nRF9151 DK + SIM card registration rejected

[Jachym]

Hello all,

I've just bought nRF9151 DK and went with Quick Start. I loaded nRF Cloud multi-service sample. 
Sample runs and connect to network. Sometimes it sends data (location + temperature) but only once.
After that I got disconnect from network and end up in attaching state forever.

The behavior of the sim cards is totally the same (Onomondo and wireless logic).

I saw that in Czech Republic eDRX and PSM is not support for LTE-M either NB-IOT.
Should I somehow disable these features? 

I am including log file. 

*** Booting My Application v2.1.0-dev-ae1ee57f3906 ***
*** Using nRF Connect SDK v3.0.0-3bfc46578e42 ***
*** Using Zephyr OS v4.0.99-a0e545cb437a ***
I: Starting bootloader
I: Primary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
I: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
I: Boot source: none
I: Image index: 0, Swap type: none
I: Bootloader chainload address offset: 0x18000
I: Image version: v0.0.0
All pins have been configured as non-secure
Booting TF-M v2.1.1-ncs4
[Sec Thread] Secure image initializing!
TF-M isolation level is: 0x00000001
TF-M Float ABI: Hard
Lazy stacking enabled
[00:00:00.253,784] <inf> spi_nor: gd25wb256e3ir@1: 32 MiBy flash
*** Booting nRF Connect SDK v3.0.0-3bfc46578e42 ***
*** Using Zephyr OS v4.0.99-a0e545cb437a ***
[00:00:00.261,474] <inf> main: nRF Cloud multi-service sample has started, version: 1.0.0, protocol: CoAP
[00:00:00.261,505] <inf> application: Reset reason: 0x1
[00:00:00.261,779] <inf> cloud_connection: Enabling connectivity...
[00:00:00.522,888] <inf> nrf_modem_lib_trace: Trace thread ready
[00:00:00.530,792] <inf> nrf_modem_lib_trace: Trace level override: 2
[00:00:00.631,225] <inf> cloud_connection: Setting up nRF Cloud library...
[00:00:00.719,848] <inf> nrf_cloud_info: Device ID: 50343956-3037-4a98-8010-1617c7895929
[00:00:00.720,428] <inf> nrf_cloud_info: IMEI:      359404230087661
[00:00:00.806,701] <inf> nrf_cloud_info: UUID:      50343956-3037-4a98-8010-1617c7895929
[00:00:00.807,159] <inf> nrf_cloud_info: Modem FW:  mfw_nrf91x1_2.0.2
[00:00:00.807,220] <inf> nrf_cloud_info: Protocol:          CoAP
[00:00:00.807,250] <inf> nrf_cloud_info: Download protocol: HTTPS
[00:00:00.807,250] <inf> nrf_cloud_info: Sec tag:           16842753
[00:00:00.807,281] <inf> nrf_cloud_info: CoAP JWT Sec tag:  16842753
[00:00:00.807,312] <inf> nrf_cloud_info: Host name:         coap.nrfcloud.com
[00:00:01.149,108] <inf> nrf_cloud_credentials: Sec Tag: 16842753; CA: Yes, Client Cert: Yes, Private Key: Yes
[00:00:01.149,169] <inf> nrf_cloud_credentials: CA Size: 1792, AWS: Likely, CoAP: Likely
[00:00:01.149,169] <inf> cloud_connection: Waiting for network ready...
[00:00:07.759,368] <inf> cloud_connection: Network connectivity gained!
[00:00:08.759,613] <inf> cloud_provisioning: Initializing the nRF Provisioning library...
[00:00:08.759,643] <inf> nrf_provisioning_coap: Init CoAP client
[00:00:08.759,918] <inf> cloud_connection: Network is ready
[00:00:08.797,485] <inf> nrf_provisioning: Checking for provisioning commands in 2s seconds
[00:00:10.797,576] <inf> cloud_provisioning: Provisioning is active.
[00:00:10.986,541] <inf> nrf_provisioning_coap: DTLS setup
[00:00:12.430,816] <inf> nrf_provisioning_coap: Connected
