5GMM Cause Values in 5G NAS
5GMM cause values explain why a mobility-side NAS procedure did not continue normally. They matter most in registration, service return, identity, authentication, security, and other UE-to-AMF control procedures where the visible question is not only that the procedure failed, but why it failed.
Use this page when a 5G NAS trace shows a mobility-side reject or status condition and you need to place the cause in the correct 5GMM procedure context before moving into message-level detail or troubleshooting.
Quick facts
| Technology | 5G |
|---|---|
| Area / Protocol | 5GMM cause values in NAS |
| Main use | Explain why a mobility-side NAS procedure was rejected, failed, or could not continue normally |
| Common procedures | Registration, service request, identity, authentication, security, deregistration, status handling |
| Reader goal | Separate mobility-side rejection meaning from state mismatch, security failure, or access-side relay issues |
| Related topics | Registration Reject, Service Reject, 5GMM Status, authentication, security mode, 5GMM states |
Contents
Overview
A 5GMM cause value is not useful by itself. It becomes useful when it is read with the failed procedure, the current 5GMM state, the message carrying it, and the immediately preceding identity or security context.
In practice, 5GMM causes help answer questions such as: was the UE rejected because registration was not allowed, because a security step could not continue, because the request did not match the current mobility context, or because the network needed to signal an abnormal condition instead of normal completion?
Where they appear
| Procedure area | Typical message view | What the cause helps explain |
|---|---|---|
| Registration | Registration Reject | Why the UE could not complete initial, periodic, or update-style registration progression. |
| Service return | Service Reject | Why a registered UE could not return cleanly to active service. |
| Abnormal handling | 5GMM Status or failure-specific branches | Why the procedure moved into abnormal handling instead of success continuation. |
| Security or identity progression | Authentication, identity, or security-related failure branch | Whether the reject meaning belongs to policy, state, identity, or security progression. |
Cause families
It is easier to read 5GMM causes by family than by memorizing isolated values. The first useful question is what kind of failure meaning the cause belongs to.
| Cause family | Main meaning | Typical next check |
|---|---|---|
| Registration or policy not allowed | The network rejects the mobility-side request because the requested service or registration branch is not accepted. | Check subscriber context, slice context, access restrictions, and the exact registration type. |
| Security or identity mismatch | The procedure cannot continue because identity or security context is missing, stale, or not trusted. | Read the preceding authentication, identity, and security-mode sequence. |
| State mismatch | The message or request does not fit the current mobility-side NAS state. | Check the UE's earlier 5GMM state and whether a previous procedure completed cleanly. |
| Protocol or abnormal handling | The message could not be accepted as a normal continuation, so the procedure moves into status or reject handling. | Inspect message order, missing prerequisites, and any earlier abnormal branch. |
5GMM cause list
Use the quick lookup table for fast code-to-cause matching, then move into the grouped cause sections when you need more context around identity problems, subscription restrictions, congestion, authentication, or protocol errors.
