LTE EMM Cause #11: PLMN Not Allowed — Roaming Rejection Diagnosis

LTE EMM cause #11 (“PLMN not allowed”) signals that the UE is attempting to register on a PLMN for which its subscription is not authorized. The consequence is immediate and persistent: the PLMN is added to the forbidden PLMN list stored on the USIM, and the UE initiates a new PLMN selection procedure — it will not attempt to register on this PLMN again until the list is cleared.

Cause #11 is frequently encountered in roaming scenarios, during network trials with test SIMs, and after operator infrastructure changes that affect roaming agreements at the HSS/HLR level.

Technical Reference

UE Behavior After Receiving Cause #11

Per 3GPP TS 24.301 §5.5.1.2.5:

• Set EPS update status to EU3 ROAMING NOT ALLOWED
• Delete stored GUTI, last visited registered TAI, TAI list, and eKSI from non-volatile memory
• Consider the USIM invalid for EPS and non-EPS services in this PLMN — this is more restrictive than cause #7 which restricts EPS only
• Delete the list of equivalent PLMNs (ePLMNs) associated with this PLMN
• Store the PLMN identifier in the forbidden PLMN list (EF_FPLMN on the USIM, per TS 23.122 §A.2)
• Enter state EMM-DEREGISTERED and initiate a new PLMN selection procedure (TS 23.122 §3.1)
• The UE will not attempt registration on the forbidden PLMN until EF_FPLMN is explicitly cleared

Field Scenarios

Roaming not authorized on this operator. The visited PLMN’s MME queries the HSS/HLR of the home PLMN via the Diameter S6a interface. If the roaming agreement does not cover this PLMN, or if the subscriber’s roaming profile excludes it, the HSS returns an error and the MME rejects with cause #11. The PLMN is then blacklisted on the UE’s USIM.

SIM with restricted PLMN list (EF_PLMNwAcT). Operator-branded SIMs can contain a preferred PLMN list in EF_PLMNwAcT (Preferred PLMN with Access Technology). If the visited PLMN is not in this list and the SIM’s PLMN selection behavior restricts attempts to unlisted PLMNs, the resulting rejection at the MME produces cause #11.

Post-merger PLMN consolidation. When an operator decommissions a legacy PLMN identifier after a merger (e.g., consolidating two PLMN codes), devices that stored the old PLMN in their registered PLMN will receive cause #11 on their first attach attempt, prompting a new PLMN selection.

Trial network with restricted access. Closed LTE trial networks often use a PLMN code that is not accessible to production SIMs. Every attach attempt from a non-whitelisted USIM produces cause #11, which progressively adds the trial PLMN to the forbidden list of those USIMs.

Step-by-Step Field Diagnosis

Step 1 — Confirm cause #11 in the Attach Reject. Decode the NAS message and verify the EMM cause IE value is 0x0B. A cause #11 in the very first Attach Reject (not preceded by any successful TAU) confirms the PLMN restriction applies from the first contact.

Step 2 — Identify the PLMN under which the reject was received. In the drive test log, record the PLMN ID (MCC + MNC) of the cell on which the Attach Reject was received. This is the PLMN that will be added to the forbidden list.

Step 3 — Observe the subsequent PLMN reselection. After cause #11, the UE enters PLMN search. In the RRC log, look for RRC_IDLE camp events on a new PLMN. If the UE remains on the same PLMN and retries, the modem firmware may not be correctly handling TS 24.301 §5.5.1.2.5.

Step 4 — Verify the forbidden PLMN list. On the device, checking the EF_FPLMN file on the USIM (using a SIM reader or a DIAG-level USIM command) reveals whether the rejected PLMN has been stored. This file can accumulate PLMNs across multiple rejection events.

Step 5 — Cross-validate with SIM provisioning. Verify with the home PLMN’s HSS/HLR that the IMSI’s roaming profile includes the visited PLMN. A missing or incorrectly configured Visited PLMN Allowed List in the HSS subscription data is the most common root cause.

Capturing Cause #11 in the Field

The Attach Reject with cause #11 is captured via DIAG log code 0x713A (LTE NAS EMM plain OTA incoming). In the decoded ASN.1 tree, the EMM cause IE value 0x0B is labeled “PLMN not allowed.” Immediately following the Attach Reject in the log, observe the RRC_IDLE state entry and the subsequent NAS PLMN search activity (visible in NAS internal state log code 0xB0EE).

The timing between cause #11 and the new PLMN selection initiation confirms whether the UE is handling the forbidden PLMN list correctly per TS 24.301.

Related Cause Codes

• Cause #12 — Tracking area not allowed (TAI-level, not PLMN-level restriction)
• Cause #14 — EPS services not allowed in this PLMN (EPS-only restriction, PLMN not fully barred)
• Cause #13 — Roaming not allowed in this tracking area (roaming restriction at TA level)
• Cause #11 in 5GS NAS — 5GS MM cause #11, TS 24.501 §9.11.3.2 (same name, 5GS context)