[00:00:13.268,768] <inf> nrf_provisioning_coap: Requesting commands
[00:00:13.524,902] <inf> nrf_provisioning_coap: No more commands to process on server side
[00:00:13.527,038] <err> net_coap: No client found for socket 3
[00:00:13.527,984] <inf> nrf_provisioning: Checking for provisioning commands in 1804s seconds
[00:00:18.527,221] <inf> cloud_provisioning: Provisioning is idle.
[00:00:18.527,282] <inf> cloud_connection: Connecting to nRF Cloud
[00:00:19.956,634] <inf> nrf_cloud_coap_transport: Request authorization with JWT
[00:00:20.308,990] <inf> nrf_cloud_coap_transport: Authorization result_code: 2.01
[00:00:20.309,143] <inf> nrf_cloud_coap_transport: Authorized
[00:00:20.309,387] <inf> nrf_cloud_coap_transport: DTLS CID is active
[00:00:26.416,412] <inf> cloud_connection: Connected to nRF Cloud
[00:00:26.416,473] <inf> cloud_connection: Reducing provisioning check interval to 30 minutes
[00:00:26.416,564] <inf> shadow_support_coap: Checking for shadow delta...
[00:00:26.417,816] <inf> nrf_cloud_fota_poll: Checking for FOTA job...
[00:00:26.417,846] <inf> application: Waiting for modem to determine current date and time
[00:00:26.417,877] <inf> application: Current date and time determined
[00:00:26.417,907] <inf> nrf_cloud_log: Changing cloud logging enabled to:1
[00:00:26.709,411] <inf> shadow_config: Sending reported configuration
[00:00:32.499,969] <inf> application: Temperature is 23 degrees C
[00:00:32.500,213] <inf> nrf_cloud_pgps: Storage base:0xEB000, size:86016
[00:00:32.502,105] <inf> nrf_cloud_pgps: Checking P-GPS header: Schema version:1, type:10, num:1, count:42
[00:00:32.502,136] <inf> nrf_cloud_pgps:   size:2006, period (minutes):240, GPS day:16643, GPS time:72000
[00:00:32.502,166] <inf> nrf_cloud_pgps: Checking stored P-GPS data; count:42, period_min:240
[00:00:32.502,655] <inf> nrf_cloud_pgps: Checking if P-GPS data is expired...
[00:00:32.502,716] <inf> nrf_cloud_pgps: Found valid prediction, day:16644, time:57600
[00:00:32.502,746] <inf> nrf_cloud_pgps: P-GPS data is up to date.
[00:00:38.870,056] <inf> nrf_cloud_fota_poll: No pending FOTA job
[00:00:38.870,086] <inf> fota_support_coap: Checking for FOTA job in 120 seconds
[00:00:39.718,414] <inf> nrf_cloud_pgps: Searching for prediction
[00:00:39.718,505] <inf> nrf_cloud_pgps: Searching for prediction
[00:00:39.718,597] <inf> nrf_cloud_pgps: GPS unit needs ephemerides. Injecting 32.
[00:00:42.789,855] <inf> shadow_support_coap: Checking for shadow delta...
[00:00:45.692,565] <inf> shadow_support_coap: Checking shadow again in 120 seconds
[00:01:19.805,236] <inf> location: Method specific timeout expired
[00:01:19.806,121] <inf> location: Location retrieval failed using 'GNSS', trying with 'Cellular' next
[00:01:25.928,192] <wrn> lte_lc: Registration rejected, EMM cause: 15, Cell ID: 84631298, Tracking area: 1320, LTE mode: 7
[00:01:25.928,314] <inf> nrf_provisioning: Disconnected from network - provisioning paused
[00:01:25.928,619] <inf> cloud_connection: Network connectivity lost!
[00:01:25.928,741] <inf> cloud_connection: Disconnected from nRF Cloud
[00:01:25.928,741] <inf> cloud_connection: Retrying in 30 seconds...
[00:01:25.928,802] <err> nrf_cloud_coap: Location response decoding error: -140
[00:01:25.928,833] <err> location: Failed to acquire location using cloud location, error: -140
