This is a NAS message which is sent to UE when the UE is not allowed to register to the specific network or a specific Location Area.

The reject cause decides what the UE does next, and the difference between the causes is larger than it looks. Some causes block a whole PLMN, some block one location area, and some keep the TMSI while others delete it. Let's first look at what the message carries and what every UE does on receipt. Then we go through causes #11, #12, #13 and #15 one by one, with a test scenario for the last three. The page ends with a comparison of the forbidden lists they fill.

• What does the Location Updating Reject message carry ?
• Cause #11 - PLMN not allowed’
• Cause #12 - LA not allowed’
• Cause #13 - ‘roaming not allowed in this LA’
• Cause #15 - ‘No Suitable Cells In LA’
• How do the forbidden lists differ ?
• Reference

What does the Location Updating Reject message carry ?

The message itself is very small, and nearly all of its meaning sits in one octet. The network sends it when a normal location update, a periodic update or an IMSI attach fails. Before we read the causes, let's see the whole message as 24.008 v20.0.0 Table 9.2.16 defines it.

The reject cause is one octet, coded by 24.008 Table 10.5.95. The four causes on this page are 0000 1011 for #11, 0000 1100 for #12, 0000 1101 for #13 and 0000 1111 for #15. The optional T3246 value is used only with cause #22, congestion, when the network runs CS domain NAS level mobility management congestion control.

Every cause starts with the same common steps in 24.008 clause 4.4.4.7. The UE stops T3210, stores the reject cause, starts T3240, enters the state LOCATION UPDATING REJECTED and waits for the network to release the RR connection. For all causes except #12, #15, #22 and #25, the UE also deletes its list of equivalent PLMNs. The cause-specific actions in the sections below happen only after the RR connection is released. If the network does not release it, T3240 expires after 10 s and the UE aborts the RR connection itself.

• One octet decides the outcome : The rest of the message is fixed header, except the optional T3246 value.
• The cause is acted on after release : The UE waits for the RR connection release, or for T3240 expiry, before it changes lists and starts PLMN or cell selection.
• #12 and #15 keep the equivalent PLMN list : Both restrict a location area, not the PLMN, so the UE keeps its equivalent PLMNs.

Cause #11 - PLMN not allowed’

Network send this message when a UE tries to camp on the PLMN (usually VPLMN) which is not allowed for the UE. When it recieves, UE has to do following steps.

i) UE has to store this PLMN in forbidden PLMN list in USIM

UE has to remove this PLMN from 'forbidden PLMN' list in the following cases.

i) UE is switched off (this clears only the optional extension of the list in the ME memory, because the list in the USIM is kept)

ii) USIM is removed (the same note as i) applies)

iii) User select the PLMN in Manual Selection Mode and it gets accepted by the network.

iv) Timer T3245 expires, if the UE is configured to use T3245.

24.008 asks for more than storing the PLMN. The UE deletes any LAI, TMSI and ciphering key sequence number stored in the USIM, resets the location update attempt counter, and sets the update status to ROAMING NOT ALLOWED. Back in MM IDLE, it performs a PLMN selection as 23.122 defines it.

The removal rules come from 23.122 clause 3.1. The "forbidden PLMNs" list in the SIM is retained when the MS is switched off or the SIM is removed. Only the optional extension of the list, kept in the ME memory, is deleted in those two cases. A UE configured to use T3245 starts that timer with a random value between 12 h and 24 h, and it erases the whole list when the timer expires. Also note that the HPLMN, or an EHPLMN, is never stored in this list.

• Cause #11 blocks the whole PLMN : The UE will not try any cell of that PLMN in automatic mode until the PLMN leaves the list.
• The forbidden PLMN list survives power off : Because it sits in the SIM, a restart does not help. Manual selection with a successful registration does.
• The TMSI and LAI are gone : The next registration starts with the IMSI.

Cause #12 - LA not allowed’

When a UE have a ‘regionally restricted service’ where it can only obtain service on certain LAs and it attempts to camp on a cell of an LA for which it does not have service entitlement, it recieves the Location Update Reject with Cause #12. When it recieves, UE has to do following steps.

i) UE has to store this LAI in the 'forbidden LAs for regional provision of service' list in UE so that it would not keep retrying the location updating process.

ii) UE gets into 'Limited Service' state.

iii) UE initiate Cell Selection Process

UE has to remove this LAI from 'forbidden LAs for regional provision of service' list in the following cases.

i) UE is switched off

ii) USIM is removed

iii) The periodic erase of the list, with a period in the range of 12 to 24 hours

Cause #12 starts like cause #11. The UE deletes any LAI, TMSI and ciphering key sequence number, resets the location update attempt counter and sets the update status to ROAMING NOT ALLOWED. Unlike cause #11, it keeps the equivalent PLMN list, and it asks for a cell selection rather than a PLMN selection.

One possible test scenario can be as follows. (This is based on GSMA TS11 17.1.4. I converted the test description into an illustration). This sequence shows only the important portions, there should be many additional common message in between each step (usually at the location of orange dotted lines). This is just one example, there can be a lot of variations of steps depending on network operators.

Condition :

PLMN of GSM1, WCDMA1, WCDMA2, GSM2 are all same.

