware plus patch levels).
[Huawei-Cellular0/0/0]display Cellular 0/0/0 hardware
Model = EC200T-EU
Modem Firmware Version = EC200TEHAAR05A08M16
// check firmware/patch against the CDRX-disabled requirements for this moduleSYMPTOMWith two cellular uplinks configured as primary/standby (a common pattern in solar-powered off-grid sites running dual SIMs against different carriers), the router either won't switch back to the primary once it recovers, or switches away from it too eagerly.
CAUSEstandby interface and NQA-tracked auto-recovery only behave sensibly when the probe timing is tuned correctly (see gotcha 3) — with route preference set on each static route, a flapping NQA probe on either link can make the switchover logic look broken when the real problem is probe timing.
FIXSet explicit route preference on each ip route-static so primary/backup priority is unambiguous, and tune the NQA probe parameters from gotcha 3 so switchovers are driven by a real outage, not a false probe failure.
interface Cellular0/0/0
standby interface Cellular0/0/1
ip route-static 0.0.0.0 0.0.0.0 Cellular0/0/0 preference 40
ip route-static 0.0.0.0 0.0.0.0 Cellular0/0/1 preference 80Pulled straight from the field — the ones worth having an answer ready for.
Traffic-triggered is the default: the cellular interface only dials once real traffic actually tries to cross it — a single Ping is enough to trigger it. Auto-dial, configured with dialer number ... autodial, has the router attempt to connect on a timer regardless of whether traffic is waiting, which is usually the better choice for a backup link you want ready before it's actually needed.
This is almost always the hot-plug limitation: the SIM was inserted (or the data card was reseated) while the router was already powered on. Remove the data card, confirm the SIM is seated correctly, reinsert the data card, and reboot the modem with modem reboot under the Cellular interface.
For a generally stable link, aim for RSSI at or above roughly -70 dBm and SINR at or above roughly 15 dB. If you're specifically troubleshooting a throughput shortfall rather than a drop, tighten that to RSSI at or above -65 dBm and RSRP at or above -85 dBm — below that, both speed and stability degrade even if the link nominally stays up.
Check whether it's paired with an NQA health probe under modem auto-recovery track — a probe-cycle of 1 combined with a test frequency shorter than interval times probe-count is the classic self-inflicted cause: a single momentary dip triggers a PLMN re-search, and the next probe fires before that finishes, repeating forever. Widening probe-cycle and frequency usually clears it outright.
No — USB 3G/LTE data cards aren't supported on these routers. Cellular connectivity has to come from either a chassis model with cellular built in, or a compatible cellular interface card installed in a SIC slot.
Confirm the antenna is the correct type for the module (LTE and 5G antennas differ and aren't interchangeable, and Wi-Fi antennas are different again), check that the Ethernet cable and NIC to the test PC are actually Gigabit rather than just reporting it, disable any VPN or proxy on the test machine during the test, and run tcp adjust-mss on the Cellular interface to tune the TCP segment size for the cellular link's encapsulation overhead. Multi-stream tools (iPerf with 10 parallel streams, or multiple simultaneous FTP transfers) also avoid understating the link because of a single-stream software bottleneck.
This note is built around the Huawei AR-series router's cellular fault-classification model and its display cellular / display ipsec statistics-style diagnostic commands, plus the field cases behind them. If your gateway or CPE is a different vendor, the exact commands change, but the underlying diagnosis order — modem present, SIM ready, signal usable, profile configured, authentication matching — carries over directly. It doesn't cover 5G SA-specific network-slicing edge cases in depth, or dedicated outdoor CPE/industrial-gateway hardware with its own antenna and enclosure considerations.
Tell us which stage it's stuck at — modem, SIM, signal, or profile — plus the display cellular ... all output, and we'll help you read it.