[00:01:25.928,894] <err> location: Location acquisition failed and fallbacks are also done
[00:01:28.798,736] <wrn> lte_lc: Registration rejected, EMM cause: 9, Cell ID: 84631309, Tracking area: 9550, LTE mode: 7
[00:01:28.798,797] <inf> nrf_provisioning: Disconnected from network - provisioning paused
[00:01:29.899,719] <wrn> lte_lc: Registration rejected, EMM cause: 15, Cell ID: 84631309, Tracking area: 9550, LTE mode: 7
[00:01:55.928,863] <inf> cloud_connection: Waiting for network ready...
[00:02:32.500,000] <inf> application: Temperature is 22 degrees C
[00:03:14.432,281] <wrn> lte_lc: Registration rejected, EMM cause: 19, Cell ID: 84631383, Tracking area: 11320, LTE mode: 9
[00:03:20.208,526] <wrn> lte_lc: Registration rejected, EMM cause: 15, Cell ID: 84631469, Tracking area: 65000, LTE mode: 9
[00:04:32.500,061] <inf> application: Temperature is 22 degrees C
[00:04:41.546,142] <wrn> lte_lc: Registration rejected, EMM cause: 13, Cell ID: 1072417, Tracking area: 47030, LTE mode: 9
[00:05:27.558,837] <wrn> lte_lc: Registration rejected, EMM cause: 19, Cell ID: 84631383, Tracking area: 11320, LTE mode: 9
[00:06:32.500,122] <inf> application: Temperature is 24 degrees C
[00:06:32.501,434] <err> nrf_cloud_alert: Error sending alert via CoAP: -13
[00:06:32.501,495] <inf> application: Temperature limit 24.000000 C exceeded: now 24.025000 C.
[00:07:56.045,928] <wrn> lte_lc: Registration rejected, EMM cause: 19, Cell ID: 84631383, Tracking area: 11320, LTE mode: 9
[00:08:05.963,500] <inf> location: Method specific timeout expired
[00:08:05.963,531] <wrn> location: GNSS timed out possibly due to too short GNSS time windows
[00:08:05.964,416] <inf> location: Location retrieval failed using 'GNSS', trying with 'Cellular' next
[00:08:11.596,069] <wrn> location: Default PDN context is NOT active, cannot retrieve a location
[00:08:11.596,130] <err> location: Location acquisition failed and fallbacks are also done
[00:08:32.500,183] <inf> application: Temperature is 23 degrees C
[00:10:32.500,244] <inf> application: Temperature is 22 degrees C
[00:11:36.216,552] <wrn> lte_lc: Registration rejected, EMM cause: 19, Cell ID: 84631383, Tracking area: 11320, LTE mode: 9
[00:12:32.500,274] <inf> application: Temperature is 23 degrees C
[00:14:32.500,335] <inf> application: Temperature is 22 degrees C
[00:14:32.500,457] <inf> application: Temperature now below limit: 22.375000 C.
[00:14:55.089,843] <inf> location: Method specific timeout expired
[00:14:55.089,874] <wrn> location: GNSS timed out possibly due to too short GNSS time windows
[00:14:55.090,637] <inf> location: Location retrieval failed using 'GNSS', trying with 'Cellular' next
[00:15:08.395,751] <wrn> location: Default PDN context is NOT active, cannot retrieve a location
[00:15:08.395,812] <err> location: Location acquisition failed and fallbacks are also done
[00:16:12.709,808] <wrn> lte_lc: Registration rejected, EMM cause: 19, Cell ID: 84631383, Tracking area: 11320, LTE mode: 9
[00:16:32.500,427] <inf> application: Temperature is 23 degrees C
[00:18:32.500,488] <inf> application: Temperature is 22 degrees C
[00:18:46.317,260] <wrn> lte_lc: Registration rejected, EMM cause: 19, Cell ID: 84631383, Tracking area: 11320, LTE mode: 9
uart:~$

