LTE EMM Cause #19: ESM Failure in Attach Reject — APN and PDN Diagnosis

LTE EMM cause #19 (“ESM failure”) is returned in an Attach Reject when the EPS Session Management (ESM) procedure embedded in the Attach Request fails. Unlike most other EMM cause codes which reflect subscription or PLMN restrictions, cause #19 specifically indicates a failure in establishing the default PDN (Packet Data Network) connection — the data bearer that is a prerequisite for LTE connectivity, including IMS registration for VoLTE.

The key diagnostic feature: an Attach Reject with cause #19 always contains an ESM message container IE that embeds the specific ESM failure reason. Reading this inner ESM cause is essential for precise root cause identification.

Technical Reference

Field	Value
Cause code	#19 (decimal) / 0x13 (hexadecimal)
IE name	EMM cause
Standard	3GPP TS 24.301 §9.9.3.9, Table 9.9.3.9.1
NAS message	Attach Reject only (not TAU Reject or Service Reject)
Back-off timer	None
UE state after	EMM-DEREGISTERED
Embedded IE	ESM message container (TS 24.301 §9.9.3.15)

The Two-Layer Failure: EMM + ESM

An LTE Attach Request contains two nested NAS messages:

1. The EMM Attach Request (outer layer) — handles registration, security, and mobility
2. The ESM Activate Default EPS Bearer Context Request (inner ESM message) — requests the default PDN connection

When the MME processes the attach, it also forwards the embedded PDN Connectivity Request to the P-GW (Packet Data Network Gateway) via the S5/S8 interface. If the P-GW rejects the PDN establishment, the MME has two options:

• Send a standalone Activate Default EPS Bearer Context Reject (only if the UE had already successfully attached)
• Reject the entire attach with EMM cause #19, embedding an ESM Activate Default EPS Bearer Context Reject in the Attach Reject

The second path — cause #19 — occurs when the PDN failure happens during the initial attach, before the UE has reached the EMM-REGISTERED state.

ESM Cause Codes Embedded in Cause #19

The ESM message container in the Attach Reject carries the specific PDN failure reason. The most field-relevant ESM cause codes (defined in TS 24.301 §9.9.4.4, Table 9.9.4.4.1):

ESM Cause	Value	Meaning
Missing or unknown APN	#27	APN not provisioned in HSS or not reachable
Unknown PDN type	#28	PDN type (IPv4/IPv6) not supported
User authentication failed	#29	PAP/CHAP authentication to the APN failed
Activation rejected by GW	#30	PGW rejected, reason unspecified
Service option not subscribed	#33	PDN type or APN not in UE’s subscription
Network failure	#38	PGW or SGW internal failure
Protocol error	#111	General protocol error at ESM layer

Field Scenarios

APN not provisioned in the HSS subscription. The UE requests connectivity to an APN (e.g., “internet”) that is not included in the subscriber’s PDN Subscription Context in the HSS. The PGW rejects the Create Session Request and the MME returns cause #19 with ESM cause #27. Very common after SIM card replacements where the APN provisioning on the new IMSI is incomplete.

Wrong PDN type. The UE requests IPv4 connectivity but the APN is provisioned as IPv6-only (or the PGW does not support the requested PDN type). ESM cause #28 is returned. More common in operators migrating to IPv6-only PDN configurations.

PGW unreachable or failed. The SGW cannot establish the S5 tunnel to the PGW (PGW is overloaded, the DNS resolution for the PGW address failed, or an S5 interface failure occurred). The SGW returns an error to the MME, which translates to EMM cause #19 with ESM cause #38 (network failure).

PAP/CHAP authentication failure. Some enterprise APNs require username/password authentication. If the credentials configured on the device do not match what the RADIUS server or GGSN expects, authentication fails and ESM cause #29 is returned.

Step-by-Step Field Diagnosis

Step 1 — Confirm cause #19 in the Attach Reject. Locate the EMM cause IE value 0x13. This immediately indicates a PDN-layer failure, not a subscription or PLMN restriction.

Step 2 — Extract the ESM message container. The Attach Reject with cause #19 contains an ESM message container IE. Decode this inner ESM message to read the Activate Default EPS Bearer Context Reject, which carries the specific ESM cause (IE type 0x69 within the ESM message).

Step 3 — Identify the APN in the original Attach Request. In the Attach Request, locate the ESM embedded message (Activate Default EPS Bearer Context Request) and read the APN IE. This is the APN the UE attempted to connect to. Cross-reference with the device’s APN settings.

Step 4 — Verify APN provisioning in the HSS. On the operator side, confirm the IMSI’s PDN Subscription Context in the HSS includes the requested APN. A missing APN context produces ESM cause #27.

Step 5 — Check the SGW/PGW interface. If the ESM cause is #38 (network failure) or #30 (activation rejected by GW), the issue is infrastructure-side: SGW-PGW S5 interface reachability, PGW load, or DNS resolution of the PGW FQDN. This requires coordination with the core network operations team.

Capturing Cause #19 in the Field

DIAG log code 0x713A (LTE NAS EMM plain OTA incoming) captures the full Attach Reject including the embedded ESM message container. A DIAG-level decoder expands both the outer EMM message and the inner ESM message as nested ASN.1 trees, making both EMM cause #19 and the inner ESM cause immediately visible in one message view.

This two-layer decode is only possible with modem-level DIAG access — standard Android telephony APIs expose neither the Attach Reject message nor its embedded ESM container.

Related Cause Codes

• Cause #17 — Network failure (general MME failure, not ESM-specific)
• ESM Cause #27 — Missing or unknown APN (most common inner cause of EMM cause #19)
• ESM Cause #38 — Network failure at ESM layer (PGW or SGW issue)
• Cause #67 in 5GS NAS — Insufficient resources for specific slice and DNN (5GS equivalent of PDN rejection)
• Cause #72 in 5GS NAS — DNN not supported or not subscribed in the slice (5GS equivalent of ESM cause #27)