Operator had a fixed-IP APN option, we got a /28. Allowed networks set on the cabinet profile. Tested with a dev board on my home broadband using a real cabinet token: CONNACK 5, and the Log tab shows the refusal reason. Tokens and PSK are in NVS now, flash encryption is next after I brick a spare or two learning it. Missing board’s token revoked.