| Code | 5GMM cause | Typical meaning | Direction |
|---|---|---|---|
| #3 | Illegal UE | The network refuses service because the UE identity is not acceptable or the UE does not pass authentication. | Network -> UE |
| #6 | Illegal ME | The device itself is not acceptable to the network, for example because it is blacklisted. | Network -> UE |
| #9 | UE identity cannot be derived by the network | The network cannot derive valid UE identity from the temporary identity context. | Network -> UE |
| #10 | Implicitly de-registered | The earlier mobility context no longer exists and the UE must re-enter with fresh registration handling. | Network -> UE |
| #5 | PEI not accepted | The network does not accept an emergency initial registration that uses PEI identity. | Network -> UE |
| #7 | 5GS services not allowed | The UE is not allowed to operate 5GS services. | Network -> UE |
| #11 | PLMN not allowed | The UE is not allowed to operate in the current PLMN. | Network -> UE |
| #12 | Tracking area not allowed | The current tracking area is not allowed for the subscriber. | Network -> UE |
| #13 | Roaming not allowed in this tracking area | Roaming is allowed more broadly, but not in the current tracking area. | Network -> UE |
| #15 | No suitable cells in tracking area | The UE is not allowed in the current area but should search for another suitable area in the same PLMN or SNPN. | Network -> UE |
| #27 | N1 mode not allowed | The UE is not allowed to operate in N1 mode in the selected PLMN or SNPN. | Network -> UE |
| #31 | Redirection to EPC required | The UE is not allowed in 5GCN and must be redirected toward EPC handling. | Network -> UE |
| #36 | IAB-node operation not authorized | The UE acting as an IAB-node is not authorized for that operation. | Network -> UE |
| #72 | Non-3GPP access to 5GCN not allowed | The UE is not allowed to access 5GCN over non-3GPP access. | Network -> UE |
| #74 | Temporarily not authorized for this SNPN | The UE is not currently authorized to operate in the SNPN. | Network -> UE |
| #75 | Permanently not authorized for this SNPN | The UE has no valid subscription or the subscription has expired for the SNPN. | Network -> UE |
| #76 | Not authorized for this CAG or authorized for CAG cells only | The UE is not authorized for the current CAG access condition. | Network -> UE |
| #77 | Wireline access area not allowed | Wireline-side 5GCN access is not allowed in the current wireline access area. | Network -> UE |
| #20 | MAC failure | The USIM detects that the MAC in Authentication Request is not fresh. | UE -> Network |
| #21 | Synch failure | The USIM detects that the sequence number in Authentication Request is out of range. | UE -> Network |
| #22 | Congestion | The request is rejected because of network congestion or overload. | Network -> UE |
| #23 | UE security capabilities mismatch | The UE detects that security capabilities returned by the network do not match what it sent. | UE -> Network |
| #24 | Security mode rejected, unspecified | The UE rejects NAS security activation for an unspecified reason. | UE -> Network |
| #26 | Non-5G authentication unacceptable | The authentication request is not acceptable for 5GS NAS security expectations. | UE -> Network |
| #28 | Restricted service area | The UE is in a non-allowed or not-allowed access area. | Network -> UE |
| #43 | LADN not available | User-plane resources of the related PDU session are not established outside the LADN area. | Network -> UE |
| #62 | No network slices available | Requested slices are not allowed and no default slice is available. | Network -> UE |
| #65 | Maximum number of PDU sessions reached | The network already reached the maximum active PDU session count for the UE. | Network -> UE |
| #67 | Insufficient resources for specific slice and DNN | Requested service cannot be provided for the slice and DNN combination. | Network -> UE |
| #69 | Insufficient resources for specific slice | Requested service cannot be provided for the selected slice. | Network -> UE |
| #71 | ngKSI already in use | The received ngKSI collides with a stored 5G security context in the UE. | UE -> Network |
| #73 | Serving network not authorized | The serving network is not authorized by the UE home network. | Network -> UE |
| #90 | Payload was not forwarded | Requested service cannot be provided because payload forwarding failed at the AMF side. | Network -> UE |
| #91 | DNN not supported or not subscribed in the slice | Requested DNN is not supported or not subscribed in the selected slice. | Network -> UE |
| #92 | Insufficient user-plane resources for the PDU session | Requested service cannot be provided because user-plane resources are not available. | Network -> UE |
| #95 | Semantically incorrect message | The received message is semantically incorrect. | UE <-> Network |
| #96 | Invalid mandatory information | Mandatory information is missing or malformed. | UE <-> Network |
| #97 | Message type non-existent or not implemented | The message type is undefined or not implemented. | UE <-> Network |
| #98 | Message type not compatible with protocol state | The message type does not fit the current protocol state. | UE <-> Network |
| #99 | Information element non-existent or not implemented | An IE is unknown or not implemented. | UE <-> Network |
| #100 | Conditional IE error | A conditional IE is inconsistent or erroneous. | UE <-> Network |
| #101 | Message not compatible with protocol state | The message itself is not valid in the current protocol state. | UE <-> Network |
| #111 | Protocol error, unspecified | A protocol error occurred but no more specific cause applies. | UE <-> Network |
UE identification causes
These causes appear when the network cannot trust, resolve, or keep the UE identity and its stored mobility context.
Illegal UE
The network refuses service because the UE identity is not acceptable or the UE does not pass authentication.