Thank you for help.
Br, Jachym

[Øyvind]

Hello, 

Yes, your device is being rejected by the network, on both NB-IoT and LTE-M. There are several EMM reject causes provided (in ascending order). 

Cause #9 – UE identity cannot be derived by the network.

      This EMM cause is sent to the UE when the network cannot derive the UE’s identity from the GUTI/S-TMSI/P-TMSI and RAI e.g. no matching identity/context in the network or failure to validate the UE’s identity due to integrity check failure of the received message.

Cause #13 – Roaming not allowed in this tracking area

      This EMM cause is sent to an UE which requests service, or if the network initiates a detach request, in a tracking area of a PLMN which by subscription offers roaming to that UE but not in that tracking area.

Cause #15 – No suitable cells in tracking area

      This EMM cause is sent to the UE if it requests service, or if the network initiates a detach request, in a tracking area where the UE, by subscription, is not allowed to operate, but when it should find another allowed tracking area or location area in the same PLMN or an equivalent PLMN.

NOTE 3:  Cause #15 and cause #12 differ in the fact that cause #12 does not trigger the UE to search for another allowed tracking area on the same PLMN.

Cause #19 – ESM failure

      This EMM cause is sent to the UE when there is a failure in the ESM message contained in the EMM message.

Could you please provide a modem trace from your device when you see these issues?

One thing to test is using a local SIM from e.g. Eurotel or Vodafone CZ. See GSMA Mobile Deployment map for LTE-M and NB-IoT coverage in Czech Republic. Looking at the coverage map of the Onomondo SIM it seems that they do not have roaming coverage in Czech Republic, but Wireless Logic seemingly has.

Kind regards,
Øyvind

[Jachym]

Hello Øyvind,

Thank you for quick response.

I see this issue every time, it is not sporadic. Unfortunately right know I don't have another SIM so I have to order one from Vodafone. 

I include modem traces as you request (used SIM Wireless Logic).

Google disc - traces 

BR, 
Jachym

[Øyvind]

Can you please capture a modem trace using each SIM card? Just to verify that both SIM seeing the same issue.

Thanks!

[Jachym]

I captured traces with onomondo sim card. The behavior looks the same as conexa.
I am attaching traces (the new ones are with the onomondo_prefix and conexa without any prefix): Google disc - traces

BR, 
Jachym

[Øyvind]

Thanks, Jachym! I've forwarded internally to get more feedback the modem developers.I hope to have some answer by end of tomorrow.

Kind regards,
Øyvind

[Øyvind]

Hello, I've got some feedback from our modem team. This might be a case of ePCO/Protocol Configuration Options (PCO), where the network you are connecting to are using legacy PCO. Could you try issuing AT%XEPCO=0 to you modem or setting CONFIG_PDN_LEGACY_PCO=y

Also, it seems that modem is still trying to connect using IPV4V6, could you try setting CONFIG_PDN_DEFAULT_FAM_IPV4=y as well?
Edit: You might need to set CONFIG_PDN_DEFAULTS_OVERRIDE=y 

[Jachym]

Hello,

I tested both configurations. Unfortunately it still doesn't work. 

I am including traces: 
1. config CONFIG_PDN_LEGACY_PCO=y (traces have prefix CONFIG_PDN_LEGACY_PCO_)
2. config CONFIG_PDN_DEFAULT_FAM_IPV4=y && CONFIG_PDN_DEFAULTS_OVERRIDE=y (traces have prefix CONFIG_PDN_DEFAULT_FAM_IPV4_)

Trace are here: Google disc: Traces

BR,
Jachym

[Øyvind]

Hello Jachym, 
Thanks for testing and providing modem traces. I was out of office yesterday and not able to forward internally. Will do so now I hope to have an answer within end of tomorrow.

