LTE NAS EMM Cause Values
LTE NAS EMM cause values tell you why the network accepted a request, rejected it, or pushed the procedure into a different path. In a trace, the easiest way to read them is to find the message carrying the cause and then map the code to what it really means: subscriber restriction, area restriction, security problem, congestion, or protocol error.
This page lists the full LTE NAS EMM cause set from 3GPP TS 24.301 and groups the causes the way they are usually checked in practice: identity problems, subscription and roaming restrictions, network and authentication failures, and protocol errors. It is the main lookup page for EMM cause links used from LTE NAS message pages.
Quick facts
| Technology | LTE / EPS |
|---|---|
| Protocol scope | EPS NAS EMM cause values used in mobility, authentication, reject, and protocol-error handling |
| Main spec | 3GPP TS 24.301 |
| Main clause | Annex A and IE definition 9.9.3.9 |
| Main use | Attach Reject, Tracking Area Update Reject, Service Reject, authentication and protocol error handling |
Overview
EMM cause values are part of the EPS mobility-management side of LTE NAS. You will see them most often in Attach Reject, Tracking Area Update Reject, and Service Reject, but they also show up in security and authentication failure handling.
The easiest way to read them is to start with the code, check whether it came from the network or the UE, and then see what it changes next. Some causes stop retry, some start a wait timer, some force the UE to look for another area, and some push the procedure into a wider recovery path.
Quick lookup
| Code | EMM cause | Typical meaning | Direction |
|---|---|---|---|
| #2 | IMSI unknown in HSS | The subscriber is not known in the HSS or has packet-only subscription context. | Network -> UE |
| #3 | Illegal UE | The network refuses service because the UE identity is not acceptable or authentication did not pass. | Network -> UE |
| #6 | Illegal ME | The device itself is not acceptable to the network, for example because it is prohibited. | Network -> UE |
| #9 | UE identity cannot be derived by the network | The network cannot resolve the UE identity from temporary context such as GUTI or S-TMSI. | Network -> UE |
| #10 | Implicitly detached | The network no longer treats the UE as having valid stored EPS registration context. | Network -> UE |
| #5 | IMEI not accepted | The network does not accept an emergency attach path that uses IMEI identity. | Network -> UE |
| #7 | EPS services not allowed | The UE is not allowed to operate EPS services. | Network -> UE |
| #8 | EPS services and non-EPS services not allowed | Neither EPS nor non-EPS services are allowed for the UE. | Network -> UE |
| #11 | PLMN not allowed | The UE is not allowed to operate in the current PLMN because of subscription or operator barring. | Network -> UE |
| #12 | Tracking area not allowed | The current tracking area is not allowed for the subscriber. | Network -> UE |
| #13 | Roaming not allowed in this tracking area | Roaming is allowed in the PLMN in general but not in the current tracking area. | Network -> UE |
| #14 | EPS services not allowed in this PLMN | The current PLMN does not offer roaming for EPS services to the UE. | Network -> UE |
| #15 | No suitable cells in tracking area | The UE is not allowed in the current area but should search for another suitable allowed area in the same PLMN or equivalent PLMN. | Network -> UE |
| #25 | Not authorized for this CSG | The UE is not authorized for the current closed subscriber group cell. | Network -> UE |
| #31 | Redirection to 5GCN required | Operator policy does not allow EPC service in the current PLMN and redirection to 5GCN is required. | Network -> UE |
| #35 | Requested service option not authorized in this PLMN | The requested service option is not authorized in the current PLMN. | Network -> UE |
| #36 | IAB-node operation not authorized | The UE is not authorized for IAB-node operation in the current PLMN. | Network -> UE |
| #40 | No EPS bearer context activated | During TAU or service request, the network has no active EPS bearer context for the UE. | Network -> UE |
| #16 | MSC temporarily not reachable | The MSC is temporarily not reachable for combined EPS attach or tracking area updating. | Network -> UE |
| #17 | Network failure | The MME cannot service the UE request because of PLMN failures. | Network -> UE |
| #18 | CS domain not available | The MME cannot service the request because the CS domain is unavailable and SMS in MME is not supported. | Network -> UE |
| #19 | ESM failure | There is a failure in the ESM message contained inside the EMM message. | Network -> UE |
| #20 | MAC failure | The USIM detected that the MAC in Authentication Request is not fresh. | UE -> Network |
| #21 | Synch failure | The USIM detected that the SQN in Authentication Request is out of range. | UE -> Network |
| #22 | Congestion | The request is rejected because of network congestion or overload. | Network -> UE |
| #23 | UE security capabilities mismatch | The UE detected that the security capabilities returned by the network do not match what it sent earlier. | UE -> Network |
