6.4.1 UE-requested PDU session establishment procedure

24.5013GPPNon-Access-Stratum (NAS) protocol for 5G System (5GS)Release 18Stage 3TS

Tools: ARFCN - Frequency Conversion for 5G NR/LTE/UMTS/GSM

6.4.1.1 General

The purpose of the UE-requested PDU session establishment procedure is to establish a new PDU session with a DN, to perform handover of an existing PDU session between 3GPP access and non-3GPP access, to transfer an existing PDN connection in the EPS to the 5GS, to transfer an existing PDN connection in an untrusted non-3GPP access connected to the EPC to the 5GS, or to establish an MA PDU session to support ATSSS (see 3GPP TS 24.193 [13B]), or to relay the service associated with the RSC for 5G ProSe layer-3 UE-to-network relay (see 3GPP TS 24.554 [19E]). If accepted by the network, the PDU session enables exchange of PDUs between the UE and the DN.

The UE shall not request a PDU session establishment:

a) for an LADN when the UE is located outside the LADN service area;

b) to transfer a PDU session from non-3GPP access to 3GPP access when the 3GPP PS data off UE status is "activated" and the UE is not using the PDU session to send uplink IP packets for any of the 3GPP PS data off exempt services (see subclause 6.2.10);

c) when the UE is in NB-N1 mode, the UE has indicated preference for user plane CIoT 5GS optimization, the network has accepted the use of user plane CIoT 5GS optimization for the UE, and the number of PDU sessions that currently has user-plane resources established equals to the UE’s maximum number of supported user-plane resources;

d) to transfer a PDU session from 3GPP access to non-3GPP access when the UE has indicated preference for control plane CIoT 5GS optimization, the network has accepted the use of control plane CIoT 5GS optimization for the UE, and the Control plane only indication IE was received in the PDU SESSION ESTABLISHMENT ACCEPT message; or

e) to transfer a PDU session from the non-3GPP access to the 3GPP access when the UE is in NB-N1 mode, the UE has indicated preference for user plane CIoT 5GS optimization, the network has accepted the use of user plane CIoT 5GS optimization for the UE, and the number of PDU sessions that currently has user-plane resources established equals to the UE’s maximum number of supported user-plane resources.

6.4.1.2 UE-requested PDU session establishment procedure initiation

In order to initiate the UE-requested PDU session establishment procedure, the UE shall create a PDU SESSION ESTABLISHMENT REQUEST message.

NOTE 0: When IMS voice is available over either 3GPP access or non-3GPP access, the "voice centric" UE in 5GMM-REGISTERED state will receive a request from upper layers to establish the PDU session for IMS signalling, if the conditions for performing an initial registration with IMS indicated in 3GPP TS 24.229 [14] subclause U.3.1.2 are satisfied.

If the UE requests to establish a new PDU session, the UE shall allocate a PDU session ID which is not currently being used by another PDU session over either 3GPP access or non-3GPP access. If the N5CW device supports 3GPP access and requests to establish a new PDU session via 3GPP access, the N5CW device shall refrain from allocating "PDU session identity value 15". If the TWIF acting on behalf of the N5CW device requests to establish a new PDU session, the TWIF acting on behalf of the N5CW device shall allocate the "PDU session identity value 15".

The UE shall allocate a PTI value currently not used and shall set the PTI IE of the PDU SESSION ESTABLISHMENT REQUEST message to the allocated PTI value.

If the UE is registered for emergency services over the current access, the UE shall not request establishing a non-emergency PDU session over the current access. If the UE is registered for emergency services over the current access it shall not request establishing an emergency PDU session over the non-current access except if the request is for transferring the emergency PDU session to the non-current access. Before transferring an emergency PDU session from non-3GPP access to 3GPP access, or before transferring a PDN connection for emergency bearer services from untrusted non-3GPP access connected to EPC to 3GPP access, the UE shall check whether emergency services are supported in the NG-RAN cell (either an NR cell or an E-UTRA cell) on which the UE is camping.

NOTE 1: Transfer of an existing emergency PDU session or PDN connection for emergency bearer services between 3GPP access and non-3GPP access is needed e.g. if the UE determines that the current access is no longer available.

If the UE requests to establish a new emergency PDU session, the UE shall include the PDU session type IE in the PDU SESSION ESTABLISHMENT REQUEST message and shall set the IE to the IP version capability as specified in subclause 6.2.4.2.

If the UE requests to establish a new non-emergency PDU session with a DN, the UE shall include the PDU session type IE in the PDU SESSION ESTABLISHMENT REQUEST message and shall set the IE to one of the following values: the IP version capability as specified in subclause 6.2.4.2, "Ethernet" or "Unstructured" based on the URSP rules or based on UE local configuration (see 3GPP TS 24.526 [19]).

NOTE 2: When the UE initiates the UE-requested PDU session establishment procedure to transfer an existing non-IP PDN connection in the EPS to the 5GS, the UE can use locally available information associated with the PDN connection to select the PDU session type between "Ethernet" and "Unstructured".

If the UE requests to establish a new non-emergency PDU session with a DN and the UE requests an SSC mode, the UE shall set the SSC mode IE of the PDU SESSION ESTABLISHMENT REQUEST message to the SSC mode. If the UE requests to establish a PDU session of "IPv4", "IPv6" or "IPv4v6" PDU session type, the UE shall either omit the SSC mode IE or set the SSC mode IE to "SSC mode 1", "SSC mode 2", or "SSC mode 3". If the UE requests to establish a PDU session of "Ethernet" or "Unstructured" PDU session type, the UE shall either omit the SSC mode IE or set the SSC mode IE to "SSC mode 1" or "SSC mode 2". If the UE requests transfer of an existing PDN connection in the EPS to the 5GS or the UE requests transfer of an existing PDN connection in an untrusted non-3GPP access connected to the EPC to the 5GS, the UE shall set the SSC mode IE to "SSC mode 1".

If the UE requests to establish a new emergency PDU session, the UE shall set the SSC mode IE of the PDU SESSION ESTABLISHMENT REQUEST message to "SSC mode 1".

A UE supporting PDU connectivity service shall support SSC mode 1 and may support SSC mode 2 and SSC mode 3 as specified in 3GPP TS 23.501 [8].

If the UE requests to establish a new non-emergency PDU session with a DN, the UE may include the SM PDU DN request container IE with a DN-specific identity of the UE complying with network access identifier (NAI) format as specified in IETF RFC 7542 [37].

NOTE 3: The UE can avoid including both the SM PDU DN request container IE and the extended protocol configuration options IE with PAP/CHAP protocol identifiers in the PDU SESSION ESTABLISHMENT REQUEST message. The way to achieve this is implementation dependent.

If the UE requests to:

a) establish a new PDU session;

b) perform handover of an existing PDU session from non-3GPP access to 3GPP access;

c) transfer an existing PDN connection in the EPS to the 5GS according to subclause 4.8.2.3.1;

d) transfer an existing PDN connection in untrusted non-3GPP access connected to the EPC to the 5GS; or

e) establish user plane resources over 3GPP access of an MA PDU session established over non-3GPP access only;

and the UE at the same time intends to join one or more multicast MBS sessions that is associated to the PDU session, the UE should include the Requested MBS container IE in the PDU SESSION ESTABLISHMENT REQUEST message. In that case, the UE shall set the MBS operation to "Join multicast MBS session" and include the multicast MBS session information(s) and shall set the Type of multicast MBS session ID for each of the multicast MBS session information to either "Temporary Mobile Group Identity (TMGI)" or "Source specific IP multicast address" depending on the type of the multicast MBS session ID available in the UE. Then the remaining values of each of the multicast MBS session information shall be set as following:

a) if the Type of multicast MBS session ID is set to "Temporary Mobile Group Identity (TMGI)", the UE shall set the multicast MBS session ID to the TMGI; or

b) if the Type of multicast MBS session ID is set to "Source specific IP multicast address for IPv4" or " Source specific IP multicast address for IPv6", the UE shall set the Source IP address information and the Destination IP address information to the corresponding values.

The UE should not request to join a multicast MBS session for local MBS service if neither current TAI nor CGI of the current cell is part of the MBS service area(s) of the multicast MBS session, if the UE has valid information of the MBS service area(s) of the multicast MBS session.

NOTE 4: The UE obtains the details of the MBS session ID(s) i.e. TMGI, Source IP address information and Destination IP address information as a pre-configuration in the UE or during the MBS service announcement, which is out of scope of this specification.

The UE should set the RQoS bit to "Reflective QoS supported" in the 5GSM capability IE of the PDU SESSION ESTABLISHMENT REQUEST message if the UE supports reflective QoS and:

a) the UE requests to establish a new PDU session of "IPv4", "IPv6", "IPv4v6" or "Ethernet" PDU session type;

b) the UE requests to transfer an existing PDN connection in the EPS of "IPv4", "IPv6", "IPv4v6" or "Ethernet" PDN type or of "Non-IP" PDN type mapping to "Ethernet" PDU session type, to the 5GS; or

c) the UE requests to transfer an existing PDN connection in an untrusted non-3GPP access connected to the EPC of "IPv4", "IPv6" or "IPv4v6" PDN type to the 5GS.

NOTE 5: The determination to not request the usage of reflective QoS by the UE for a PDU session is implementation dependent.

The UE shall indicate the maximum number of packet filters that can be supported for the PDU session in the Maximum number of supported packet filters IE of the PDU SESSION ESTABLISHMENT REQUEST message if:

a) the UE requests to establish a new PDU session of "IPv4", "IPv6", "IPv4v6", or "Ethernet" PDU session type, and the UE can support more than 16 packet filters for this PDU session;

b) the UE requests to transfer an existing PDN connection in the EPS of "IPv4", "IPv6", "IPv4v6", or "Ethernet" PDN type or of "Non-IP" PDN type mapping to "Ethernet" PDU session type, to the 5GS and the UE can support more than 16 packet filters for this PDU session; or

c) the UE requests to transfer an existing PDN connection in an untrusted non-3GPP access connected to the EPC of "IPv4", "IPv6" or "IPv4v6" PDN type to the 5GS and the UE can support more than 16 packet filters for this PDU session.

The UE shall include the Integrity protection maximum data rate IE in the PDU SESSION ESTABLISHMENT REQUEST message to indicate the maximum data rate per UE for user-plane integrity protection supported by the UE for uplink and the maximum data rate per UE for user-plane integrity protection supported by the UE for downlink.

The UE shall set the MH6-PDU bit to "Multi-homed IPv6 PDU session supported" in the 5GSM capability IE of the PDU SESSION ESTABLISHMENT REQUEST message if the UE supports multi-homed IPv6 PDU session and:

a) the UE requests to establish a new PDU session of "IPv6" or "IPv4v6" PDU session type; or.

b) the UE requests to transfer an existing PDN connection of "IPv6" or "IPv4v6" PDN type in the EPS or in an untrusted non-3GPP access connected to the EPC to the 5GS.

The UE shall set the EPT-S1 bit to "Ethernet PDN type in S1 mode supported" in the 5GSM capability IE of the PDU SESSION ESTABLISHMENT REQUEST message if the UE supports Ethernet PDN type in S1 mode and requests "Ethernet" PDU session type.

If the UE requests to establish a new PDU session as an always-on PDU session (e.g. because the PDU session is for time synchronization or TSC), the UE shall include the Always-on PDU session requested IE and set the value of the IE to "Always-on PDU session requested" in the PDU SESSION ESTABLISHMENT REQUEST message.

NOTE 6: Determining whether a PDU session is for time synchronization or TSC is UE implementation dependent.

If the UE has an emergency PDU session, the UE shall not perform the UE-requested PDU session establishment procedure to establish another emergency PDU session. The UE may perform the UE-requested PDU session establishment procedure to transfer an existing emergency PDU session or an existing PDN connection for emergency services.

If:

a) the UE requests to perform handover of an existing PDU session between 3GPP access and non-3GPP access;

b) the UE requests to perform transfer an existing PDN connection in the EPS to the 5GS; or

c) the UE requests to perform transfer an existing PDN connection in an untrusted non-3GPP access connected to the EPC to the 5GS;

the UE shall:

a) set the PDU session ID in the PDU SESSION ESTABLISHMENT REQUEST message and in the UL NAS TRANSPORT message to the stored PDU session ID corresponding to the PDN connection; and

b) set the S-NSSAI in the UL NAS TRANSPORT message to the stored S-NSSAI associated with the PDU session ID of a non-emergency PDU session. The UE shall not request to perform handover of an existing non-emergency PDU session between 3GPP access and non-3GPP access if the S-NSSAI is not included in the allowed NSSAI for the target access.

If the N5CW device supports 3GPP access and requests to perform handover of an existing PDU session from non-3GPP access to 3GPP access, the N5CW device shall set the PDU session ID in the PDU SESSION ESTABLISHMENT REQUEST message and in the UL NAS TRANSPORT message to "PDU session identity value 15".

