Skip to main content

OmniEIR Troubleshooting

Overview | Configuration Reference | Operations Guide | Metrics and Monitoring

Common issues​

Every device is allowed even though I provisioned a blacklist rule​

Check, in order:

  1. Is the AMF check enabled? The gate is off by default. Set config :omniamf, eir_enabled: true and restart the AMF. Without it the AMF never queries OmniEIR.
  2. Can OmniEIR reach OmniHSS? A failure to read GET /api/eir/rule fails open (device allowed). Watch for Could not read EIR rules from HSS in the OmniEIR logs and [:omnieir, :hss, :request] telemetry with result: :failure. Confirm hss_api_base_url.
  3. Does the regex match the PEI form the UE presents? The rule regex is matched against the digit string. A rule written for a 14-digit IMEI will not match a 15-digit imei- PEI unless the regex is anchored to allow it. Test the regex against the exact PEI digits.
  4. Did the AMF actually receive a PEI? If the UE presented no PEI, the AMF logs EIR enabled but UE ... presented no PEI; allowing and proceeds.

The AMF rejects a device I did not intend to bar​

  • A rule's regex is broader than intended (e.g. ^3531 matches a whole TAC range). Narrow it.
  • unknown_equipment_status is set to BLACKLISTED (fail-closed) and the device matches no rule. Either add a whitelist rule for it or revert to the default WHITELISTED.

400 MANDATORY_QUERY_PARAM_INCORRECT​

The pei query parameter was missing from the request to /n5g-eir-eic/v1/equipment-status. It is mandatory (TS 29.511).

500 SYSTEM_FAILURE from OmniEIR​

OmniEIR could not read the rule set from OmniHSS. This is an upstream (HSS) problem; the AMF treats a non-2xx as fail-open. Check OmniHSS health and hss_api_base_url.

Architecture notes​

OmniEIR has no provisioning API of its own: the IMEI allow/block/grey rules live in OmniHSS (one rule set shared with the 4G S13 interface), and OmniEIR reads them over the HSS REST API and applies the identical matching logic. The AMF gate is fail-open by design (see Operations), and the N5g-eir service is a single equipment-status Get per TS 29.511. Terminate TLS at an external proxy in front of the SBI listener.

Last updated on