LTE EMM Cause #12: Tracking Area Not Allowed — NAS Rejection Diagnosis

LTE EMM cause #12 (“Tracking area not allowed”) is returned by the MME in an Attach Reject or TAU Reject when the tracking area where the UE is attempting to register is not permitted for its subscription. Unlike cause #15, which allows limited service, cause #12 is a definitive TA-level access restriction: the TAI is added to the forbidden tracking areas list and the UE ceases all normal service attempts in that TA.

Cause #12 is encountered in enterprise-restricted LTE zones, in roaming deployments with TA-level exclusions, and during drive testing when a device enters a TA configured for a different subscriber segment.

Technical Reference

UE Behavior After Receiving Cause #12

Per 3GPP TS 24.301 §5.5.1.2.5:

• Set EPS update status to EU3 ROAMING NOT ALLOWED
• Delete stored GUTI, last visited registered TAI, and TAI list
• Store the TAI in the “forbidden tracking areas” list — distinct from the forbidden tracking areas for roaming list used by cause #15
• Enter state EMM-DEREGISTERED and initiate a new PLMN/cell selection procedure
• Do not camp in this TA for normal service — the UE must find a cell in a different, non-forbidden TA
• Emergency calls remain possible — the UE may initiate an emergency Attach Request even in a forbidden TA

Distinction from cause #15: Cause #12 adds the TAI to the “forbidden tracking areas” list; cause #15 adds it to the “forbidden tracking areas for roaming” list. The key practical difference is that cause #12 prevents the UE from remaining camped in that TA even for non-registration purposes, whereas cause #15 allows limited service camping.

Field Scenarios

Enterprise or campus LTE with TA whitelist. A private LTE campus deployment (sCell or dedicated TAI) is configured in the MME to accept only USIM IMSIs belonging to the enterprise subscriber group. A commercial SIM inserted into a test device inside the campus receives cause #12 on every Attach Request. The UE searches for a public LTE cell in a different TAI and registers there instead.

Roaming with TA-level exclusion. An inter-operator roaming agreement covers the visited PLMN but explicitly excludes specific tracking areas (e.g., border zones, military areas, or TAs with insufficient tariff coverage). The visited MME checks the roaming subscriber’s profile and returns cause #12 for attach attempts in the excluded TAIs. The UE then reselects to an included TA of the same visited PLMN or searches for a different PLMN.

Subscriber group restriction via Access Restriction Data. The HSS profile of a specific subscriber group (e.g., IoT-only SIMs, M2M devices) includes an Access Restriction Data IE (TS 29.272 §7.3.31) that limits the allowed tracking areas. If the device is powered on in a TA outside the allowed set, the MME returns cause #12. This is a deliberate network design to limit IoT device registration to specific zones.

TA misconfiguration during LTE rollout. During network expansion, a newly activated eNB is placed in a TAI that was previously designated as a test TA and remains in the restricted-TA list of the MME configuration. Field test devices registering on the new eNB receive cause #12 until the MME configuration is updated to include the production TAI in the accepted list.

Step-by-Step Field Diagnosis

Step 1 — Confirm cause #12 in the NAS log. Locate the Attach Reject or TAU Reject carrying EMM cause IE value 0x0C. Record the TAI (MCC, MNC, TAC) of the cell on which the rejection was received — this TAI will be stored in the forbidden tracking areas list.

Step 2 — Distinguish from cause #15. If the next UE action is a PLMN search (visible in RRC log as MeasurementReport or SIB1 decoding across multiple PLMNs), cause #12 is confirmed: the UE cannot stay on any cell in this TA. If the UE remains camped in limited service, cause #15 is more likely.

Step 3 — Attempt registration on a cell in a different TA. Move the device to a cell with a different TAC. A successful attach confirms the restriction is TA-specific (cause #12 from one TA, normal service in another) rather than PLMN-wide (cause #11).

Step 4 — Test with an unrestricted USIM. Insert a SIM from a subscriber group without TA restrictions on the same cell in the same TA. A successful attach confirms the restriction is subscriber-group-specific, not an MME or RAN configuration error.

Step 5 — Verify the MME’s subscriber group configuration. On the operator side, confirm the IMSI’s Access Restriction Data in the HSS (TS 29.272 §7.3.31) and the MME’s Allowed TA list configuration for the subscriber group. A TAI absent from the allowed list or explicitly included in a restricted list produces cause #12.

Capturing Cause #12 in the Field

DIAG log code 0x713A (LTE NAS EMM plain OTA incoming) captures the Attach Reject or TAU Reject with cause #12. The decoded message shows the EMM cause IE 0x0C alongside the TAI of the cell in the NAS header fields. The subsequent PLMN/cell search (following cause #12) is visible in NAS state log 0xB0EE as an EMM-DEREGISTERED state entry followed by PLMN selection events.

Related Cause Codes

• Cause #15 — No suitable cells in tracking area (less severe TA restriction, limited service allowed)
• Cause #13 — Roaming not allowed in this tracking area (roaming-specific restriction, same TA scope)
• Cause #11 — PLMN not allowed (PLMN-level restriction, broader than TA-level)
• Cause #15 in 5GS NAS — 5GS MM cause #15, TS 24.501 §9.11.3.2 (5GS context, same TA restriction semantics)