Direction: Network -> UE
Typical message pages: Registration Reject , Service Reject
Illegal ME
The device itself is not acceptable to the network, for example because it is blacklisted.
Direction: Network -> UE
Typical message pages: Registration Reject
UE identity cannot be derived by the network
The network cannot derive valid UE identity from the temporary identity context.
Direction: Network -> UE
Typical message pages: Registration Reject
Implicitly de-registered
The earlier mobility context no longer exists and the UE must re-enter with fresh registration handling.
Direction: Network -> UE
Typical message pages: Registration Reject , Service Reject
Subscription and area restriction causes
These causes are mostly about service eligibility, roaming rules, tracking-area restrictions, access mode, or operator policy.
PEI not accepted
The network does not accept an emergency initial registration that uses PEI identity.
Direction: Network -> UE
Typical message pages: Registration Reject
5GS services not allowed
The UE is not allowed to operate 5GS services.
Direction: Network -> UE
Typical message pages: Registration Reject , Service Reject
PLMN not allowed
The UE is not allowed to operate in the current PLMN.
Direction: Network -> UE
Typical message pages: Registration Reject
Tracking area not allowed
The current tracking area is not allowed for the subscriber.
Direction: Network -> UE
Typical message pages: Registration Reject
Roaming not allowed in this tracking area
Roaming is allowed more broadly, but not in the current tracking area.
Direction: Network -> UE
Typical message pages: Registration Reject
No suitable cells in tracking area
The UE is not allowed in the current area but should search for another suitable area in the same PLMN or SNPN.
Direction: Network -> UE
Typical message pages: Registration Reject
N1 mode not allowed
The UE is not allowed to operate in N1 mode in the selected PLMN or SNPN.
Direction: Network -> UE
Typical message pages: Registration Reject , Service Reject
Redirection to EPC required
The UE is not allowed in 5GCN and must be redirected toward EPC handling.
Direction: Network -> UE
Typical message pages: Registration Reject , Service Reject
IAB-node operation not authorized
The UE acting as an IAB-node is not authorized for that operation.
Direction: Network -> UE
Non-3GPP access to 5GCN not allowed
The UE is not allowed to access 5GCN over non-3GPP access.
Direction: Network -> UE
Typical message pages: Registration Reject
Temporarily not authorized for this SNPN
The UE is not currently authorized to operate in the SNPN.
Direction: Network -> UE
Typical message pages: Registration Reject
Permanently not authorized for this SNPN
The UE has no valid subscription or the subscription has expired for the SNPN.
Direction: Network -> UE
Typical message pages: Registration Reject
Not authorized for this CAG or authorized for CAG cells only
The UE is not authorized for the current CAG access condition.
Direction: Network -> UE
Typical message pages: Registration Reject
Wireline access area not allowed
Wireline-side 5GCN access is not allowed in the current wireline access area.
Direction: Network -> UE
Failures, congestion, and authentication causes
These causes usually explain why a procedure stopped because of temporary network failure, overload, authentication, security, or user-plane limitations.
MAC failure
The USIM detects that the MAC in Authentication Request is not fresh.
Direction: UE -> Network
Typical message pages: Authentication Failure
Synch failure
The USIM detects that the sequence number in Authentication Request is out of range.
Direction: UE -> Network
Typical message pages: Authentication Failure
Congestion
The request is rejected because of network congestion or overload.
Direction: Network -> UE
Typical message pages: Registration Reject , Service Reject
UE security capabilities mismatch
The UE detects that security capabilities returned by the network do not match what it sent.
Direction: UE -> Network
Typical message pages: Security Mode Reject
Security mode rejected, unspecified
The UE rejects NAS security activation for an unspecified reason.
Direction: UE -> Network
Typical message pages: Security Mode Reject
Non-5G authentication unacceptable
The authentication request is not acceptable for 5GS NAS security expectations.
Direction: UE -> Network
Typical message pages: Authentication Failure
Restricted service area
The UE is in a non-allowed or not-allowed access area.
Direction: Network -> UE
Typical message pages: Registration Reject , Service Reject
LADN not available
User-plane resources of the related PDU session are not established outside the LADN area.
