Why eSIM changes the rules for a modem farm
With 5–10 modems you can still survive on “manual ops”: buy a SIM, label it, top it up, move on. Once you reach 30–50 devices, the main enemy of stable mobile proxies is not hardware — it is operational chaos. eSIM can help you scale (faster replacement, multiple profiles on one eUICC, less physical logistics), but without processes it creates new failure modes: QR codes get lost, profiles get mixed, data bundles expire unexpectedly, and carrier-portal access becomes a shared password.
This guide focuses on operations: eSIM procurement and inventory, profile rotation, usage limits, secure access to carrier portals, and common scaling mistakes.
Key terms: eSIM, eUICC, profile, EID
Agree on terminology early:
- eUICC is the eSIM “container” (chip/card) that can store multiple profiles. In phones it is embedded; in modem farms you often use an eSIM adapter (SIM form factor with eUICC) or an industrial module.
- eSIM profile is the operator profile downloaded to the eUICC.
- EID is the identifier of the eUICC. It is one of the best anchors for inventory.
- Active profile is the one currently connected to the network. Typically only one profile is active at a time.
Practical rule: the unit of management is not “the modem” and not “the phone number”, but a link eUICC (EID) ↔ profile (ICCID/number) ↔ plan/bundle ↔ physical location (modem/port/rack).
SIM-pool management architecture: from a sheet to a system
- Single source of truth: one database/table that contains all SIM/eSIM records and their state.
- Standard states (e.g., new, bound, production, rotating, frozen, access-issue, decommissioned).
- Hardware inventory: modem/router IDs, IMEI/serial, USB hub/port mapping, rack position, management IP.
- Security boundaries: who can access portals, QR assets, remote control, and payments.
- Limits and spending control: top-up rules, alerts, per-SIM and per-group policies.
The common mistake is “everything in one spreadsheet” without rules. A spreadsheet can start the journey, but roles, approvals, and access control must be defined.
Procurement and onboarding: make it a controlled flow
- Capacity planning: how many new eSIMs per week, how many spares, expected loss due to activation errors or blocks.
- Plan segmentation: separate test vs production pools; avoid mixing without labels.
- Standard SIM record: carrier/plan, number, ICCID (if available), EID, issue date, delivery channel (QR/email/portal), owner, notes.
- Controlled asset storage: QR codes, vouchers, emails — stored with permissions and change logs.
Simple but effective: assign an internal ID (e.g., SIM-UA-000123). Put the same ID on the modem/slot/port and use it as the primary key. Phone numbers are not reliable identifiers.
Carrier reality in Ukraine: practical constraints
In practice, eSIM for Kyivstar, Vodafone, and lifecell is commonly issued via an app/portal or as a QR code. At scale, plan for:
- Re-install limitations: QR codes can be time-limited or have limited re-use depending on the carrier process. Treat it as a risk and record it.
- Device/EID binding: moving an eSIM to another device may require a re-issue. It is not always as simple as swapping a plastic SIM.
- Corporate route: at hundreds of lines, a corporate pool with formal procedures can be easier to manage than consumer workflows.
Define one “approved procedure” per carrier (buy/activate/replace/move) and enforce it.
Profile rotation: what can be automated
“Rotation” can mean two things:
- IP rotation within one line (common in mobile networks due to reconnects and CGNAT).
- Profile rotation: switching between different eSIM profiles on one eUICC or replacing the eSIM line.
Profile rotation often requires device actions and sometimes re-activation. Automate only what is repeatable:
- Planned rotation (schedule-based, with defined warm/cold pools).
- Failover rotation (no network, bundle depleted, line blocked) — switch to a spare profile/line.
Rotation should be driven by state and policy (limits, modem health, SIM status), not ad-hoc decisions.
Usage limits: data, money, billing dates
Most outages are not technical — a bundle expires, a monthly fee is charged, the balance hits zero. Limits control is your first “enterprise” capability.
- SIM level: daily/monthly data cap, minimum balance, fee renewal date.
- Group level: pool budget per customer/offer/server and spare ratio.
- Infrastructure level: per-node caps to avoid one SIM draining the whole uplink.
Implementation options:
- Device telemetry (router/modem counters) aggregated daily.
- Carrier portal data (remaining bundle/balance) when available and compliant with your usage terms.
- Reconciliation: large mismatches between device counters and carrier data signal routing leaks or misconfigurations.
Set actionable alerts: 80% bundle used, 95% used, balance below X, fee due in 24 hours. Each alert must map to an action: top up, switch to spare, pause a customer, quarantine the SIM, etc.
Securing carrier-portal access: minimum baseline
Your two critical assets are carrier-portal access and activation artifacts (QR/vouchers/codes). Losing access means losing control.
- Role separation: inventory vs payments vs re-issue should not be fully merged without oversight.
- MFA wherever possible. SMS-based MFA is weaker for a SIM farm.
- Individual accounts instead of one shared login, plus auditing.
- Password manager and incident-driven rotation.
- No QR in messengers: treat QR as a private key; store it in controlled storage.
For corporate portals, use a “two-person rule” for critical actions (re-issue, ownership changes, billing changes).
Remote modem control: essentials for scale
- Remote power reboot (managed PDU/smart plugs).
- Out-of-band access to nodes so you can recover even if the main network is down.
- Consistent addressing: you can locate and access “modem-17” quickly.
- Configuration templates for APN/network modes/timeouts to avoid per-device snowflakes.
Common scaling mistakes
- No internal ID and incomplete SIM records.
- QR sprawl: screenshots and chat forwards instead of controlled storage.
- No history of who activated/re-issued/moved a profile.
- No spares and no failover rules.
- Limits “by feel”, leading to surprise charges or line suspensions.
- One shared login for the whole team.
A simple operating model for 30–300 SIMs
- 1) Intake: procure/receive → create SIM record → store activation assets.
- 2) Provisioning: bind to eUICC/modem → record EID/IMEI/port → network test.
- 3) Production: set to active → assign to group/customer → apply limits.
- 4) Monitoring: daily telemetry + bundle/balance checks + alerts.
- 5) Rotation/Spare: spare pool and planned/failover rotation rules.
- 6) Incident: runbook for failure (reboot, switch, replace, escalate).
- 7) Decommission: freeze/retire → revoke access → archive → final cost check.
Checklist before adding the next +50 eSIMs
- Every line has an internal ID and a complete record.
- QR/vouchers are stored in controlled storage with access boundaries.
- Per-carrier procedures are documented and enforced.
- Spare capacity is in place (at least 10–15% hot spares).
- Limits and alerts exist for usage, balance, and billing dates.
- Remote power control and clean modem addressing are ready.
- Action logs exist for profile and access changes.
Conclusion
eSIM removes some physical friction, but it raises the bar for operational discipline: inventory, security, limits, and standard procedures. Build a source of truth, clear statuses, access policies, and monitoring — and scaling a mobile proxy farm becomes a controlled operation rather than constant firefighting.
FAQ
Can I store multiple profiles on one eUICC and switch between them?
Often yes, but typically only one profile is active at a time. Capabilities depend on your device/adapter and carrier rules.
What should be the primary key in inventory?
Use an internal ID plus EID as anchors, with phone number/ICCID as attributes. Numbers can change after re-issue or porting.
What if a SIM consumes data faster than expected?
Reconcile device counters vs carrier usage, check background traffic and routing, enforce per-node caps, quarantine the SIM, and collect diagnostics.
How do I reduce the risk of losing portal access?
Individual accounts, MFA, a password manager, role separation, and auditing. Apply a two-person rule for critical actions.