If the UE is registered to a network which supports ATSSS and the UE requests to establish a new PDU session the UE may allow the network to upgrade the requested PDU session to an MA PDU session. In order to allow the network to upgrade the requested PDU session to an MA PDU session, the UE shall set "MA PDU session network upgrade is allowed" in the MA PDU session information IE and shall set the request type to "initial request" in the UL NAS TRANSPORT message. If the UE is registered to a network which does not support ATSSS, the UE shall not perform the procedure to allow the network to upgrade the requested PDU session to an MA PDU session.

If the UE is registered to a network which supports ATSSS, the UE may request to establish an MA PDU session. If the UE requests to establish an MA PDU session, the UE shall set the request type to "MA PDU request" in the UL NAS TRANSPORT message. If the UE is registered to a network which does not support ATSSS, the UE shall not request to establish an MA PDU session.

When the UE is registered over both 3GPP access and non-3GPP access in the same PLMN and the UE requests to establish a new MA PDU session, the UE may provide an S-NSSAI in the UL NAS TRANSPORT message only if the S-NSSAI is included in the allowed NSSAIs of both accesses.

NOTE 7: If the UE requested DNN corresponds to an LADN DNN, the AMF does not forward the MA PDU session information IE to the SMF but sends the message back to the UE to inform of the unhandled request (see subclause 5.4.5.2.5).

If the UE is registered to a network which supports ATSSS and the UE has already an MA PDU session established over one access, the UE may perform the UE-requested PDU session establishment procedure to establish user-plane resources over the other access for the MA PDU session as specified in subclause 4.22 of 3GPP TS 23.502 [9] and the S-NSSAI associated with the MA PDU session is included in the allowed NSSAI of the other access. If the UE establishes user-plane resources over the other access for the MA PDU session, the UE shall:

a) set the request type to "MA PDU request" in the UL NAS TRANSPORT message;

b) set the PDU session ID to the stored PDU session ID corresponding to the established MA PDU session in the PDU SESSION ESTABLISHMENT REQUEST message and in the UL NAS TRANSPORT message; and

c) set the S-NSSAI in the UL NAS TRANSPORT message to the stored S-NSSAI associated with the PDU session ID.

If the UE requests to establish a new MA PDU session or if the UE requests to establish a new PDU session and the UE allows the network to upgrade the requested PDU session to an MA PDU session:

a) if the UE supports ATSSS Low-Layer functionality with any steering mode as specified in subclause 5.32.6 of 3GPP TS 23.501 [8], the UE shall set the ATSSS-ST bits to "ATSSS Low-Layer functionality with any steering mode supported" in the 5GSM capability IE of the PDU SESSION ESTABLISHMENT REQUEST message;

b) if the UE supports MPTCP functionality with any steering mode and ATSSS-LL functionality with only active-standby steering mode as specified in subclause 5.32.6 of 3GPP TS 23.501 [8], the UE shall set the ATSSS-ST bits to "MPTCP functionality with any steering mode and ATSSS-LL functionality with only active-standby steering mode supported" in the 5GSM capability IE of the PDU SESSION ESTABLISHMENT REQUEST message;

c) if the UE supports MPTCP functionality with any steering mode and ATSSS-LL functionality with any steering mode as specified in subclause 5.32.6 of 3GPP TS 23.501 [8], the UE shall set the ATSSS-ST bits to "MPTCP functionality with any steering mode and ATSSS-LL functionality with any steering mode supported" in the 5GSM capability IE of the PDU SESSION ESTABLISHMENT REQUEST message; and

d) if a performance measurement function in the UE can perform access performance measurements using the QoS flow of the non-default QoS rule as specified in subclause 5.32.5 of 3GPP TS 23.501 [8], the UE shall set the APMQF bit to "Access performance measurements per QoS flow supported" in the 5GSM capability IE of the PDU SESSION ESTABLISHMENT REQUEST message.

If the UE requests to establish a new MA PDU session and the UE supports to establish a PDN connection as the user plane resource of an MA PDU session, the UE shall include the ATSSS request parameter in the Extended protocol configuration options IE of the PDU SESSION ESTABLISHMENT REQUEST message.

If the UE is registered to a network which does not support ATSSS and the UE has already an MA PDU session established over one access, the UE shall not attempt to establish user-plane resources for the MA PDU session over the network which does not support ATSSS as specified in subclause 4.22 of 3GPP TS 23.502 [9].

If the UE supports 3GPP PS data off, except for the transfer of a PDU session from non-3GPP access to 3GPP access and except for the establishment of user plane resources on the other access for the MA PDU session, the UE shall include the Extended protocol configuration options IE in the PDU SESSION ESTABLISHMENT REQUEST message and include the 3GPP PS data off UE status. The UE behaves as described in subclause 6.2.10.

If the UE supports Reliable Data Service, the UE shall include the Extended protocol configuration options IE in the PDU SESSION ESTABLISHMENT REQUEST message and include the Reliable Data Service request indicator. The UE behaves as described in subclause 6.2.15.

If the UE supports DNS over (D)TLS (see 3GPP TS 33.501 [24]), the UE shall include the Extended protocol configuration options IE in the PDU SESSION ESTABLISHMENT REQUEST message and include DNS server security information indicator and optionally, if the UE wishes to indicate which security protocol type(s) are supported by the UE, it may include the DNS server security protocol support.

NOTE 8: Support of DNS over (D)TLS is based on the informative requirements as specified in 3GPP TS 33.501 [24].

If:

a) the PDU session type value of the PDU session type IE is set to "IPv4", "IPv6" or "IPv4v6";

b) the UE indicates "Control plane CIoT 5GS optimization supported" and "IP header compression for control plane CIoT 5GS optimization supported" in the 5GMM capability IE of the REGISTRATION REQUEST message; and

c) the network indicates "Control plane CIoT 5GS optimization supported" and "IP header compression for control plane CIoT 5GS optimization supported" in the 5GS network support feature IE of the REGISTRATION ACCEPT message;

the UE shall include the IP header compression configuration IE in the PDU SESSION ESTABLISHMENT REQUEST message.

If:

a) the PDU session type value of the PDU session type IE is set to "Ethernet";

b) the UE indicates "Control plane CIoT 5GS optimization supported" and "Ethernet header compression for control plane CIoT 5GS optimization supported" in the 5GMM capability IE of the REGISTRATION REQUEST message; and

c) the network indicates "Control plane CIoT 5GS optimization supported" and "Ethernet header compression for control plane CIoT 5GS optimization supported" in the 5GS network support feature IE of the REGISTRATION ACCEPT message;

the UE shall include the Ethernet header compression configuration IE in the PDU SESSION ESTABLISHMENT REQUEST message.

If the UE supports transfer of port management information containers, the UE shall:

a) set the TPMIC bit to "Transfer of port management information containers supported" in the 5GSM capability IE of the PDU SESSION ESTABLISHMENT REQUEST message;

b) if the UE requests to establish a PDU session of "Ethernet" PDU session type , include the DS-TT Ethernet port MAC address IE in the PDU SESSION ESTABLISHMENT REQUEST message and set its contents to the MAC address of the DS-TT Ethernet port used for the PDU session;

c) if the UE-DS-TT residence time is available at the UE, include the UE-DS-TT residence time IE and set its contents to the UE-DS-TT residence time; and

d) if a Port management information container is provided by the DS-TT, include the Port management information container IE in the PDU SESSION ESTABLISHMENT REQUEST message.

NOTE 9: Only SSC mode 1 is supported for a PDU session which is for time synchronization or TSC.

If the UE supports secondary DN authentication and authorization over EPC, the UE shall set the SDNAEPC bit to "Secondary DN authentication and authorization over EPC supported" in the 5GSM capability IE of the PDU SESSION ESTABLISHMENT REQUEST message.

If the UE supporting S1 mode supports receiving QoS rules with the length of two octets or QoS flow descriptions with the length of two octets via the Extended protocol configuration options IE, the UE shall include the QoS rules with the length of two octets support indicator or the QoS flow descriptions with the length of two octets support indicator, respectively, in the Extended protocol configuration options IE in the PDU SESSION ESTABLISHMENT REQUEST message.

If:

– the UE is operating in single-registration mode;

– the UE supports local IP address in traffic flow aggregate description and TFT filter in S1 mode; and

– the PDU session Type requested is different from "Unstructured".

the UE shall indicate the support of local address in TFT in S1 mode in the Extended protocol configuration options IE in the PDU SESSION ESTABLISHMENT REQUEST message.

If the W-AGF acting on behalf of the FN-RG requests to establish a PDU session of "IPv6" or "IPv4v6" PDU session type, the W-AGF acting on behalf of the FN-RG may include in the PDU SESSION ESTABLISHMENT REQUEST message the Suggested interface identifier IE with the PDU session type value field set to "IPv6" and containing the interface identifier for the IPv6 link local address associated with the PDU session suggested to be allocated to the FN-RG.

If the UE supports provisioning of ECS configuration information to the EEC in the UE, then the UE shall include the Extended protocol configuration options IE in the PDU SESSION ESTABLISHMENT REQUEST message and shall include the ECS configuration information provisioning support indicator.

If the UE supports receiving DNS server addresses in protocol configuration options, the UE shall include the Extended protocol configuration options IE in the PDU SESSION ESTABLISHMENT REQUEST message and in the Extended protocol configuration options IE:

a) if the UE requests to establish a PDU session of "IPv4" or "IPv4v6" PDU session type, the UE shall include the DNS server IPv4 address request; and

b) if the UE requests to establish a PDU session of "IPv6" or "IPv4v6" PDU session type, the UE shall include the DNS server IPv6 address request.

If the UE supporting UAS services requests to establish a PDU session for C2 communication, the UE shall include the Service-level-AA container IE in the PDU SESSION ESTABLISHMENT REQUEST message. In the Service-level-AA container IE, the UE shall include:

a) the service-level device ID with the value set to the CAA-level UAV ID of the UE; and

b) if available, the service-level-AA payload with the value set to the C2 authorization payload and the service-level-AA payload type with the value set to "C2 authorization payload".

NOTE 10: The C2 authorization payload in the service-level-AA payload can include the pairing information for C2 communication and the UAV flight authorization information.

If the UE supports the EAS rediscovery, the UE shall include the Extended protocol configuration options IE in the PDU SESSION ESTABLISHMENT REQUEST message and shall include the EAS rediscovery support indication in the Extended protocol configuration options IE.

If the UE needs to include a PDU session pair ID based on the matching URSP rule or UE local configuration, the UE shall include the PDU session pair ID IE in the PDU SESSION ESTABLISHMENT REQUEST message. If the UE needs to include an RSN based on the matching URSP rule or UE local configuration, the UE shall include the RSN IE in the PDU SESSION ESTABLISHMENT REQUEST message.

If the UE is not registered for onboarding services in SNPN and needs PVS information, the UE shall include the Extended protocol configuration options IE in the PDU SESSION ESTABLISHMENT REQUEST message and include the PVS information request in the Extended protocol configuration options IE.

If the UE supports the EDC, the UE shall include the Extended protocol configuration options IE in the PDU SESSION ESTABLISHMENT REQUEST message and shall include the EDC support indicator in the Extended protocol configuration options IE.

If the UE supports a "destination MAC address range type" packet filter component and a "source MAC address range type" packet filter component, the UE shall include the Extended protocol configuration options IE in the PDU SESSION ESTABLISHMENT REQUEST message and shall include the MS support of MAC address range in 5GS indicator in the Extended protocol configuration options IE.

The UE shall transport:

a) the PDU SESSION ESTABLISHMENT REQUEST message;

b) the PDU session ID of the PDU session being established, being handed over, being transferred, or been established as an MA PDU session;

c) if the request type is set to:

1) "initial request" or "MA PDU request" and the UE determined to establish a new PDU session or an MA PDU session based on either a URSP rule including one or more S-NSSAIs in the URSP (see subclause 6.2.9) or UE local configuration, according to subclause 4.2.2 of 3GPP TS 24.526 [19]:

i) if the UE is in the HPLMN or the subscribed SNPN, an S-NSSAI in the allowed NSSAI which corresponds to one of the S-NSSAI(s) in the matching URSP rule, if any, or else to the S-NSSAI(s) in the UE local configuration or in the default URSP rule, if any, according to the conditions given in subclause 4.2.2 of 3GPP TS 24.526 [19];

ii) if the UE is in a non-subscribed SNPN, the UE determined according to the conditions given in subclause 4.2.2 of 3GPP TS 24.526 [19] to establish a new PDU session or an MA PDU session based on a URSP rule including one or more S-NSSAIs, and the URSP rule is a part of a non-subscribed SNPN signalled URSP (see 3GPP TS 24.526 [19]):

A) an S-NSSAI in the allowed NSSAI, which is one of the S-NSSAI(s) in the URSP rule; and

B) a mapped S-NSSAI associated with the S-NSSAI in A); or

iii) otherwise:

A) one of the mapped S-NSSAI(s) which is equal to one of the S-NSSAI(s) in the matching URSP rule, if any, or else to the S-NSSAI(s) in the UE local configuration or in the default URSP rule, if any, according to the conditions given in subclause 4.2.2 of 3GPP TS 24.526 [19]; and

B) the S-NSSAI in the allowed NSSAI associated with the S-NSSAI in A); or

1a) "initial request" and the UE determined to establish a new PDU session based on the PDU session parameters for 5G ProSe layer-3 UE-to-network relay UE including an S-NSSAI in the UE policies for 5G ProSe UE-to-network relay UE as defined in 3GPP TS 24.555 [19F]:

i) in case of a non-roaming scenario, an S-NSSAI in the allowed NSSAI which corresponds to the S-NSSAI in the selected PDU session parameters for 5G ProSe layer-3 UE-to-network relay UE, if any; or

ii) in case of a roaming scenario:

A) one of the mapped S-NSSAI(s) which corresponds to the S-NSSAI in the selected PDU session parameters for 5G ProSe layer-3 UE-to-network relay UE, if any; and

B) the S-NSSAI in the allowed NSSAI associated with the S-NSSAI in A); or

NOTE 11: When the UE is roaming, an AMF compliant with earlier versions of the specification can omit providing to the UE a mapped S-NSSAI for one or more S-NSSAIs in the allowed NSSAI and the UE then locally sets the mapped S-NSSAI as described in clause 4.6.2.1.

2) "existing PDU session", an S-NSSAI, which is an S-NSSAI associated with the PDU session and (in roaming scenarios) a mapped S-NSSAI, with exception when S-NSSAI is not provided by the network in subclause 6.1.4.2;

d) if the request type is set to:

1) "initial request" or "MA PDU request" and the UE determined to establish a new PDU session or an MA PDU session based on either a URSP rule including one or more DNNs in the URSP (see subclause 6.2.9) or UE local configuration, according to subclause 4.2.2 of 3GPP TS 24.526 [19], a DNN which corresponds to one of the DNN(s) in the matching URSP rule, if any, or else to the DNN(s) in the UE local configuration or in the default URSP rule, if any, according to the conditions given in subclause 4.2.2 of 3GPP TS 24.526 [19];

1a) "initial request" and the UE determined to establish a new PDU session based on the PDU session parameters for 5G ProSe layer-3 UE-to-network relay UE including a DNN in the UE policies for 5G ProSe UE-to-network relay UE as defined in 3GPP TS 24.555 [19F], a DNN which corresponds to the DNN in the selected PDU session parameters for 5G ProSe layer-3 UE-to-network relay UE, if any; or

2) "existing PDU session", a DNN which is a DNN associated with the PDU session;

e) the request type which is set to:

1) "initial request", if the UE is not registered for emergency services and the UE requests to establish a new non-emergency PDU session;

2) "existing PDU session", if the UE is not registered for emergency services and the UE requests:

i) handover of an existing non-emergency PDU session between 3GPP access and non-3GPP access;

ii) transfer of an existing PDN connection for non-emergency bearer services in the EPS to the 5GS; or

iii) transfer of an existing PDN connection for non-emergency bearer services in an untrusted non-3GPP access connected to the EPC to the 5GS;

3) "initial emergency request", if the UE requests to establish a new emergency PDU session;

4) "existing emergency PDU session", if the UE requests:

i) handover of an existing emergency PDU session between 3GPP access and non-3GPP access;

ii) transfer of an existing PDN connection for emergency bearer services in the EPS to the 5GS; or

iii) transfer of an existing PDN connection for emergency bearer services in an untrusted non-3GPP access connected to the EPC to the 5GS; or

5) "MA PDU request", if:

i) the UE requests to establish an MA PDU session;

ii) the UE requests to establish user plane resources over other access of an MA PDU session established over one access only; or

iii) the UE performs inter-system change from S1 mode to N1 mode according to subclause 4.8.2.3.1 and requests transfer of a PDN connection which is a user plane resource of an MA PDU session; and

f) the old PDU session ID which is the PDU session ID of the existing PDU session, if the UE initiates the UE-requested PDU session establishment procedure upon receiving the PDU SESSION MODIFICATION COMMAND messages with the 5GSM cause IE set to #39 "reactivation requested";

using the NAS transport procedure as specified in subclause 5.4.5, and the UE shall start timer T3580 (see example in figure 6.4.1.2.1).

For bullet c) 1), if the matching URSP rule does not have an associated S-NSSAI, or if the UE does not have any matching URSP rule and there is no S-NSSAI in the UE local configuration or in the default URSP rule, the UE shall not provide any S-NSSAI in a PDU session establishment procedure.

For bullet c) 1a), if the selected PDU session parameters for 5G ProSe layer-3 UE-to-network relay UE do not have an associated S-NSSAI, the UE shall not provide any S-NSSAI in a PDU session establishment procedure.

For bullet d) 1),

– If the matching non-default URSP rule does not have an associated DNN, then the UE shall not provide any DNN in a PDU session establishment procedure;

– If the UE does not have any matching non-default URSP rule, the UE requests a connectivity that requires PAP/CHAP and the UE is configured with the default DNN for the S-NSSAI in the UE local configuration corresponding to the request, then the UE should provide such DNN in a PDU session establishment procedure;

– If the UE does not have any matching non-default URSP rule, the UE requests a connectivity that requires PAP/CHAP, the UE is not configured with the default DNN for the S-NSSAI in the UE local configuration corresponding to the request, and the application provides the DNN, then the UE shall use such DNN in a PDU session establishment procedure;

– If the UE does not have any matching non-default URSP rule, the UE requests a connectivity that does not require PAP/CHAP, the UE is not configured with the DNN for the S-NSSAI in the UE local configuration corresponding to the request, and the application provides the DNN, then the UE shall use such DNN in a PDU session establishment procedure;

– If the UE does not have any matching non-default URSP rule, the UE requests a connectivity that requires PAP/CHAP, the UE is not configured with the default DNN for the S-NSSAI in the UE local configuration corresponding to the request, the application does not provide the DNN and there is no DNN in the default URSP rule, then the UE shall not provide any DNN in a PDU session establishment procedure; or

– If the UE does not have any matching non-default URSP rule, the UE requests a connectivity that does not require PAP/CHAP, the UE is not configured with the DNN for the S-NSSAI in the UE local configuration corresponding to the request, the application does not provide the DNN and there is no DNN in the default URSP rule, then the UE shall not provide any DNN in a PDU session establishment procedure.

For bullet d) 1a), if the selected the PDU session parameters for 5G ProSe layer-3 UE-to-network relay UE do not have an associated DNN, the UE shall not provide any DNN in a PDU session establishment procedure.

If the request type is set to "initial emergency request" or "existing emergency PDU session" or the UE is registered for onboarding services in SNPN, neither DNN nor S-NSSAI is transported by the UE using the NAS transport procedure as specified in subclause 5.4.5.

Figure 6.4.1.2.1: UE-requested PDU session establishment procedure

Upon receipt of a PDU SESSION ESTABLISHMENT REQUEST message, a PDU session ID, optionally an S-NSSAI associated with (in roaming scenarios) a mapped S-NSSAI, optionally a DNN determined by the AMF, optionally a DNN selected by the network (if different from the DNN determined by the AMF), the request type, and optionally an old PDU session ID, the SMF checks whether connectivity with the requested DN can be established. If the requested DNN is not included, the SMF shall use the default DNN.

If the PDU session being established is a non-emergency PDU session, the request type is not set to "existing PDU session" and the PDU session authentication and authorization by the external DN is required due to local policy, the SMF shall check whether the PDU SESSION ESTABLISHMENT REQUEST message includes the SM PDU DN request container IE or the Service-level-AA container IE.

If the PDU session being established is a non-emergency PDU session, the request type is not set to "existing PDU session", the SM PDU DN request container IE is included in the PDU SESSION ESTABLISHMENT REQUEST message, the PDU session authentication and authorization by the external DN is required due to local policy and user’s subscription data, and:

a) the information for the PDU session authentication and authorization by the external DN in the SM PDU DN request container IE is compliant with the local policy and user’s subscription data, the SMF shall proceed with the EAP Authentication procedure specified in 3GPP TS 33.501 [24] and refrain from accepting or rejecting the PDU SESSION ESTABLISHMENT REQUEST message until the EAP Authentication procedure finalizes; or

b) the information for the PDU session authentication and authorization by the external DN in the SM PDU DN request container IE is not compliant with the local policy and user’s subscription data, the SMF shall consider it as an abnormal case and proceed as specified in subclause 6.4.1.7.

If the PDU session being established is a non-emergency PDU session, the request type is not set to "existing PDU session", the SM PDU DN request container IE is not included in the PDU SESSION ESTABLISHMENT REQUEST message and the PDU session authentication and authorization by the external DN is required due to local policy and user’s subscription data, the SMF shall proceed with the EAP Authentication procedure specified in 3GPP TS 33.501 [24] and refrain from accepting or rejecting the PDU SESSION ESTABLISHMENT REQUEST message until the EAP Authentication procedure finalizes.

If the SMF receives the old PDU session ID from the AMF and a PDU session exists for the old PDU session ID, the SMF shall consider that the request for the relocation of SSC mode 3 PDU session anchor with multiple PDU sessions as specified in 3GPP TS 23.502 [9] is accepted by the UE.

If the SMF receives the onboarding indication from the AMF, the SMF shall consider that the PDU session is established for onboarding services in SNPN.

If the UE has set the TPMIC bit to "Transfer of port management information containers supported" in the 5GSM capability IE of the PDU SESSION ESTABLISHMENT REQUEST message and has included a DS-TT Ethernet port MAC address IE (if the PDU session type is "Ethernet"), the Port management information container IE, and, optionally, the UE-DS-TT residence time IE in the PDU SESSION ESTABLISHMENT REQUEST message, the SMF shall operate as specified in 3GPP TS 23.502 [9] subclause 4.3.2.2.1.

If requested by the upper layers, the UE supporting UAS services shall initiate a request to establish a PDU session for UAS services, where the UE:

a) shall include the service-level device ID with the value set to the CAA-level UAV ID;

b) if provided by the upper layers, shall include the service-level-AA server address, with the value set to the USS address; and

c) if provided by the upper layers, shall include:

i) the service-level-AA payload type, with the value set to "UUAA payload"; and

ii) the service-level-AA payload, with the value set to UUAA payload,

in the Service-level-AA container IE of the PDU SESSION ESTABLISHMENT REQUEST message.

If the PDU session being established is a non-emergency PDU session, the request type is not set to "existing PDU session", the Service-level-AA container IE is included in the PDU SESSION ESTABLISHMENT REQUEST message, and

a) the service-level authentication and authorization by the external DN is required due to local policy;

b) there is a valid user’s subscription information for the requested DNN or for the requested DNN and S-NSSAI; and

c) the information for the service-level authentication and authorization by the external DN in the Service-level-AA container IE includes CAA-level UAV ID,

then the SMF shall proceed with the UUAA-SM procedure as specified in 3GPP TS 23.256 [6AB] and refrain from accepting or rejecting the PDU SESSION ESTABLISHMENT REQUEST message until the service-level authentication and authorization procedure is completed.

The UE supporting UAS services shall not request a PDU session establishment procedure to the same DNN (or no DNN, if no DNN was indicated by the UE) and the same S-NSSAI (or no S-NSSAI, if no S-NSSAI was indicated by the UE) for which the UE has requested a service level authentication and authorization procedure which is ongoing.

If the PDU SESSION ESTABLISHMENT REQUEST message includes the PDU session pair ID IE, the RSN IE, or both, the SMF shall operate as specified in clause 5.33.2 of 3GPP TS 23.501 [8].

6.4.1.3 UE-requested PDU session establishment procedure accepted by the network

If the connectivity with the requested DN is accepted by the network, the SMF shall create a PDU SESSION ESTABLISHMENT ACCEPT message.

If the UE requests establishing an emergency PDU session, the network shall not check for service area restrictions or subscription restrictions when processing the PDU SESSION ESTABLISHMENT REQUEST message.

The SMF shall set the Authorized QoS rules IE of the PDU SESSION ESTABLISHMENT ACCEPT message to the authorized QoS rules of the PDU session and may include the authorized QoS flow descriptions IE of the PDU SESSION ESTABLISHMENT ACCEPT message set to the authorized QoS flow descriptions of the PDU session.

NOTE 1: This is applicable also if the PDU session establishment procedure was initiated to perform handover of an existing PDU session between 3GPP access and non-3GPP access, and even if the authorized QoS rules and authorized QoS flow descriptions for source and target access of the handover are the same.

The SMF shall ensure that the number of the packet filters used in the authorized QoS rules of the PDU Session does not exceed the maximum number of packet filters supported by the UE for the PDU session. If the received request type is "initial emergency request", the SMF shall set the Authorized QoS flow descriptions IE according to the QoS parameters used for establishing emergency services as specified in subclause 5.16.4 of 3GPP TS 23.501 [8].

SMF shall set the Authorized QoS flow descriptions IE to the authorized QoS flow descriptions of the PDU session, if:

a) the Authorized QoS rules IE contains at least one GBR QoS flow;

b) the QFI is not the same as the 5QI of the QoS flow identified by the QFI;

c) the QoS flow can be mapped to an EPS bearer as specified in subclause 4.11.1 of 3GPP TS 23.502 [9]; or

d) the QoS flow is established for the PDU session used for relaying, as specified in subclause 5.6.2.1 of 3GPP TS 23.304 [6E].

NOTE 2: In cases other than above listed cases, it is up to the SMF implementation to include the authorized QoS flow description for the QoS flow in the Authorized QoS flow descriptions IE of the PDU SESSION ESTABLISHMENT ACCEPT message.

If interworking with EPS is supported for the PDU session, the SMF shall set in the PDU SESSION ESTABLISHMENT ACCEPT message:

a) the Mapped EPS bearer contexts IE to the EPS bearer contexts mapped from one or more QoS flows of the PDU session; and

b) the EPS bearer identity parameter in the Authorized QoS flow descriptions IE to the EPS bearer identity corresponding to the QoS flow, for each QoS flow which can be transferred to EPS.

If the "Create new EPS bearer" operation code in the Mapped EPS bearer contexts IE was received, and there is no corresponding Authorized QoS flow descriptions IE in the PDU SESSION ESTABLISHMENT ACCEPT message, the UE shall send a PDU SESSION MODIFICATION REQUEST message including a Mapped EPS bearer contexts IE to delete the mapped EPS bearer context. If the EPS bearer identity parameter in the Authorized QoS flow descriptions IE was received, the operation code is "Create new QoS flow description" and there is no corresponding Mapped EPS bearer contexts IE in the PDU SESSION ESTABLISHMENT ACCEPT message, the UE shall not diagnose an error, and shall keep storing the association between the QoS flow and the corresponding EPS bearer identity.

Furthermore, the SMF shall store the association between the QoS flow and the mapped EPS bearer context, for each QoS flow which can be transferred to EPS.

The SMF shall set the selected SSC mode IE of the PDU SESSION ESTABLISHMENT ACCEPT message to:

a) the received SSC mode in the SSC mode IE included in the PDU SESSION ESTABLISHMENT REQUEST message based on one or more of the PDU session type, the subscription and the SMF configuration;

b) either the default SSC mode for the data network listed in the subscription or the SSC mode associated with the SMF configuration, if the SSC mode IE is not included in the PDU SESSION ESTABLISHMENT REQUEST message.

NOTE 3: For bullet b), to avoid issues for UEs not supporting all SSC modes, the network operator can, in the subscription data and local configuration, include at least SSC mode 1 in the allowed SSC modes, and set the default SSC mode to "SSC mode 1" as per 3GPP TS 23.501 [8].

If the PDU session is an emergency PDU session, the SMF shall set the Selected SSC mode IE of the PDU SESSION ESTABLISHMENT ACCEPT message to "SSC mode 1". If the PDU session is a non-emergency PDU session of "Ethernet" or "Unstructured" PDU session type, the SMF shall set the Selected SSC mode IE to "SSC mode 1" or "SSC mode 2". If the PDU session is a non-emergency PDU session of "IPv4", "IPv6" or "IPv4v6" PDU session type, the SMF shall set the selected SSC mode IE to "SSC mode 1", "SSC mode 2", or "SSC mode 3".

If the PDU session is a non-emergency PDU session and the UE is not registered for onboarding services in SNPN, the SMF shall set the S-NSSAI IE of the PDU SESSION ESTABLISHMENT ACCEPT message to:

a) the S-NSSAI of the PDU session; and

b) the mapped S-NSSAI (in roaming scenarios).

The SMF shall set the Selected PDU session type IE of the PDU SESSION ESTABLISHMENT ACCEPT message to the selected PDU session type, i.e. the PDU session type of the PDU session.

If the PDU SESSION ESTABLISHMENT REQUEST message includes a PDU session type IE set to "IPv4v6", the SMF shall select "IPv4", "IPv6" or "IPv4v6" as the Selected PDU session type. If the subscription, the SMF configuration, or both, are limited to IPv4 only or IPv6 only for the DNN selected by the network, the SMF shall include the 5GSM cause value #50 "PDU session type IPv4 only allowed", or #51 "PDU session type IPv6 only allowed", respectively, in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT ACCEPT message.

If the selected PDU session type is "IPv4", the SMF shall include the PDU address IE in the PDU SESSION ESTABLISHMENT ACCEPT message and shall set the PDU address IE to an IPv4 address is allocated to the UE in the PDU session.

If the selected PDU session type is "IPv6", the SMF shall include the PDU address IE in the PDU SESSION ESTABLISHMENT ACCEPT message and shall set the PDU address IE to an interface identifier for the IPv6 link local address allocated to the UE in the PDU session.

If the selected PDU session type is "IPv4v6", the SMF shall include the PDU address IE in the PDU SESSION ESTABLISHMENT ACCEPT message and shall set the PDU address IE to an IPv4 address and an interface identifier for the IPv6 link local address, allocated to the UE in the PDU session.

If the selected PDU session type of a PDU session established by the W-AGF acting on behalf of the FN-RG is "IPv4v6" or "IPv6", the SMF shall also indicate the SMF’s IPv6 link local address in the PDU address IE of the PDU SESSION ESTABLISHMENT ACCEPT message.

If the PDU session is a non-emergency PDU session and the UE is not registered for onboarding services in SNPN, the SMF shall set the DNN IE of the PDU SESSION ESTABLISHMENT ACCEPT message to the DNN determined by the AMF of the PDU session.

The SMF shall set the Session-AMBR IE of the PDU SESSION ESTABLISHMENT ACCEPT message to the Session-AMBR of the PDU session.

If the selected PDU session type is "IPv4", "IPv6", "IPv4v6" or "Ethernet" and if the PDU SESSION ESTABLISHMENT REQUEST message includes a 5GSM capability IE with the RQoS bit set to "Reflective QoS supported", the SMF shall consider that reflective QoS is supported for QoS flows belonging to this PDU session and may include the RQ timer IE set to an RQ timer value in the PDU SESSION ESTABLISHMENT ACCEPT message.

If the selected PDU session type is "IPv4", "IPv6", "IPv4v6" or "Ethernet" and if the PDU SESSION ESTABLISHMENT REQUEST message includes a Maximum number of supported packet filters IE, the SMF shall consider this number as the maximum number of packet filters that can be supported by the UE for this PDU session. Otherwise the SMF considers that the UE supports 16 packet filters for this PDU session.

The SMF shall consider that the maximum data rate per UE for user-plane integrity protection supported by the UE for uplink and the maximum data rate per UE for user-plane integrity protection supported by the UE for downlink are valid for the lifetime of the PDU session.

If the value of the RQ timer is set to "deactivated" or has a value of zero, the UE considers that RQoS is not applied for this PDU session.

NOTE 4: If the 5G core network determines that reflective QoS is to be used for a QoS flow, the SMF sends reflective QoS indication (RQI) to UPF to activate reflective QoS. If the QoS flow is established over 3GPP access, the SMF also includes reflective QoS Attribute (RQA) in QoS profile of the QoS flow during QoS flow establishment.

If the selected PDU session type is "IPv6" or "IPv4v6" and if the PDU SESSION ESTABLISHMENT REQUEST message includes a 5GSM capability IE with the MH6-PDU bit set to "Multi-homed IPv6 PDU session supported", the SMF shall consider that this PDU session is supported to use multiple IPv6 prefixes.

If the selected PDU session type is "Ethernet", the PDU SESSION ESTABLISHMENT REQUEST message includes a 5GSM capability IE with the EPT-S1 bit set to "Ethernet PDN type in S1 mode supported" and the network supports Ethernet PDN type in S1 mode, the SMF shall set the EPT-S1 bit of the 5GSM network feature support IE of the PDU SESSION ESTABLISHMENT ACCEPT message to "Ethernet PDN type in S1 mode supported".

If the DN authentication of the UE was performed and completed successfully, the SMF shall set the EAP message IE of the PDU SESSION ESTABLISHMENT ACCEPT message to an EAP-success message as specified in IETF RFC 3748 [34], provided by the DN.

Based on local policies or configurations in the SMF and the Always-on PDU session requested IE in the PDU SESSION ESTABLISHMENT REQUEST message (if available), if the SMF determines that either:

a) the requested PDU session needs to be established as an always-on PDU session (e.g. because the PDU session is for time synchronization or TSC, for URLLC, or for both), the SMF shall include the Always-on PDU session indication IE in the PDU SESSION ESTABLISHMENT ACCEPT message and shall set the value to "Always-on PDU session required"; or

b) the requested PDU session shall not be established as an always-on PDU session and:

i) if the UE included the Always-on PDU session requested IE, the SMF shall include the Always-on PDU session indication IE in the PDU SESSION ESTABLISHMENT ACCEPT message and shall set the value to "Always-on PDU session not allowed"; or

ii) if the UE did not include the Always-on PDU session requested IE, the SMF shall not include the Always-on PDU session indication IE in the PDU SESSION ESTABLISHMENT ACCEPT message.

If the PDU session is an MA PDU session, the SMF shall include the ATSSS container IE in the PDU SESSION ESTABLISHMENT ACCEPT message. The SMF shall set the content of the ATSSS container IE as specified in 3GPP TS 24.193 [13B]. If the UE requests to establish user plane resources over the second access of an MA PDU session which has already been established over the first access and the parameters associated with ATSSS previously provided to the UE are not to be updated, the "ATSSS container contents" shall not be included in the ATSSS container IE in the PDU SESSION ESTABLISHMENT ACCEPT message.

If the PDU session is a single access PDU session containing the MA PDU session information IE with the value set to "MA PDU session network upgrade is allowed" and:

a) if the SMF decides to establish a single access PDU session, the SMF shall not include the ATSSS container IE in the PDU SESSION ESTABLISHMENT ACCEPT message; or

b) if the SMF decides to establish an MA PDU session, the SMF shall include the ATSSS container IE in the PDU SESSION ESTABLISHMENT ACCEPT message, which indicates to the UE that the requested single access PDU session was established as an MA PDU Session.

If the network decides that the PDU session is only for control plane CIoT 5GS optimization, the SMF shall include the control plane only indication in the PDU SESSION ESTABLISHMENT ACCEPT message.

If:

a) the UE provided the IP header compression configuration IE in the PDU SESSION ESTABLISHMENT REQUEST message; and

b) the SMF supports IP header compression for control plane CIoT 5GS optimization;

the SMF shall include the IP header compression configuration IE in the PDU SESSION ESTABLISHMENT ACCEPT message.

If:

a) the UE provided the Ethernet header compression configuration IE in the PDU SESSION ESTABLISHMENT REQUEST message; and

b) the SMF supports Ethernet header compression for control plane CIoT 5GS optimization;

the SMF shall include the Ethernet header compression configuration IE in the PDU SESSION ESTABLISHMENT ACCEPT message.

If the PDU SESSION ESTABLISHMENT REQUEST included the Requested MBS container IE with the MBS operation set to "Join MBS session", the SMF:

a) shall include the TMGI for the multicast MBS session IDs that the UE is allowed to join, if any, in the Received MBS container IE, shall set the MBS decision to "MBS join is accepted" for each of those Received MBS information, may include the MBS start time to indicate the time when the multicast MBS session starts and shall include the MBS security container in each of those Received MBS information if security protection is applied for that multicast MBS session and the control plane security procedure is used as specified in annex W.4.1.2 in 3GPP TS 33.501 [24], and shall use separate QoS flows dedicated for multicast by including the Authorized QoS flow descriptions IE if no separate QoS flows dedicated for multicast exist or if the SMF wants to establish new QoS flows dedicated for multicast;

NOTE 5: The network determines whether security protection applies or not for the multicast MBS session as specified in 3GPP TS 33.501 [24].

b) shall include the TMGI for multicast MBS session IDs that the UE is not allowed to join, if any, in the Received MBS container IE, shall set the MBS decision to "MBS join is rejected" for each of those Received MBS information, shall set the Rejection cause for each of those Received MBS information with the reason of rejection, and if the Rejection cause is set to "multicast MBS session has not started or will not start soon", may include an MBS back-off timer value; and

c) may include in the Received MBS container IE the MBS service area for each multicast MBS session and include in it the MBS TAI list, the NR CGI list or both, that identify the service area(s) for the local MBS service

NOTE 6: For an multicast MBS session that has multiple MBS service areas, the MBS service areas are indicated to the UE using MBS service announcement as described in 3GPP TS 23.247 [53], which is out of scope of this specification.

in the PDU SESSION ESTABLISHMENT ACCEPT message. If the UE has set the Type of multicast MBS session ID to "Source specific IP multicast address" in the Requested multicast MBS container IE for certain MBS session(s) in the PDU SESSION ESTABLISHMENT REQUEST message, the SMF shall include the Source IP address information and Destination IP address information in the Received MBS information together with the TMGI for each of those multicast MBS sessions.

NOTE 7: Including the Source IP address information and Destination IP address information in the Received MBS information in that case is to allow the UE to perform the mapping between the requested multicast MBS session ID and the provided TMGI.

NOTE 8: In SNPN, TMGI is used together with NID to identify an MBS Session.

If the request type is "existing PDU session", the SMF shall not perform network slice admission control for the PDU session, except for the following cases:

a) when EPS counting is not required for the S-NSSAI of the PDU session for network slice admission control and the PDU session is established due to transfer the PDN connection from S1 mode to N1 mode in case of inter-system change; or

b) handover of an existing PDU session between 3GPP access and non-3GPP access is performed.

The SMF shall send the PDU SESSION ESTABLISHMENT ACCEPT message.

Upon receipt of a PDU SESSION ESTABLISHMENT ACCEPT message and a PDU session ID, using the NAS transport procedure as specified in subclause 5.4.5, the UE shall stop timer T3580, shall release the allocated PTI value and shall consider that the PDU session was established.

If the PDU session establishment procedure was initiated to perform handover of an existing PDU session between 3GPP access and non-3GPP access, then upon receipt of the PDU SESSION ESTABLISHMENT ACCEPT message the UE shall locally delete any authorized QoS rules, authorized QoS flow descriptions, the session-AMBR and the parameters provided in the Protocol configuration options IE when in S1 mode or the Extended protocol configuration options IE stored for the PDU session before processing the new received authorized QoS rules, authorized QoS flow descriptions, the session-AMBR and the parameters provided in the Extended protocol configuration options IE, if any.

NOTE 9: For the case of handover from 3GPP access to non-3GPP access, deletion of the QoS flow descriptions implies deletion of the associated EPS bearer identities, if any, and according to subclause 6.1.4.1 also deletion of the associated EPS bearer contexts. Regarding the reverse direction, for PDU sessions via non-3GPP access the network does not allocate associated EPS bearer identities (see 3GPP TS 23.502 [9], subclause 4.11.1.4.1).

If the PDU session establishment procedure was initiated to perform handover of an existing PDU session from 3GPP access to non-3GPP access and that existing PDU session is associated with one or more multicast MBS sessions, the UE shall locally leave the associated multicast MBS sessions and the SMF shall consider the UE as removed from the associated multicast MBS sessions.

For an MA PDU session already established on a single access, except for all those MA PDU sessions with a PDN connection established as a user-plane resource, upon receipt of PDU SESSION ESTABLISHMENT ACCEPT message over the other access:

a) the UE shall delete the stored authorized QoS rules and the stored session-AMBR;

b) if the authorized QoS flow descriptions IE is included in the PDU SESSION ESTABLISHMENT ACCEPT message, the UE shall delete the stored authorized QoS flow descriptions; and

c) if the mapped EPS bearer contexts IE is included in the PDU SESSION ESTABLISHMENT ACCEPT message, the UE shall delete the stored mapped EPS bearer contexts.

The UE shall store the authorized QoS rules, and the session-AMBR received in the PDU SESSION ESTABLISHMENT ACCEPT message for the PDU session. The UE shall also store the authorized QoS flow descriptions if it is included in the Authorized QoS flow descriptions IE of the PDU SESSION ESTABLISHMENT ACCEPT message for the PDU session.

If the number of the authorized QoS rules, the number of the packet filters, or the number of the authorized QoS flow descriptions associated with the PDU session have reached the maximum number supported by the UE upon receipt of a PDU SESSION ESTABLISHMENT ACCEPT message, then the UE may initiate the PDU session release procedure by sending a PDU SESSION RELEASE REQUEST message with 5GSM cause #26 "insufficient resources".

For a PDU session that is being established with the request type set to "initial request", "initial emergency request" or "MA PDU request", or a PDU session that is being transferred from EPS to 5GS and established with the request type set to "existing PDU session" or "existing emergency PDU session" or a PDU session that is being handed over between non-3GPP access and 3GPP access and established with the request type set to "existing PDU session" or "existing emergency PDU session ", the UE shall verify the authorized QoS rules and the authorized QoS flow descriptions provided in the PDU SESSION ESTABLISHMENT ACCEPT message for different types of errors as follows:

a) Semantic errors in QoS operations:

1) When the rule operation is "Create new QoS rule", and the DQR bit is set to "the QoS rule is the default QoS rule" when there’s already a default QoS rule.

2) When the rule operation is "Create new QoS rule", and there is no rule with the DQR bit set to "the QoS rule is the default QoS rule".

3) When the rule operation is "Create new QoS rule" and two or more QoS rules associated with this PDU session would have identical precedence values.

4) When the rule operation is an operation other than "Create new QoS rule".

5) When the rule operation is "Create new QoS rule", the DQR bit is set to "the QoS rule is not the default QoS rule", and the UE is in NB-N1 mode.

6) When the rule operation is "Create new QoS rule" and there is already an existing QoS rule with the same QoS rule identifier.

7) When the rule operation is "Create new QoS rule", the DQR bit is set to "the QoS rule is not the default QoS rule", and the PDU session type of the PDU session is "Unstructured".

8) When the flow description operation is an operation other than "Create new QoS flow description".

8a) When the flow description operation is "Create new QoS flow description" and there is already an existing QoS flow description with the same QoS flow identifier.

9) When the flow description operation is "Create new QoS flow description", the QFI associated with the QoS flow description is not the same as the QFI of the default QoS rule and the UE is NB-N1 mode.

10) When the flow description operation is "Create new QoS flow description", the QFI associated with the QoS flow description is not the same as the QFI of the default QoS rule, and the PDU session type of the PDU session is "Unstructured".

11) When the rule operation is "Create new QoS rule" and the DQR bit is set to "the QoS rule is not the default QoS rule" and one match-all packet filter is to be associated with the QoS rule.

In case 4, case 5, or case 7 if the rule operation is for a non-default QoS rule, the UE shall send a PDU SESSION MODIFICATION REQUEST message to delete the QoS rule with 5GSM cause #83 "semantic error in the QoS operation".

In case 6, if the existing QoS rule is not the default QoS rule and the DQR bit of the new QoS rule is set to "the QoS rule is not the default QoS rule", the UE shall not diagnose an error, further process the create request and, if it was processed successfully, delete the old QoS rule (i.e. the QoS rule that existed when case 6 was detected). If the existing QoS rule is the default QoS rule or the DQR bit of the new QoS rule is set to "the QoS rule is the default QoS rule", the UE shall initiate a PDU session release procedure by sending a PDU SESSION RELEASE REQUEST message with 5GSM cause #83 "semantic error in the QoS operation".

In case 8, case 9, or case 10, the UE shall send a PDU SESSION MODIFICATION REQUEST message to delete the QoS flow description with 5GSM cause #83 "semantic error in the QoS operation".

In case 8a, the UE shall not diagnose an error, further process the create request and, if it was processed successfully, delete the old QoS flow description (i.e. the QoS flow description that existed when case 8a was detected).

Otherwise for all the cases above, the UE shall initiate a PDU session release procedure by sending a PDU SESSION RELEASE REQUEST message with 5GSM cause #83 "semantic error in the QoS operation".

b) Syntactical errors in QoS operations:

1) When the rule operation is "Create new QoS rule", the QoS rule is a QoS rule of a PDU session of IPv4, IPv6, IPv4v6 or Ethernet PDU session type, and the packet filter list in the QoS rule is empty.

2) When the rule operation is "Create new QoS rule", the DQR bit is set to "the QoS rule is the default QoS rule", the PDU session type of the PDU session is "Unstructured", and the packet filter list in the QoS rule is not empty.

3) When there are other types of syntactical errors in the coding of the Authorized QoS rules IE or the Authorized QoS flow descriptions IE, such as: a mismatch between the number of packet filters subfield and the number of packet filters in the packet filter list when the rule operation is create new QoS rule", or the number of packet filters subfield is larger than the maximum possible number of packet filters in the packet filter list (i.e., there is no QoS rule precedence subfield included in the QoS rule IE), the QoS Rule Identifier is set to "no QoS rule identifier assigned", or the QoS flow identifier is set to "no QoS flow identifier assigned".

4) When, the rule operation is "Create new QoS rule", there is no QoS flow description with a QFI corresponding to the QFI of the resulting QoS rule and the UE determines, by using the QoS rule’s QFI as the 5QI, that there is a resulting QoS rule for a GBR QoS flow (as described in 3GPP TS 23.501 [8] table 5.7.4-1).

5) When the flow description operation is "Create new QoS flow description", and the UE determines that there is a QoS flow description of a GBR QoS flow (as described in 3GPP TS 23.501 [8] table 5.7.4-1) which lacks at least one of the mandatory parameters (i.e., GFBR uplink, GFBR downlink, MFBR uplink and MFBR downlink). If the QoS flow description does not include a 5QI, the UE determines this by using the QFI as the 5QI.

In case 1, case 3 or case 4, if the QoS rule is not the default QoS rule, the UE shall initiate a PDU session release procedure by sending a PDU SESSION RELEASE REQUEST message with 5GSM cause #84 "syntactical error in the QoS operation". Otherwise, the UE shall send a PDU SESSION MODIFICATION REQUEST message including a requested QoS rule IE, a requested QoS flow description IE or both to delete the QoS rule, the QoS flow description or both with 5GSM cause #84 "syntactical error in the QoS operation".

In case 2, if the QoS rule is the default QoS rule, the UE shall send a PDU SESSION MODIFICATION REQUEST message including a requested QoS rule IE to delete all the packet filters of the default QoS rule. The UE shall include the 5GSM cause #84 "syntactical error in the QoS operation".

In case 5, if the default QoS rule is associated with the QoS flow description which lacks at least one of the mandatory parameters, the UE shall initiate a PDU session release procedure by sending a PDU SESSION RELEASE REQUEST message with 5GSM cause #84 "syntactical error in the QoS operation". Otherwise, the UE shall send a PDU SESSION MODIFICATION REQUEST message to delete the QoS flow description which lacks at least one of the mandatory parameters and the associated QoS rule(s), if any, with 5GSM cause #84 "syntactical error in the QoS operation".

NOTE 10: It is not considered an error if the UE determines that after processing all QoS operations on QoS rules and QoS flow descriptions there is a QoS flow description that is not associated with any QoS rule and the UE is not in NB-N1 mode.

c) Semantic errors in packet filters:

1) When a packet filter consists of conflicting packet filter components which would render the packet filter ineffective, i.e. no IP packet will ever fit this packet filter. How the UE determines a semantic error in a packet filter is outside the scope of the present document.

If the QoS rule is the default QoS rule, the UE shall initiate a PDU session release procedure by sending a PDU SESSION RELEASE REQUEST message with 5GSM cause #44 "semantic error in packet filter(s)". Otherwise, the UE shall send a PDU SESSION MODIFICATION REQUEST message to delete the QoS rule with 5GSM cause #44 "semantic error in packet filter(s)".

d) Syntactical errors in packet filters:

1) When the rule operation is "Create new QoS rule" and two or more packet filters in the resultant QoS rule would have identical packet filter identifiers.

2) When there are other types of syntactical errors in the coding of packet filters, such as the use of a reserved value for a packet filter component identifier.

If the QoS rule is the default QoS rule, the UE shall initiate a PDU session release procedure by sending a PDU SESSION RELEASE REQUEST message with 5GSM cause #45 "syntactical errors in packet filter(s)". Otherwise, the UE shall send a PDU SESSION MODIFICATION REQUEST message to delete the QoS rule with 5GSM cause #45 "syntactical errors in packet filter(s)".

If the Always-on PDU session indication IE is included in the PDU SESSION ESTABLISHMENT ACCEPT message and:

a) the value of the IE is set to "Always-on PDU session required", the UE shall consider the established PDU session as an always-on PDU session; or

b) the value of the IE is set to "Always-on PDU session not allowed", the UE shall not consider the established PDU session as an always-on PDU session.

The UE shall not consider the established PDU session as an always-on PDU session if the UE does not receive the Always-on PDU session indication IE in the PDU SESSION ESTABLISHMENT ACCEPT message.

The UE shall store the mapped EPS bearer contexts, if received in the PDU SESSION ESTABLISHMENT ACCEPT message. Furthermore, the UE shall also store the association between the QoS flow and the mapped EPS bearer context, for each QoS flow which can be transferred to EPS, based on the received EPS bearer identity parameter in Authorized QoS flow descriptions IE and the mapped EPS bearer contexts. The UE shall check each mapped EPS bearer context for different types of errors as follows:

NOTE 11: An error detected in a mapped EPS bearer context does not cause the UE to discard the Authorized QoS rules IE and Authorized QoS flow descriptions IE included in the PDU SESSION ESTABLISHMENT ACCEPT, if any.

a) Semantic error in the mapped EPS bearer operation:

1) When the operation code is an operation code other than "Create new EPS bearer".

2) When the operation code is "Create new EPS bearer" and there is already an existing mapped EPS bearer context with the same EPS bearer identity associated with any PDU session.

3) When the operation code is "Create new EPS bearer" and the resulting mapped EPS bearer context has invalid mandatory parameters or missing mandatory parameters (e.g., mapped EPS QoS parameters or traffic flow template for a dedicated EPS bearer context).

In case 2, if the existing mapped EPS bearer context is associated with the PDU session that is being established, the UE shall not diagnose an error, further process the create request and, if it was process successfully, delete the old EPS bearer context.

Otherwise, the UE shall initiate a PDU session modification procedure by sending a PDU SESSION MODIFICATION REQUEST message to delete the mapped EPS bearer context with 5GSM cause #85 "Invalid mapped EPS bearer identity".

b) if the mapped EPS bearer context includes a traffic flow template, the UE shall check the traffic flow template for different types of TFT IE errors as follows:

1) Semantic errors in TFT operations:

i) When the TFT operation is an operation other than "Create new TFT"

The UE shall initiate a PDU session modification procedure by sending a PDU SESSION MODIFICATION REQUEST message to delete the mapped EPS bearer context with 5GSM cause #41 "semantic error in the TFT operation".

2) Syntactical errors in TFT operations:

i) When the TFT operation = "Create new TFT" and the packet filter list in the TFT IE is empty.

ii) When there are other types of syntactical errors in the coding of the TFT IE, such as a mismatch between the number of packet filters subfield, and the number of packet filters in the packet filter list.

The UE shall initiate a PDU session modification procedure by sending a PDU SESSION MODIFICATION REQUEST message with to delete the mapped EPS bearer context 5GSM cause #42 "syntactical error in the TFT operation".

3) Semantic errors in packet filters:

i) When a packet filter consists of conflicting packet filter components which would render the packet filter ineffective, i.e. no IP packet will ever fit this packet filter. How the UE determines a semantic error in a packet filter is outside the scope of the present document.

ii) When the resulting TFT, which is assigned to a dedicated EPS bearer context, does not contain any packet filter which applicable for the uplink direction.

The UE shall initiate a PDU session modification procedure by sending a PDU SESSION MODIFICATION REQUEST message to delete the mapped EPS bearer context with 5GSM cause #44 "semantic errors in packet filter(s)".

4) Syntactical errors in packet filters:

i) When the TFT operation = "Create new TFT" and two or more packet filters in the resultant TFT would have identical packet filter identifiers.

ii) When the TFT operation = "Create new TFT" and two or more packet filters in all TFTs associated with this PDN connection would have identical packet filter precedence values.

iii) When there are other types of syntactical errors in the coding of packet filters, such as the use of a reserved value for a packet filter component identifier.

In case ii, if the old packet filters do not belong to the default EPS bearer context, the UE shall not diagnose an error and shall delete the old packet filters which have identical filter precedence values.

In case ii, if one or more old packet filters belong to the default EPS bearer context, the UE shall initiate a PDU session modification procedure by sending a PDU SESSION MODIFICATION REQUEST message to delete the mapped EPS bearer context with 5GSM cause #45 "syntactical errors in packet filter(s)".

In cases i and iii the UE shall initiate a PDU session modification procedure by sending a PDU SESSION MODIFICATION REQUEST message to delete the mapped EPS bearer context with 5GSM cause #45 "syntactical error in packet filter(s)".

If the UE detects different errors in the mapped EPS bearer contexts, QoS rules or QoS flow descriptions, the UE may send a single PDU SESSION MODIFICATION REQUEST message to delete the erroneous mapped EPS bearer contexts, QoS rules or QoS flow descriptions. In that case, the UE shall include a single 5GSM cause in the PDU SESSION MODIFICATION REQUEST message.

NOTE 12: The 5GSM cause to use cannot be different from: #41 "semantic error in the TFT operation", #42 "syntactical error in the TFT operation", #44 "semantic error in packet filter(s)", #45 "syntactical errors in packet filter(s)", #83 "semantic error in the QoS operation", #84 "syntactical error in the QoS operation", and #85 "Invalid mapped EPS bearer identity". The selection of a 5GSM cause is up to the UE implementation.

If there are mapped EPS bearer context(s) associated with a PDU session, but none of them is associated with the default QoS rule, the UE shall initiate a PDU session modification procedure by sending a PDU SESSION MODIFICATION REQUEST message to delete the mapped EPS bearer context(s) with 5GSM cause #85 "Invalid mapped EPS bearer identity" and shall locally delete the stored EPS bearer identity (EBI) in all the QoS flow descriptions of the PDU session, if any.

The UE shall only use the Control plane CIoT 5GS optimization for this PDU session if the Control plane only indication is included in the PDU SESSION ESTABLISHMENT ACCEPT message.

If the UE requests the PDU session type "IPv4v6" and:

a) the UE receives the selected PDU session type set to "IPv4" and does not receive the 5GSM cause value #50 "PDU session type IPv4 only allowed"; or

b) the UE receives the selected PDU session type set to "IPv6" and does not receive the 5GSM cause value #51 "PDU session type IPv6 only allowed";

the UE may subsequently request another PDU session for the other IP version using the UE-requested PDU session establishment procedure to the same DNN (or no DNN, if no DNN was indicated by the UE) and the same S-NSSAI associated with (in roaming scenarios) a mapped S-NSSAI (or no S-NSSAI, if no S-NSSAI was indicated by the UE) with a single address PDN type (IPv4 or IPv6) other than the one already activated.

If the UE requests the PDU session type "IPv4v6", receives the selected PDU session type set to "IPv4" and the 5GSM cause value #50 "PDU session type IPv4 only allowed", the UE shall not subsequently request another PDU session using the UE-requested PDU session establishment procedure to the same DNN (or no DNN, if no DNN was indicated by the UE) and the same S-NSSAI associated with (in roaming scenarios) a mapped S-NSSAI (or no S-NSSAI, if no S-NSSAI was indicated by the UE) to obtain a PDU session type different from the one allowed by the network until any of the following conditions is fulfilled:

a) the UE is registered to a new PLMN;

b) the UE is switched off; or

c) the USIM is removed or the entry in the "list of subscriber data" for the current SNPN is updated.

If the UE requests the PDU session type "IPv4v6", receives the selected PDU session type set to "IPv6" and the 5GSM cause value #51 "PDU session type IPv6 only allowed", the UE shall not subsequently request another PDU session using the UE-requested PDU session establishment procedure to the same DNN (or no DNN, if no DNN was indicated by the UE) and the same S-NSSAI associated with (in roaming scenarios) a mapped S-NSSAI (or no S-NSSAI, if no S-NSSAI was indicated by the UE) to obtain a PDU session type different from the one allowed by the network until any of the following conditions is fulfilled:

a) the UE is registered to a new PLMN;

b) the UE is switched off; or

c) the USIM is removed or the entry in the "list of subscriber data" for the current SNPN is updated.

NOTE 13: For the 5GSM cause values #50 "PDU session type IPv4 only allowed", and #51 "PDU session type IPv6 only allowed", re-attempt in S1 mode for the same DNN (or no DNN, if no DNN was indicated by the UE) is only allowed using the PDU session type(s) indicated by the network.

If the selected PDU session type of the PDU session is "Unstructured" or "Ethernet", the UE supports inter-system change from N1 mode to S1 mode, the UE does not support establishment of a PDN connection for the PDN type set to "non-IP" in S1 mode, and the parameters list field of one or more authorized QoS flow descriptions received in the Authorized QoS flow descriptions IE of the PDU SESSION ESTABLISHMENT ACCEPT message contains an EPS bearer identity (EBI), then the UE shall locally remove the EPS bearer identity (EBI) from the parameters list field of such one or more authorized QoS flow descriptions. Additionally the UE shall also initiate a PDU session modification procedure by sending a PDU SESSION MODIFICATION REQUEST message to delete the mapped EPS bearer context with 5GSM cause #85 "Invalid mapped EPS bearer identity".

If the selected PDU session type of the PDU session is "Ethernet", the UE supports inter-system change from N1 mode to S1 mode, the UE does not support establishment of a PDN connection for the PDN type set to "non-IP" in S1 mode, the UE, the network or both of them do not support Ethernet PDN type in S1 mode, and the parameters list field of one or more authorized QoS flow descriptions received in the Authorized QoS flow descriptions IE of the PDU SESSION ESTABLISHMENT ACCEPT message contains an EPS bearer identity (EBI), then the UE shall locally remove the EPS bearer identity (EBI) from the parameters list field of such one or more authorized QoS flow descriptions. Additionally, the UE shall also initiate a PDU session modification procedure by sending a PDU SESSION MODIFICATION REQUEST message to delete the mapped EPS bearer context with 5GSM cause #85 "Invalid mapped EPS bearer identity".

For a UE which is registered for disaster roaming services and for a PDU session which is not a PDU session for emergency services:

a) if the parameters list field of one or more authorized QoS flow descriptions received in the Authorized QoS flow descriptions IE of the PDU SESSION ESTABLISHMENT ACCEPT message contains an EPS bearer identity (EBI), then the UE shall locally remove the EPS bearer identity (EBI) from the parameters list field of such one or more authorized QoS flow descriptions; and

b) the UE shall locally delete the contents of the Mapped EPS bearer contexts IE if it is received in the PDU SESSION ESTABLISHMENT ACCEPT message.

If the UE receives an IPv4 Link MTU parameter, an Ethernet Frame Payload MTU parameter, an Unstructured Link MTU parameter, or a Non-IP Link MTU parameter in the Extended protocol configuration options IE of the PDU SESSION ESTABLISHMENT ACCEPT message, the UE shall pass to the upper layer the received IPv4 link MTU size, the received Ethernet frame payload MTU size, the unstructured link MTU size, or the non-IP link MTU size.

NOTE 14: The IPv4 link MTU size corresponds to the maximum length of user data packet that can be sent either via the control plane or via N3 interface for a PDU session of the "IPv4" PDU session type.

NOTE 15: The Ethernet frame payload MTU size corresponds to the maximum length of a payload of an Ethernet frame that can be sent either via the control plane or via N3 interface for a PDU session of the "Ethernet" PDU session type.

NOTE 16: The unstructured link MTU size correspond to the maximum length of user data packet that can be sent either via the control plane or via N3 interface for a PDU session of the "Unstructured" PDU session type.

NOTE 17: A PDU session of "Ethernet" or "Unstructured" PDU session type can be transferred to a PDN connection of "non-IP" PDN type, thus the UE can request the non-IP link MTU parameter in the PDU session establishment procedure. The non-IP link MTU size corresponds to the maximum length of user data that can be sent either in the user data container in the ESM DATA TRANSPORT message or via S1-U interface as specified in 3GPP TS 24.301 [15].

If the 5G-RG receives an ACS information parameter in the Extended protocol configuration options IE of the PDU SESSION ESTABLISHMENT ACCEPT message, the 5G-RG shall pass the ACS URL in the received ACS information parameter to the upper layer.

If the UE has indicated support for CIoT 5GS optimizations and receives a small data rate control parameters container in the Extended protocol configuration options IE in the PDU SESSION ESTABLISHMENT ACCEPT message, the UE shall store the small data rate control parameters value and use the stored small data rate control parameters value as the maximum allowed limit of uplink user data for the PDU session in accordance with 3GPP TS 23.501 [8].

If the UE has indicated support for CIoT 5GS optimizations and receives an additional small data rate control parameters for exception data container in the Extended protocol configuration options IE in the PDU SESSION ESTABLISHMENT ACCEPT message, the UE shall store the additional small data rate control parameters for exception data value and use the stored additional small data rate control parameters for exception data value as the maximum allowed limit of uplink exception data for the PDU session in accordance with 3GPP TS 23.501 [8].

If the UE has indicated support for CIoT 5GS optimizations and receives an initial small data rate control parameters container or an initial additional small data rate control parameters for exception data container in the Extended protocol configuration options IE in the PDU SESSION ESTABLISHMENT ACCEPT message, the UE shall use these parameters for the newly established PDU Session. When the validity period of the initial parameters expire, the parameters received in a small data rate control parameters container or an additional small data rate control parameters for exception data container shall be used.

If the UE receives a Serving PLMN rate control IE in the PDU SESSION ESTABLISHMENT ACCEPT message, the UE shall store the Serving PLMN rate control IE value and use the stored serving PLMN rate control value as the maximum allowed limit of uplink control plane user data for the corresponding PDU session in accordance with 3GPP TS 23.501 [8].

If the UE receives an APN rate control parameters container or an additional APN rate control for exception data parameters container in the Extended protocol configuration options IE in the PDU SESSION ESTABLISHMENT ACCEPT message, the UE shall store these parameters and use them to limit the rate at which it generates uplink user data messages for the PDN connection corresponding to the PDU session if the PDU session is transferred to EPS upon inter-system change from N1 mode to S1 mode in accordance with 3GPP TS 24.301 [15]. The received APN rate control parameters and additional APN rate control for exception data parameters shall replace any previously stored APN rate control parameters and additional APN rate control for exception data parameters, respectively, for this PDN connection.

If the UE receives an initial APN rate control parameters container or an initial additional APN rate control for exception data parameters container in the Extended protocol configuration options IE in the PDU SESSION ESTABLISHMENT ACCEPT message, the UE shall store these parameters in the APN rate control status and use them to limit the rate at which it generates exception data messages for the PDN connection corresponding to the PDU session if the PDU session is transferred to EPS upon inter-system change from N1 mode to S1 mode in accordance with 3GPP TS 24.301 [15]. The received APN rate control status shall replace any previously stored APN rate control status for this PDN connection.

NOTE 18: In the PDU SESSION ESTABLISHMENT ACCEPT message, the SMF provides either APN rate control parameters container, or initial APN rate control parameters container, in the Extended protocol configuration options IE, but not both.

NOTE 19: In the PDU SESSION ESTABLISHMENT ACCEPT message, the SMF provides either additional APN rate control for exception data parameters container, or initial additional APN rate control for exception data parameters container, in the Extended protocol configuration options IE, but not both.

If the network accepts the use of Reliable Data Service to transfer data for the PDU session, the network shall include the Extended protocol configuration options IE in the PDU SESSION ESTABLISHMENT ACCEPT message and include the Reliable Data Service accepted indicator. The UE behaves as described in subclause 6.2.15.

If the UE indicates support of DNS over (D)TLS by providing DNS server security information indicator to the network and optionally, if the UE wishes to indicate which security protocol type(s) are supported by the UE, providing the DNS server security protocol support and the network wants to enforce the use of DNS over (D)TLS, the network may include the Extended protocol configuration options IE in the PDU SESSION ESTABLISHMENT ACCEPT message and include the DNS server security information with length of two octets. Upon receiving the DNS server security information, the UE shall pass it to the upper layer. The UE shall use this information to send the DNS over (D)TLS (See 3GPP TS 33.501 [24]).

NOTE 20: Support of DNS over (D)TLS is based on the informative requirements as specified in 3GPP TS 33.501 [24] and it is implemented based on the operator requirement.

If the PDU SESSION ESTABLISHMENT REQUEST message includes the Service-level-AA container IE with the service-level device ID set to the CAA-level UAV ID, and the SMF is provided by the UAS-NF the successful UUAA-SM result and the CAA-level UAV ID, the SMF shall store the successful result together with the authorized CAA-level UAV ID and transmit the PDU SESSION ESTABLISHMENT ACCEPT message to the UE, where the PDU SESSION ESTABLISHMENT ACCEPT message shall include the Service-level-AA container IE containing:

a) the service-level-AA response, with the SLAR field set to "Service level authentication and authorization was successful";

b) the service-level device ID with the value set to the CAA-level UAV ID; and

c) if a payload is received from the UAS-NF,the service-level-AA payload, with the value set to the payload;

d) if a payload type associated with the payload is received from the UAS-NF, the service-level-AA payload type with the values set to the associated payload type.

NOTE 21: UAS security information can be included in the UUAA payload by the USS as specified in 3GPP TS 33.256 [24B].

If the network accepts the request of the PDU session establishment for C2 communication, the network shall send the PDU SESSION ESTABLISHMENT ACCEPT message including the Service-level-AA container IE containing:

a) the service-level-AA response with the value of C2AR field set to the "C2 authorization was successful";

b) if a payload is provided from the UAS-NF, the service-level-AA payload with the value set to the payload;

c) if a payload type associated with the payload is provided from the UAS-NF, the service-level-AA payload type with the value set to the payload type; and

d) if the CAA-level UAV ID is provided from the UAS-NF, the service-level device ID with the value set to the CAA-level UAV ID.

NOTE 22:The C2 authorization payload in the service-level-AA payload can include the C2 session security information.

Upon receipt of the PDU SESSION ESTABLISHMENT ACCEPT message of the PDU session for C2 communication, if the Service-level-AA container IE is included, the UE shall forward the service-level-AA contents of the Service-level-AA container IE to the upper layers.

The SMF may be configured with one or more PVS IP addresses or PVS names or both associated with the DNN and S-NSSAI used for onboarding services in SNPN, for configuration of SNPN subscription parameters in PLMN via the user plane, or for configuration of a UE via the user plane with credentials for NSSAA or PDU session authentication and authorization procedure. If the PDU session was established for onboarding services in SNPN, or the PVS information request is included in the Extended protocol configuration options IE of the PDU SESSION ESTABLISHMENT REQUEST message establishing a PDU session providing connectivity for configuration of SNPN subscription parameters in PLMN via the user plane, the network may include the Extended protocol configuration options IE in the PDU SESSION ESTABLISHMENT ACCEPT message and include the PVS IP address(es) or the PVS name(s) or both associated with the DNN and S-NSSAI of the established PDU session, if available. If the PVS information request is included in the Extended protocol configuration options IE of the PDU SESSION ESTABLISHMENT REQUEST message establishing the PDU session providing connectivity for configuration of a UE via the user plane with credentials for PDU session authentication and authorization procedure, based on the subscribed DNN(s) and S-NSSAI(s) of the UE and the DNN and S-NSSAI of the established PDU session, the network should include the Extended protocol configuration options IE in the PDU SESSION ESTABLISHMENT ACCEPT message and include the PVS IP address(es) or the PVS name(s) or both, which are associated with the established PDU session and per subscribed DNN(s) and S-NSSAI(s) of the UE, if available. If the PVS information request is included in the Extended protocol configuration options IE of the PDU SESSION ESTABLISHMENT REQUEST message establishing the PDU session providing connectivity for configuration of a UE via the user plane with credentials for NSSAA, based on the subscribed S-NSSAI(s) of the UE and the S-NSSAI of the established PDU session, the network should include the Extended protocol configuration options IE in the PDU SESSION ESTABLISHMENT ACCEPT message and include the PVS IP address(es) or the PVS name(s) or both, which are associated with the established PDU session and per subscribed S-NSSAI(s) of the UE, if available.

NOTE 23: If the PVS information request is included in the Extended protocol configuration options IE of the PDU SESSION ESTABLISHMENT REQUEST message establishing a PDU session providing connectivity for configuration of SNPN subscription parameters in SNPN via the user plane by a UE which is not registered for onboarding services in SNPN, the SMF can include the PVS IP address(es) or the PVS name(s) or both, associated with the DNN and S-NSSAI of the established PDU session, if available, in the Extended protocol configuration options IE of the PDU SESSION ESTABLISHMENT ACCEPT message.

The UE upon receiving one or more PVS IP address(es), if any, one or more the PVS name(s), if any, or both shall pass them to the upper layers.

NOTE 24: If several PVS IP addresses, several PVS name(s), or one or more PVS IP addresses and one or more PVS name(s) are received, how the UE uses this information is up to UE implementation.

If the UE indicates support for ECS configuration information provisioning by providing the ECS configuration information provisioning support indicator in the Extended protocol configuration options IE of the PDU SESSION ESTABLISHMENT REQUEST message, then the SMF may include the Extended protocol configuration options IE in the PDU SESSION ESTABLISHMENT ACCEPT message with

– at least one of ECS IPv4 Address(es), ECS IPv6 Address(es), and ECS FQDN(s);

– at least one associated ECSP identifier; and

– optionally, spatial validity conditions associated with the ECS address.

The UE upon receiving one or more ECS IPv4 address(es), if any, ECS IPv6 address(es), if any, or ECS FQDN(s), if any, with the associated spatial validity condition, if any, and an ECSP identifier shall pass them to the upper layers.

NOTE 25: The IP address(es) and/or FQDN(s) are associated with the ECSP identifier and replace previously provided ECS configuration information associated with the same ECSP identifier, if any.

If the SMF needs to provide DNS server address(es) to the UE and the UE has provided the DNS server IPv4 address request, the DNS server IPv6 address request or both of them, in the PDU SESSION ESTABLISHMENT REQUEST message, then the SMF shall include the Extended protocol configuration options IE in the PDU SESSION ESTABLISHMENT ACCEPT message with one or more DNS server IPv4 address(es), one or more DNS server IPv6 address(es) or both of them. If the UE supports receiving DNS server addresses in protocol configuration options and receives one or more DNS server IPv4 address(es), one or more DNS server IPv6 address(es) or both of them, in the Extended protocol configuration options IE of the PDU SESSION ESTABLISHMENT ACCEPT message, then the UE shall pass the received DNS server IPv4 address(es), if any, and the received DNS server IPv6 address(es), if any, to upper layers.

NOTE 26: The received DNS server address(es) replace previously provided DNS server address(es), if any.

If the PDU SESSION ESTABLISHMENT ACCEPT message includes the Received MBS container IE, for each of the Received MBS information:

a) if MBS decision is set to "MBS join is accepted", the UE shall consider that it has successfully joined the multicast MBS session. The UE shall store the received TMGI and shall use it for any further operation on that multicast MBS session. The UE shall store the received MBS service area associated with the received TMGI, if any, and provide the received TMGI to lower layers. The UE may provide the MBS start time if it is included in the Received MBS information to upper layers; or

b) if MBS decision is set to "MBS join is rejected", the UE shall consider the requested join as rejected. The UE shall store the received MBS service area associated with the received TMGI, if any. If the received Rejection cause is set to "User is outside of local MBS service area", the UE shall not request to join the same multicast MBS session if neither current TAI nor CGI of the current cell is part of the received MBS service area. If the received Rejection cause is set to "multicast MBS session has not started or will not start soon" and an MBS back-off timer value is included with value that indicates neither zero nor deactivated, the UE shall start a back-off timer T3530 with the value provided in the MBS back-off timer value for the received TMGI, and shall not attempt to join the multicast MBS session with the same TMGI until the expiry of T3530. If the MBS back-off timer value indicates that this timer is deactivated, the UE shall not attempt to join the multicast MBS session with the same TMGI, the Source IP address information of the TMGI, or the Destination IP address information of the TMGI until the UE is switched off, the USIM is removed, or the entry in the "list of subscriber data" for the current SNPN is updated. If the MBS back-off timer value indicates zero, the UE may attempt to join the multicast MBS session with the same TMGI.

If the PDU session is established for IMS signalling and the UE has requested P-CSCF IPv6 address or P-CSCF IPv4 address, the SMF shall include P-CSCF IP address(es) in the Extended protocol configuration options IE in the PDU SESSION ESTABLISHMENT ACCEPT message.

NOTE 27: The P-CSCF selection functionality is specified in subclause 5.16.3.11 of 3GPP TS 23.501 [8].

Upon receipt of the PDU SESSION ESTABLISHMENT ACCEPT message, if the UE included the PDU session pair ID in the PDU SESSION ESTABLISHMENT REQUEST message, the UE shall associate the PDU session with the PDU session pair ID. If the UE included the RSN in the PDU SESSION ESTABLISHMENT REQUEST message, the UE shall associate the PDU session with the RSN.

If the UE supports EDC and the network allows the use of EDC, the SMF shall include the Extended protocol configuration options IE in the PDU SESSION ESTABLISHMENT ACCEPT message with the EDC usage allowed indicator. If the UE supports EDC and receives the EDC usage allowed indicator in the Extended protocol configuration options IE of the PDU SESSION ESTABLISHMENT ACCEPT message, the UE shall indicate to upper layers that network allows the use of EDC.

If the UE supports EDC and the network requires the use of EDC, the SMF shall include the Extended protocol configuration options IE in the PDU SESSION ESTABLISHMENT ACCEPT message with the EDC usage required indicator. If the UE supports EDC and receives the EDC usage required indicator in the Extended protocol configuration options IE of the PDU SESSION ESTABLISHMENT ACCEPT message, the UE shall indicate to upper layers that network requires the use of EDC.

If the PDU SESSION ESTABLISHMENT REQUEST message includes a MS support of MAC address range in 5GS indicator in the Extended protocol configuration options IE, the SMF:

a) shall consider that the UE supports a "destination MAC address range type" packet filter component and a "source MAC address range type" packet filter component; and

b) if the SMF supports a "destination MAC address range type" packet filter component and a "source MAC address range type" packet filter component and enables the UE to request QoS rules with a "destination MAC address range type" packet filter component and a "source MAC address range type" packet filter component, shall include the Extended protocol configuration options IE in the PDU SESSION ESTABLISHMENT ACCEPT message and shall include the Network support of MAC address range in 5GS indicator in the Extended protocol configuration options IE.

If the PDU SESSION ESTABLISHMENT ACCEPT message includes a Network support of MAC address range in 5GS indicator in the Extended protocol configuration options IE, the UE shall consider that the network supports a "destination MAC address range type" packet filter component and a "source MAC address range type" packet filter component.

NOTE 28: Handling of indication that network allows the use of EDC or that network requires the use of EDC is specified in 3GPP TS 23.548 [182].

6.4.1.4 UE-requested PDU session establishment procedure not accepted by the network

6.4.1.4.1 General

If the connectivity with the requested DN is rejected by the network, the SMF shall create a PDU SESSION ESTABLISHMENT REJECT message.

The SMF shall set the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message to indicate the reason for rejecting the PDU session establishment.

The 5GSM cause IE typically indicates one of the following SM cause values:

#8 operator determined barring;

#26 insufficient resources;

#27 missing or unknown DNN;

#28 unknown PDU session type;

#29 user authentication or authorization failed;

#31 request rejected, unspecified;

#32 service option not supported;

#33 requested service option not subscribed;

#35 PTI already in use;

#38 network failure;

#39 reactivation requested;

#46 out of LADN service area;

#50 PDU session type IPv4 only allowed;

#51 PDU session type IPv6 only allowed;

#54 PDU session does not exist;

#57: PDU session type IPv4v6 only allowed;

#58: PDU session type Unstructured only allowed;

#61: PDU session type Ethernet only allowed;

#67 insufficient resources for specific slice and DNN;

#68 not supported SSC mode;

#69 insufficient resources for specific slice;

#70 missing or unknown DNN in a slice;

#82 maximum data rate per UE for user-plane integrity protection is too low;

#86 UAS services not allowed; or

#95 – 111 protocol errors.