Direction: Network -> UE
Typical message pages: Service Reject
No network slices available
Requested slices are not allowed and no default slice is available.
Direction: Network -> UE
Typical message pages: Registration Reject
Maximum number of PDU sessions reached
The network already reached the maximum active PDU session count for the UE.
Direction: Network -> UE
Typical message pages: Service Reject
Insufficient resources for specific slice and DNN
Requested service cannot be provided for the slice and DNN combination.
Direction: Network -> UE
Typical message pages: Registration Reject , Service Reject
Insufficient resources for specific slice
Requested service cannot be provided for the selected slice.
Direction: Network -> UE
Typical message pages: Registration Reject , Service Reject
ngKSI already in use
The received ngKSI collides with a stored 5G security context in the UE.
Direction: UE -> Network
Typical message pages: Authentication Failure
Serving network not authorized
The serving network is not authorized by the UE home network.
Direction: Network -> UE
Typical message pages: Registration Reject
Payload was not forwarded
Requested service cannot be provided because payload forwarding failed at the AMF side.
Direction: Network -> UE
Typical message pages: Service Reject
DNN not supported or not subscribed in the slice
Requested DNN is not supported or not subscribed in the selected slice.
Direction: Network -> UE
Typical message pages: Service Reject
Insufficient user-plane resources for the PDU session
Requested service cannot be provided because user-plane resources are not available.
Direction: Network -> UE
Typical message pages: Service Reject
Invalid messages and protocol-error causes
These are protocol-level causes used when the message content or current protocol state is not valid.
Semantically incorrect message
The received message is semantically incorrect.
Direction: UE <-> Network
Typical message pages: 5gmm Status
Invalid mandatory information
Mandatory information is missing or malformed.
Direction: UE <-> Network
Typical message pages: 5gmm Status
Message type non-existent or not implemented
The message type is undefined or not implemented.
Direction: UE <-> Network
Typical message pages: 5gmm Status
Message type not compatible with protocol state
The message type does not fit the current protocol state.
Direction: UE <-> Network
Typical message pages: 5gmm Status
Information element non-existent or not implemented
An IE is unknown or not implemented.
Direction: UE <-> Network
Typical message pages: 5gmm Status
Conditional IE error
A conditional IE is inconsistent or erroneous.
Direction: UE <-> Network
Typical message pages: 5gmm Status
Message not compatible with protocol state
The message itself is not valid in the current protocol state.
Direction: UE <-> Network
Typical message pages: 5gmm Status
Protocol error, unspecified
A protocol error occurred but no more specific cause applies.
Direction: UE <-> Network
Typical message pages: 5gmm Status
The value alone is not enough. First decide whether the cause came from the network or the UE, then place it in the exact 5GMM procedure branch such as registration, service return, authentication, or security handling.
How to read them
1. Identify the failed 5GMM procedure.
2. Find the exact message carrying the cause.
3. Check the immediately preceding identity or security step.
4. Place the cause against the current 5GMM state.
5. Decide whether the real issue is policy, state, security, or an earlier missing prerequisite.
This order matters because many causes look similar when read in isolation. The actual meaning becomes clearer only when the cause is tied back to the procedure branch that failed.
Example
A simple example is a UE sending Registration Request and receiving Registration Reject with a 5GMM cause.
Registration Request appears first.
Registration Reject carries the 5GMM cause.
The cause is then read together with registration type, identity context, and any earlier authentication or slice-selection branch.
The next step is not to memorize the number alone, but to decide whether the reject is policy-driven, security-driven, or state-driven.
FAQ
What are 5GMM cause values?
They are mobility-side NAS reject or abnormal-condition indicators that explain why a 5GMM procedure did not continue normally.
Are 5GMM causes only for registration?
No. Registration is the most visible area, but 5GMM causes also matter in service return, abnormal handling, and other mobility-side NAS branches.
Should a 5GMM cause be read by itself?
No. It should be read with the message carrying it, the procedure that failed, and the current 5GMM state.
References
- 3GPP TS 24.501, Non-Access-Stratum (NAS) protocol for the 5G System
- 3GPP TS 23.502, Procedures for the 5G System