Kind regards,
Øyvind

[Øyvind]

Hi, the issue seems to be with the network and/or SIM used. There have been several issues reported from the Czech Republic similar to yours. Our modem team are working on this.

The best recommendation at the moment is for you to reach out directly to Onomondo and Conexa, and report the issues you are having with the network. 

Sorry for the inconvenience.

[Øyvind]

Hello, our team have been in contact with Onomondo. Currently the best solution is for you to use  PLMN access limitation %PALL to blacklist the Vodafone network. Onomondo does not provide Vodafone LTE-M, only O2 and T-mobile. 

Please test and let us know how that works!

Kind regards,
Øyvind

[Jachym]

Hello,
Sorry for the late reply but I was on vacation.
I tried to set PLMN and add Vodafone to blacklist like this: AT%PALL=0,1,”23001”,3
MMC: 230 and MNC:03, LTE-M + NB-IOT (found here). 

For test I used example from Dev Academy Cellular IoT Fundamentals l3/l3_e1.
I added PLMN config before connect like this:

    err = nrf_modem_at_printf("%s", "AT%PALL=0,1,\"23003\",3");                //Blacklist PLMN 23003 - Vodafone
    if (err)
    {
        LOG_ERR("Failed to send AT command, error: %d", err);
        return err;
    }

    LOG_INF("Connecting to LTE network");
    err = lte_lc_connect_async(lte_handler);
    if (err)
    {
        LOG_ERR("Error in lte_lc_connect_async, error: %d", err);
        return err;
    }

I also enabled only LTE-M in prj.conf since only LTE-M is supported by Onomondo.

# Use only LTE-M
CONFIG_LTE_NETWORK_MODE_LTE_M=y

Here is result traces:

*** Booting nRF Connect SDK v3.0.2-89ba1294ac9b ***
*** Using Zephyr OS v4.0.99-f791c49f492c ***
[00:00:00.407,928] <inf> Lesson3_Exercise1: Initializing modem library
[00:00:00.675,231] <inf> Lesson3_Exercise1: Connecting to LTE network
[00:00:07.257,934] <inf> Lesson3_Exercise1: Not connected to network, status: 2
[00:00:07.257,965] <inf> Lesson3_Exercise1: Cell update: MCC 0, MNC 0, Cell ID 0x050b5f02, TAC 1320
[00:00:07.257,995] <inf> Lesson3_Exercise1: LTE mode: LTE-M
[00:00:07.311,340] <inf> Lesson3_Exercise1: RRC mode: Connected
[00:00:16.307,952] <inf> Lesson3_Exercise1: Network registration status: Connected - roaming
[00:00:16.308,715] <inf> Lesson3_Exercise1: AT command sent: AT%PALL=1
[00:00:16.308,746] <inf> Lesson3_Exercise1: AT command response: %PALL: 1,"23003",3
OK