LAI of GSM1, WCDMA1, WCDMA2, GSM2 are all different

In the sequence below, the UE starts idle on GSM1 and is made to reselect to WCDMA1. Its Normal Location Updating is rejected with cause #12, so the UE stores that LAI and moves on to WCDMA2. WCDMA2 rejects it with cause #12 as well, and the UE stores a second LAI. The third attempt, on GSM2, is accepted with a new TMSI, and the UE answers with TMSI Reallocation Complete.

• Every cell stays in the same PLMN : Only the LAI changes, which is why cell selection alone finds GSM2.
• Each reject adds one LAI : After two rejects, the list of forbidden location areas for regional provision of service holds the LAIs of WCDMA1 and WCDMA2.
• The accept brings a new TMSI : The UE deleted its TMSI at the first reject, so the network assigns a new one.

Cause #13 - ‘roaming not allowed in this LA’

When a UE recieves the Location Update Reject with Cause #13, UE has to do following steps. Compare them with cause #12, because both causes put an LAI on a forbidden list.

i) UE has to store this LAI in the 'forbidden LAs for roaming' list in UE so that it would not keep retrying the location updating process.

ii) UE has to initiate PLMN selection process (not Cell Selection Process).

Cause #13 is typical for a roaming UE whose visited network allows it in some location areas but not in this one. 24.008 tells the UE to reset the location update attempt counter and set the update status to ROAMING NOT ALLOWED. But it does not ask the UE to delete its TMSI or LAI. The UE deletes the equivalent PLMN list, and the PLMN selection may bring it back to the same PLMN in another location area.

One possible test scenario can be as follows. (This is based on GSMA TS11 17.1.3. I converted the test description into an illustration). This sequence shows only the important portions, there should be many additional common message in between each step (usually at the location of orange dotted lines). This is just one example, there can be a lot of variations of steps depending on network operators.

Condition :

PLMN of WCDMA1, WCDMA2 are same, PLMN of GSM may or may not be same.

LAI of WCDMA1, WCDMA2, GSM are all different

In the sequence below, every Location Updating Request is of Type 2, IMSI attach. WCDMA1 and then WCDMA2 reject the UE with cause #13, and the UE stores each LAI in the list of forbidden location areas for roaming. The attempt on GSM is accepted with a new TMSI.

• Cause #13 blocks an LA, not the PLMN : WCDMA2 is in the same PLMN as WCDMA1, and the UE still tries it because its LAI differs.
• PLMN selection follows the reject : This is the difference from cause #15, which only needs a cell in another LA.
• The list is kept in the ME : It is erased at switch off, at USIM removal and every 12 to 24 hours.

Cause #15 - ‘No Suitable Cells In LA’

When a UE recieves the Location Update Reject with Cause #15, UE has to do following steps. The list is the same as for cause #13, but the UE stays in its PLMN.

i) UE has to store this LAI in the 'forbidden LAs for roaming' list in UE so that it would not keep retrying the location updating process.

ii) UE has to searches for a suitable cell in the same PLMN but belonging to an LA which is not in the ‘forbidden LAs for roaming’ list

Cause #15 uses the same list as cause #13, but the next step is lighter. The UE keeps its equivalent PLMN list and searches for a suitable cell in another location area. 24.008 v20.0.0 also allows that cell to be a tracking area, so a UE that supports E-UTRA can also continue on an LTE cell.

One possible test scenario can be as follows. (This is based on GSMA TS11 17.1.2. I converted the test description into an illustration). This sequence shows only the important portions, there should be many additional common message in between each step (usually at the location of orange dotted lines). This is just one example, there can be a lot of variations of steps depending on network operators.

Condition :

PLMN of WCDMA1, WCDMA2, GSM are all same.

LAI of WCDMA1, WCDMA2, GSM are all different

The sequence below has the same shape as the one for cause #13. Two IMSI attach attempts on WCDMA1 and WCDMA2 are rejected with cause #15, and each LAI goes into the list of forbidden location areas for roaming. The third attempt on GSM, in the same PLMN, is accepted.

• Cause #15 means this LA has no suitable cell for the UE : The PLMN is fine, so the UE stays in it.
• The next step is cell search, not PLMN selection : This makes recovery faster than with cause #13.
• The TMSI is not deleted : 24.008 lists no TMSI deletion for #13 and #15.

How do the forbidden lists differ ?

Four causes fill three different lists, and the lists do not behave the same way. When you debug a UE that refuses to register, check which list holds the entry and when that list is cleared. The table below puts the rules of 24.008 clause 4.4.1 and 23.122 clause 3.1 side by side.

One more rule matters on live networks. In 24.008 clause 4.1.1.6A, a UE that is not configured to use T3245 treats a reject without integrity protection with extra care. Take a reject with cause #2, #3, #6, #11, #12, #13 or #15 that arrives before the network has activated integrity protection for the CS domain. On such a reject, the UE starts T3247 with a random value between 30 and 60 minutes. For causes #12, #13 and #15, it still applies the normal actions of clause 4.4.4.7. For cause #11 in its HPLMN or an EHPLMN, it only bars the current location area instead of the PLMN.

• Only the forbidden PLMN list lives in the SIM : The two forbidden LA lists are in the ME and disappear with a power cycle.
• Causes #13 and #15 share one list : They differ in the next step, PLMN selection against cell search.
• An unprotected reject is not fully trusted : T3247 limits how long a possibly fake reject can keep the UE away.

Reference

• 3GPP TS 24.008 v20.0.0 : Mobile radio interface Layer 3 specification; Core network protocols; Stage 3
• 3GPP TS 23.122 v20.0.0 : Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode