The equipment (device) isn't allowed to use the network (illegalEquipment) -- e.g. blacklisted/barred IMEI.
Where you see it
In a returnError component of a MAP dialogue over TCAP/SCCP (roaming, SMS, call routing).
What to check
Check whether this IMEI is barred (e.g. in an EIR blacklist).
Check which network element sent the returnError (calling GT) and the operation it answered.
Got a trace with MAP error 12 illegalEquipment? Drop it in the analyzer: it finds the step that really failed first, which node sent the code and what to ask the other side. Captures, test-system PDFs and vendor exports. 5 free analyses a month, no sign-up.