| #24 | Security mode rejected, unspecified | The UE rejected the security mode command, for example because NonceUE did not match or for unspecified reasons. | UE -> Network |
| #26 | Non-EPS authentication unacceptable | In S1 mode, the separation bit in AUTN indicates unacceptable non-EPS authentication context. | UE -> Network |
| #39 | CS service temporarily not available | The requested CS fallback or related CS service continuation cannot be served temporarily. | Network -> UE |
| #42 | Severe network failure | The network determined that the requested procedure cannot be completed successfully and repeated retry is unlikely to help soon. | Network -> UE |
| #78 | PLMN not allowed to operate at the present UE location | The PLMN is not allowed to operate at the current UE location. In this spec version this is only used for NB-S1 or WB-S1 satellite access. | Network -> UE |
| #95 | Semantically incorrect message | The received message is semantically incorrect. | UE <-> Network |
| #96 | Invalid mandatory information | Mandatory information is missing or invalid in the message. | UE <-> Network |
| #97 | Message type non-existent or not implemented | The message type does not exist or is not implemented. | UE <-> Network |
| #98 | Message type not compatible with protocol state | The message type is not valid in the current protocol state. | UE <-> Network |
| #99 | Information element non-existent or not implemented | An IE is unknown or not implemented. | UE <-> Network |
| #100 | Conditional IE error | A conditionally included IE is wrong or inconsistent. | UE <-> Network |
| #101 | Message not compatible with protocol state | The message itself is not valid in the current protocol state. | UE <-> Network |
| #111 | Protocol error, unspecified | A protocol error occurred but no more specific cause value applies. | UE <-> Network |
UE identification
These causes appear when the network cannot trust, resolve, or keep the UE identity and existing mobility context.
IMSI unknown in HSS
The subscriber is not known in the HSS or has packet-only subscription context.
Direction: Network -> UE
Typical message pages: Attach Reject
Illegal UE
The network refuses service because the UE identity is not acceptable or authentication did not pass.
Direction: Network -> UE
Typical message pages: Attach Reject , Service Reject
Illegal ME
The device itself is not acceptable to the network, for example because it is prohibited.
Direction: Network -> UE
Typical message pages: Attach Reject , Service Reject
UE identity cannot be derived by the network
The network cannot resolve the UE identity from temporary context such as GUTI or S-TMSI.
Direction: Network -> UE
Typical message pages: Attach Reject , Tracking Area Update Reject
Implicitly detached
The network no longer treats the UE as having valid stored EPS registration context.
Direction: Network -> UE
Typical message pages: Attach Reject , Service Reject
Subscription options
These causes are mostly about service eligibility, roaming rules, tracking-area restrictions, or PLMN policy.
IMEI not accepted
The network does not accept an emergency attach path that uses IMEI identity.
Direction: Network -> UE
Typical message pages: Attach Reject
EPS services not allowed
The UE is not allowed to operate EPS services.
Direction: Network -> UE
Typical message pages: Attach Reject , Service Reject
EPS services and non-EPS services not allowed
Neither EPS nor non-EPS services are allowed for the UE.
Direction: Network -> UE
Typical message pages: Attach Reject
PLMN not allowed
The UE is not allowed to operate in the current PLMN because of subscription or operator barring.
Direction: Network -> UE
Typical message pages: Attach Reject
Tracking area not allowed
The current tracking area is not allowed for the subscriber.
Direction: Network -> UE
Typical message pages: Tracking Area Update Reject , Attach Reject
Roaming not allowed in this tracking area
Roaming is allowed in the PLMN in general but not in the current tracking area.
Direction: Network -> UE
Typical message pages: Tracking Area Update Reject , Attach Reject
EPS services not allowed in this PLMN
The current PLMN does not offer roaming for EPS services to the UE.
Direction: Network -> UE
Typical message pages: Tracking Area Update Reject , Attach Reject
No suitable cells in tracking area
The UE is not allowed in the current area but should search for another suitable allowed area in the same PLMN or equivalent PLMN.
Direction: Network -> UE
Typical message pages: Tracking Area Update Reject , Attach Reject
Not authorized for this CSG
The UE is not authorized for the current closed subscriber group cell.
Direction: Network -> UE
Typical message pages: Attach Reject
Redirection to 5GCN required
Operator policy does not allow EPC service in the current PLMN and redirection to 5GCN is required.
Direction: Network -> UE
Typical message pages: Service Reject
Requested service option not authorized in this PLMN
The requested service option is not authorized in the current PLMN.
Direction: Network -> UE
Typical message pages: Attach Reject
IAB-node operation not authorized
The UE is not authorized for IAB-node operation in the current PLMN.
Direction: Network -> UE
No EPS bearer context activated
During TAU or service request, the network has no active EPS bearer context for the UE.
Direction: Network -> UE
Typical message pages: Tracking Area Update Reject , Service Reject
Failures, congestion, and authentication
These causes usually explain why a procedure stopped because of temporary network failure, overload, or a security/authentication problem.
MSC temporarily not reachable
The MSC is temporarily not reachable for combined EPS attach or tracking area updating.
Direction: Network -> UE
Typical message pages: Attach Reject , Tracking Area Update Reject
Network failure
The MME cannot service the UE request because of PLMN failures.
Direction: Network -> UE
Typical message pages: Attach Reject , Tracking Area Update Reject , Service Reject
CS domain not available
The MME cannot service the request because the CS domain is unavailable and SMS in MME is not supported.
Direction: Network -> UE
Typical message pages: Service Reject
ESM failure
There is a failure in the ESM message contained inside the EMM message.
Direction: Network -> UE
Typical message pages: Attach Reject
MAC failure
The USIM detected that the MAC in Authentication Request is not fresh.
Direction: UE -> Network
Typical message pages: Authentication Request
Synch failure
The USIM detected that the SQN in Authentication Request is out of range.
Direction: UE -> Network
Typical message pages: Authentication Request
Congestion
The request is rejected because of network congestion or overload.
Direction: Network -> UE
Typical message pages: Attach Reject , Tracking Area Update Reject , Service Reject
UE security capabilities mismatch
The UE detected that the security capabilities returned by the network do not match what it sent earlier.
Direction: UE -> Network
Typical message pages: Authentication Request
Security mode rejected, unspecified
The UE rejected the security mode command, for example because NonceUE did not match or for unspecified reasons.
Direction: UE -> Network
Typical message pages: Messagesltelte Rrclte Security Mode Failure
Non-EPS authentication unacceptable
In S1 mode, the separation bit in AUTN indicates unacceptable non-EPS authentication context.
Direction: UE -> Network
Typical message pages: Authentication Request
CS service temporarily not available
The requested CS fallback or related CS service continuation cannot be served temporarily.
Direction: Network -> UE
Typical message pages: Service Reject
Severe network failure
The network determined that the requested procedure cannot be completed successfully and repeated retry is unlikely to help soon.
Direction: Network -> UE
Typical message pages: Attach Reject , Tracking Area Update Reject , Service Reject
PLMN not allowed to operate at the present UE location
The PLMN is not allowed to operate at the current UE location. In this spec version this is only used for NB-S1 or WB-S1 satellite access.
Direction: Network -> UE
Typical message pages: Tracking Area Update Reject
Invalid messages and protocol errors
These are protocol-level causes used when the message content or protocol state is not valid.
Semantically incorrect message
The received message is semantically incorrect.
Direction: UE <-> Network
Invalid mandatory information
Mandatory information is missing or invalid in the message.
Direction: UE <-> Network
Message type non-existent or not implemented
The message type does not exist or is not implemented.
Direction: UE <-> Network
Message type not compatible with protocol state
The message type is not valid in the current protocol state.
Direction: UE <-> Network
Information element non-existent or not implemented
An IE is unknown or not implemented.
Direction: UE <-> Network
Conditional IE error
A conditionally included IE is wrong or inconsistent.
Direction: UE <-> Network
Message not compatible with protocol state
The message itself is not valid in the current protocol state.
Direction: UE <-> Network
Protocol error, unspecified
A protocol error occurred but no more specific cause value applies.
Direction: UE <-> Network
Where to use this page
This page is most useful when a message page says EMM cause but the trace question is really about the behavior behind the code. Use it together with the carrying message, the timer page, and the next UE behavior.
- Use Attach Reject with this page when the UE never reaches normal EPS registration.
- Use Tracking Area Update Reject with this page when the UE tried to preserve registration but failed to stay in the TAU path.
- Use Service Reject with this page when idle-to-connected service restoration stops in reject handling.
- Use LTE NAS Timers when the same reject also returns T3346, T3402, T3442, or T3448 and you need the timing effect as well as the cause.
References
- 3GPP TS 24.301, Release 18, Annex A: Cause values for EPS mobility management
- 3GPP TS 24.301, clause 9.9.3.9: EMM cause IE
- 3GPP TS 24.008, Annex H: referenced protocol error cause definitions for the higher numbered EMM causes