EM9291 Not Connecting to Private 5G Network

We are attempting to attach a UE to a private 5G deployment and the UE uses the EM9291 modem. Output from qmicli suggests the SIM is ‘illegal’, but this SIM has been used to successfully connect other UEs to the same network.

voxl2:/$ qmicli -d /dev/cdc-wdm0 --uim-get-card-status 
[/dev/cdc-wdm0] Successfully got card status
Provisioning applications:
	Primary GW:   slot '1', application '1'
	Primary 1X:   session doesn't exist
	Secondary GW: session doesn't exist
	Secondary 1X: session doesn't exist
Slot [1]:
	Card state: 'present'
	UPIN state: 'not-initialized'
		UPIN retries: '0'
		UPUK retries: '0'
	Application [1]:
		Application type:  'usim (2)'
		Application state: 'illegal'
		Application ID:
			A0:00:00:00:87:10:02:FF:FF:FF:FF:89:07:09:00:00
		Personalization state: 'ready'
		UPIN replaces PIN1: 'no'
		PIN1 state: 'disabled'
			PIN1 retries: '3'
			PUK1 retries: '10'
		PIN2 state: 'enabled-not-verified'
			PIN2 retries: '3'
			PUK2 retries: '10'
	Application [2]:
		Application type:  'isim (5)'
		Application state: 'detected'
		Application ID:
			A0:00:00:00:87:10:04:FF:FF:FF:FF:89:07:09:00:00
		Personalization state: 'unknown'
		UPIN replaces PIN1: 'no'
		PIN1 state: 'disabled'
			PIN1 retries: '3'
			PUK1 retries: '10'
		PIN2 state: 'not-initialized'
			PIN2 retries: '0'
			PUK2 retries: '0'
Slot [2]:
	Card state: 'absent'
	UPIN state: 'not-initialized'
		UPIN retries: '0'
		UPUK retries: '0'

Based on the output of AT commands it seems like the network is visible to the modem:

voxl2:/$ busybox microcom /dev/ttyUSB0
at!entercnd="A710"
OK
ati3
Manufacturer: Sierra Wireless, Incorporated
Model: EM9291
Revision: SWIX65C_03.04.10.01 00b8ca jenkins 2025/06/18 05:56:16
IMEI: 358186652129789
IMEI SV: 11
FSN: 833415552901B1
+GCAP: +CGSM


OK
at!impref?
!IMPREF: 
 preferred fw version:    03.04.10.01
 preferred carrier name:  GENERIC
 preferred config name:   GENERIC_040.025_001
 preferred subpri index:  000
 current fw version:      03.04.10.01
 current carrier name:    GENERIC
 current config name:     GENERIC_040.025_001
 current subpri index:    000

OK
at!selrat?
!SELRAT: 00, Automatic


OK
at!band?
Index, Name
0C, NR5G ALL,
0 - GW:    0000000000000000
1 - LTE:   0000000000000000 0000000000000000
3 - NRNSA: 000081A03B0A38D7 0000000000007C62
4 - NRSA:  000081A03B0A38D7 0000000000007C62

OK
at!sdpref?
RATs : WCDMA,LTE,NR5G
GWC  : B1,B2,B4,B5,B6,B8,B19
LTE  : B1,B2,B3,B4,B5,B7,B8,B12,B13,B14,B17,B18,B19,B20,B25,B26,B28,B29,B30,B32,B34,B38,B39,B40,B41,B42,B43,B46,B48,B66,B71
TDS  : 
NRSA : n1,n2,n3,n5,n7,n8,n12,n13,n14,n18,n20,n25,n26,n28,n29,n30,n38,n40,n41,n48,n66,n70,n71,n75,n76,n77,n78,n79
NRNSA: n1,n2,n3,n5,n7,n8,n12,n13,n14,n18,n20,n25,n26,n28,n29,n30,n38,n40,n41,n48,n66,n70,n71,n75,n76,n77,n78,n79

OK
at!gstatus?
!GSTATUS: 
Current Time:  8240		Temperature: 35

Reset Counter: 1		Mode:        ONLINE         
System mode:   NR5G       	PS state:    Not attached 
MM5G state:    Deregistered     Limited Service
RRC state:     RRC Idle        
IMS reg state: NOT REGISTERED  	IMS mode:    Normal       
IMS Srv State: UNKNOWN SMS,UNKNOWN VoIP

NR5G TAC:        000001        		NR5G Cell ID:    D15 (3349)
NR5G band:       n78       		NR5G Carrier ID: 0
NR5G dl bw:      100 MHz   		NR5G ul bw:      100 MHz   
NR5G Tx Power:   ---        		NR5G Tx chan:    0
NR5G Rx chan:    624924
NR5G dl MIMO:    4         		NR5G ul MIMO:    1
NR5G(sub6) Rx0 RSSI (dBm):   -51.3	NR5G(sub6) Rx1 RSSI (dBm):   -52.8
NR5G(sub6) Rx2 RSSI (dBm):   ---  	NR5G(sub6) Rx3 RSSI (dBm):   ---	

NR5G RSRP (dBm): -79			NR5G RSRQ (dB):  -11
NR5G SINR (dB):  23.5


OK
at!lteinfo?
!LTEINFO: Not Available


OK
at!nrinfo?
!NRINFO: 
Connectivity Mode: SA

NR5G Cell ID:    D15 (3349)
NR5G band:       n78       		NR5G Carrier ID: 0
NR5G dl bw:      100 MHz   		NR5G ul bw:      100 MHz   
NR5G Tx Power:   ---        		NR5G Tx chan:    0
NR5G Rx chan:    624924
NR5G dl MIMO:    4         		NR5G ul MIMO:    1
NR5G(sub6) Rx0 RSSI (dBm):   -51.3	NR5G(sub6) Rx1 RSSI (dBm):   -52.8
NR5G(sub6) Rx2 RSSI (dBm):   ---  	NR5G(sub6) Rx3 RSSI (dBm):   ---	

NR5G RSRP (dBm): -79			NR5G RSRQ (dB):  -11
NR5G SINR (dB):  23.5


OK
AT+CGDCONT?
+CGDCONT: 1,"IPV4V6","internet","0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0",0,0,0,0,,,,,,,,,"",,,,0
+CGDCONT: 2,"IPV4V6","ims","0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0",0,0,0,0,,,,,,,,,"",,,,0

OK

Probably you need to capture network log and send to distributor for further analysis

Maybe I can help. Here is what I see - in the AT!GSTATUS? response, the status or state is Limited Service mode. Something went wrong with the module/SIM handshaking with the network. Network does not like something about that communications and tells the device, you have limited service. So need more information, over the air messages between the device and network. Yes, sometimes this happens.