[00:00:16.308,807] <inf> Lesson3_Exercise1: Connected to LTE network
[00:00:16.729,553] <inf> Lesson3_Exercise1: IPv4 Address found 20.82.16.164
[00:00:16.730,285] <inf> Lesson3_Exercise1: Successfully connected to server
[00:00:16.730,316] <inf> Lesson3_Exercise1: Press button 1 on your DK or Thingy:91 to send your message
[00:00:18.779,602] <inf> Lesson3_Exercise1: Successfully sent message: Hi from nRF91 Series device
[00:00:19.279,724] <inf> Lesson3_Exercise1: Data received from the server: (Time: 2025-09-06 18:10:07 Message: Hi from nRF91 Series device)
[00:00:20.296,386] <inf> Lesson3_Exercise1: Successfully sent message: Hi from nRF91 Series device
[00:00:20.559,783] <inf> Lesson3_Exercise1: Data received from the server: (Time: 2025-09-06 18:10:08 Message: Hi from nRF91 Series device)
[00:00:21.667,663] <inf> Lesson3_Exercise1: Successfully sent message: Hi from nRF91 Series device
[00:00:22.159,881] <inf> Lesson3_Exercise1: Data received from the server: (Time: 2025-09-06 18:10:10 Message: Hi from nRF91 Series device)
[00:00:23.083,953] <inf> Lesson3_Exercise1: Successfully sent message: Hi from nRF91 Series device
[00:00:23.439,941] <inf> Lesson3_Exercise1: Data received from the server: (Time: 2025-09-06 18:10:11 Message: Hi from nRF91 Series device)
[00:00:24.601,318] <inf> Lesson3_Exercise1: Successfully sent message: Hi from nRF91 Series device
[00:00:25.040,008] <inf> Lesson3_Exercise1: Data received from the server: (Time: 2025-09-06 18:10:13 Message: Hi from nRF91 Series device)
[00:00:25.941,406] <inf> Lesson3_Exercise1: Successfully sent message: Hi from nRF91 Series device
[00:00:26.320,068] <inf> Lesson3_Exercise1: Data received from the server: (Time: 2025-09-06 18:10:14 Message: Hi from nRF91 Series device)
[00:00:27.296,722] <inf> Lesson3_Exercise1: Successfully sent message: Hi from nRF91 Series device
[00:00:27.600,128] <inf> Lesson3_Exercise1: Data received from the server: (Time: 2025-09-06 18:10:15 Message: Hi from nRF91 Series device)
[00:00:48.462,646] <inf> Lesson3_Exercise1: RRC mode: Idle
[00:00:59.685,272] <inf> Lesson3_Exercise1: Successfully sent message: Hi from nRF91 Series device
[00:00:59.773,925] <inf> Lesson3_Exercise1: RRC mode: Connected
[00:00:59.845,794] <wrn> lte_lc: Registration rejected, EMM cause: 15, Cell ID: 84631298, Tracking area: 1320, LTE mode: 7
[00:00:59.845,825] <inf> Lesson3_Exercise1: Not connected to network, status: 4
[00:00:59.903,198] <inf> Lesson3_Exercise1: RRC mode: Idle
[00:00:59.940,856] <inf> Lesson3_Exercise1: Cell update: MCC 0, MNC 0, Cell ID 0xffffffff, TAC -1
[00:00:59.940,917] <inf> Lesson3_Exercise1: LTE mode: NB-IoT

Based on traces I can see that LTE connection was established successfully.
I was able send/received multiple messages until device went to RRC_IDLE state.
After that I always got Registration rejected.

Here is saved log and sources file which are patched from example.

Question: Why last trace says: "[00:00:59.940,917] <inf> Lesson3_Exercise1: LTE mode: NB-IoT", if only LTE-M is enabled via kconfig? 

BR,
Jachym

[Øyvind]

Hello Jachym,

Can you please share the IMSI? 

Jachym said:

Here is saved log and sources file which are patched from example.

This links to prj.conf only. Can you please provide the information as a .zip file and upload via DevZone? Does this include modem traces as well?

Jachym said:

Question: Why last trace says: "[00:00:59.940,917] <inf> Lesson3_Exercise1: LTE mode: NB-IoT", if only LTE-M is enabled via kconfig? 

This is due to your device being rejected by the network (LTE-M) with reject:

Cause #15 – No suitable cells in tracking area

      This EMM cause is sent to the UE if it requests service, or if the network initiates a detach request, in a tracking area where the UE, by subscription, is not allowed to operate, but when it should find another allowed tracking area or location area in the same PLMN or an equivalent PLMN.

Kind regards,
Øyvind