If the PDU SESSION ESTABLISHMENT REQUEST message includes a PDU session type IE set to "IPv6", and the subscription, the SMF configuration, or both, are limited to IPv4 only for the requested DNN, the SMF shall include the 5GSM cause value #50 "PDU session type IPv4 only allowed" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message.

If the PDU SESSION ESTABLISHMENT REQUEST message includes a PDU session type IE set to "IPv6", and the subscription, the SMF configuration, or both, support none of "IPv4" and "IPv6" PDU session types for the requested DNN, the SMF shall include the 5GSM cause value #28 "unknown PDU session type" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message.

If the PDU SESSION ESTABLISHMENT REQUEST message includes a PDU session type IE set to "IPv4", and the subscription, the SMF configuration, or both, are limited to IPv6 only for the requested DNN, the SMF shall include the 5GSM cause value #51 "PDU session type IPv6 only allowed" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message.

If the PDU SESSION ESTABLISHMENT REQUEST message includes a PDU session type IE set to "IPv4", and the subscription, the SMF configuration, or both, support none of "IPv4" and "IPv6" PDU session types for the requested DNN, the SMF shall include the 5GSM cause value #28 "unknown PDU session type" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message.

If the PDU SESSION ESTABLISHMENT REQUEST message includes a PDU session type IE set to "IPv4v6", and the subscription, the SMF configuration, or both, support none of "IPv4v6", "IPv4" and "IPv6" PDU session types for the requested DNN, the SMF shall include the 5GSM cause value #28 "unknown PDU session type" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message.

If the PDU SESSION ESTABLISHMENT REQUEST message includes a PDU session type IE set to "Unstructured" or "Ethernet", and the subscription, the SMF configuration, or both, do not support the PDU session type for the requested DNN, the SMF shall include the 5GSM cause value #28 "unknown PDU session type" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message.

If the PDU SESSION ESTABLISHMENT REQUEST message is to establish an MA PDU session and includes a PDU session type IE set to "Unstructured", and the SMF configuration does not support the PDU session type, the SMF shall include the 5GSM cause value #28 "unknown PDU session type" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message.

If the PDU SESSION ESTABLISHMENT REQUEST message contains the SSC mode IE indicating an SSC mode not supported by the subscription, the SMF configuration, or both of them, and the SMF decides to rejects the PDU session establishment, the SMF shall include the 5GSM cause value #68 "not supported SSC mode" in the 5GSM cause IE and the SSC modes allowed by SMF in the Allowed SSC mode IE of the PDU SESSION ESTABLISHMENT REJECT message.

If the PDU SESSION ESTABLISHMENT REQUEST message is to establish an MA PDU session and MA PDU session is not allowed due to operator policy and subscription, and the SMF decides to reject the PDU session establishment, the SMF shall include the 5GSM cause value #33 "requested service option not subscribed" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message.

If the PDU SESSION ESTABLISHMENT REQUEST message is identified to be for C2 communication and:

a) does not include the Service-level-AA container IE with the service-level device ID set to the CAA-level UAV ID; or

b) does not include the Service-level-AA container IE with the service-level-AA payload and the Service-level-AA payload type,

the SMF shall reject the PDU SESSION ESTABLISHMENT REQUEST message by transmitting a PDU SESSION ESTABLISHMENT REJECT message with 5GSM cause IE set to 5GSM cause value #86 "UAS services not allowed".

In 3GPP access, if the operator’s configuration requires user-plane integrity protection for the PDU session and, the maximum data rate per UE for user-plane integrity protection supported by the UE for uplink or the maximum data rate per UE for user-plane integrity protection supported by the UE for downlink, or both, are lower than required by the operator’s configuration, the SMF shall include the 5GSM cause value #82 "maximum data rate per UE for user-plane integrity protection is too low" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message.

If the UE requests a PDU session establishment for an LADN when the UE is located outside of the LADN service area, the SMF shall include the 5GSM cause value #46 "out of LADN service area" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message.

If the DN authentication of the UE was performed with the PDU session authentication and authorization procedure and completed unsuccessfully, the SMF shall include the 5GSM cause value #29 "user authentication or authorization failed" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message and shall set the EAP message IE of the PDU SESSION ESTABLISHMENT REJECT message to an EAP-failure message as specified in IETF RFC 3748 [34], provided by the DN.

If the DN authentication of the UE was performed with the service-level authentication and authorization procedure and completed unsuccessfully, the SMF shall include the 5GSM cause value #29 "user authentication or authorization failed" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message and shall include the service-level-AA response provided by DN in the Service-level-AA container IE of the PDU SESSION ESTABLISHMENT REJECT message.

Based on the local policy and user’s subscription data, if a PDU session is being established with the request type set to "existing PDU session" and the SMF determines the UE has:

a) moved between a tracking area in NB-N1 mode and a tracking area in WB-N1 mode;

b) moved between a tracking area in NB-S1 mode and a tracking area in WB-N1 mode; or

c) moved between a tracking area in WB-S1 mode and a tracking area in NB-N1 mode,

the SMF may reject the PDU SESSION ESTABLISHMENT REQUEST message and:

a) include the 5GSM cause value #39 "reactivation requested" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message; or

b) include a 5GSM cause value other than #39 "reactivation requested" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message.

NOTE 1: The included 5GSM cause value is up to the network implementation.

If the PDU session cannot be established due to resource unavailability in the UPF, the SMF shall include the 5GSM cause value #26 "insufficient resources" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message.

Based on the user’s subscription data and the operator policy, if the SMF determines that the UUAA-SM procedure needs to be performed for a UE but the SMF does not receives the service-level device ID set to the CAA-level UAV ID in the Service-level-AA container IE of the PDU SESSION ESTABLISHMENT REQUEST message from the UE, the SMF shall include the 5GSM cause value #86 "UAS services not allowed" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message.

The network may include a Back-off timer value IE in the PDU SESSION ESTABLISHMENT REJECT message.

If the 5GSM cause value is #26 "insufficient resources", #67 "insufficient resources for specific slice and DNN", or #69 "insufficient resources for specific slice" and the PDU SESSION ESTABLISHMENT REQUEST message was received from a UE configured for high priority access in selected PLMN or SNPN or the request type provided during the PDU session establishment is set to "initial emergency request" or "existing emergency PDU session", the network shall not include a Back-off timer value IE.

If the 5GSM cause value is #29 "user authentication or authorization failed ", the network should include a Back-off timer value IE.

If the Back-off timer value IE is included and the 5GSM cause value is different from #26 "insufficient resources", #28 "unknown PDU session type", #46 "out of LADN service area", #50 "PDU session type IPv4 only allowed", #51 "PDU session type IPv6 only allowed", #54 "PDU session does not exist", #57 "PDU session type IPv4v6 only allowed", #58 "PDU session type Unstructured only allowed", #61 "PDU session type Ethernet only allowed", #67 "insufficient resources for specific slice and DNN", #68 "not supported SSC mode", and #69 "insufficient resources for specific slice", the network may include the Re-attempt indicator IE to indicate whether the UE is allowed to attempt a PDN connectivity procedure in the PLMN for the same DNN in S1 mode, and whether another attempt in S1 mode or in N1 mode is allowed in an equivalent PLMN.

If the 5GSM cause value is #50 "PDU session type IPv4 only allowed", #51 "PDU session type IPv6 only allowed", #57 "PDU session type IPv4v6 only allowed", #58 "PDU session type Unstructured only allowed", or #61 "PDU session type Ethernet only allowed", the network may include the Re-attempt indicator IE without Back-off timer value IE to indicate whether the UE is allowed to attempt a PDU session establishment procedure in an equivalent PLMN in N1 mode using the same PDU session type for the same DNN (or no DNN, if no DNN was indicated by the UE) and the same S-NSSAI (or no S-NSSAI, if no S-NSSAI was indicated by the UE).

The SMF shall send the PDU SESSION ESTABLISHMENT REJECT message.

Upon receipt of a PDU SESSION ESTABLISHMENT REJECT message and a PDU session ID, using the NAS transport procedure as specified in subclause 5.4.5, the UE shall stop timer T3580 shall release the allocated PTI value and shall consider that the PDU session was not established.

If the PDU SESSION ESTABLISHMENT REQUEST message was sent with request type set to "initial emergency request" or "existing emergency PDU session" and the UE receives a PDU SESSION ESTABLISHMENT REJECT message, then the UE may:

a) inform the upper layers of the failure of the procedure; or

NOTE 2: This can result in the upper layers requesting another emergency call attempt using domain selection as specified in 3GPP TS 23.167 [6].

b) de-register locally, if not de-registered already, attempt initial registration for emergency services.

If the PDU SESSION ESTABLISHMENT REJECT message includes 5GSM cause #39 "reactivation requested" and the PDU session is being transferred from EPS to 5GS and established with the request type set to "existing PDU session", the UE should re-initiate the UE-requested PDU session establishment procedure as specified in subclause 6.4.1 for:

a) the PDU session type associated with the transferred PDU session;

b) the SSC mode associated with the transferred PDU session;

c) the DNN associated with the transferred PDU session; and

d) the S-NSSAI associated with (if available in roaming scenarios) a mapped S-NSSAI if provided in the UE-requested PDU session establishment procedure of the transferred PDU session.

If the PDU SESSION ESTABLISHMENT REJECT message includes 5GSM cause #86 "UAS services not allowed" and the UE has not included the service-level device ID in the Service-level-AA container IE of the PDU SESSION ESTABLISHMENT REQUEST message and set the value to the CAA-level UAV ID:

a) the UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for UAS services without including the CAA-level UAV ID in the service-level device ID of the Service-level-AA container IE; and

b) upon receipt of the request from the upper layers to establish a PDU session for UAS services, the UE shall initiate the UE-requested PDU session establishment procedure by including the service-level device ID in the Service-level-AA container IE of the PDU SESSION ESTABLISHMENT REQUEST message and set the value to the CAA-level UAV ID as specified in subclause 6.4.1.2.

If the 5GSM cause value is different from #26 "insufficient resources", #28 "unknown PDU session type", #39 "reactivation requested", #46 "out of LADN service area", #50 "PDU session type IPv4 only allowed", #51 "PDU session type IPv6 only allowed", #54 "PDU session does not exist", #57 "PDU session type IPv4v6 only allowed", #58 "PDU session type Unstructured only allowed", #61 "PDU session type Ethernet only allowed", #67 "insufficient resources for specific slice and DNN", #68 "not supported SSC mode", and #69 "insufficient resources for specific slice", #86 "UAS services not allowed", and #33 "requested service option not subscribed" and the PDU SESSION ESTABLISHMENT REQUEST message was received from a UE configured for high priority access in selected PLMN, the network shall not include a Back-off timer value IE.

6.4.1.4.2 Handling of network rejection due to congestion control

If:

– the 5GSM cause value #26 "insufficient resources" and the Back-off timer value IE are included in the PDU SESSION ESTABLISHMENT REJECT message; or

– an indication that the 5GSM message was not forwarded due to DNN based congestion control is received along a Back-off timer value and a PDU SESSION ESTABLISHMENT REQUEST message with the PDU session ID IE set to the PDU session ID of the PDU session;

the UE shall ignore the 5GSM congestion re-attempt indicator or the Re-attempt indicator IE provided by the network, if any, and the UE shall take different actions depending on the timer value received for timer T3396 in the Back-off timer value IE or depending on the Back-off timer value received from the 5GMM sublayer (if the UE is a UE configured for high priority access in selected PLMN or SNPN, exceptions are specified in subclause 6.2.7):

a) If the timer value indicates neither zero nor deactivated and a DNN was provided during the PDU session establishment, the UE shall stop timer T3396 associated with the corresponding DNN, if it is running. If the timer value indicates neither zero nor deactivated and no DNN was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop timer T3396 associated with no DNN if it is running. The UE shall then start timer T3396 with the value provided in the Back-off timer value IE or with the Back-off timer value received from the 5GMM sublayer and:

The UE shall not stop timer T3396 upon a PLMN change or inter-system change;

b) if the timer value indicates that this timer is deactivated and a DNN was provided during the PDU session establishment, the UE shall stop timer T3396 associated with the corresponding DNN, if it is running. If the timer value indicates that this timer is deactivated and no DNN was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop timer T3396 associated with no DNN if it is running. The UE:

1) shall not send another PDU SESSION ESTABLISHMENT REQUEST message or PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for the same DNN until the UE is switched off, the USIM is removed, the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder, or the UE receives a PDU SESSION MODIFICATION COMMAND message for the same DNN from the network, or a PDU SESSION AUTHENTICATION COMMAND message for the same DNN from the network, or a PDU SESSION RELEASE COMMAND message without the Back-off timer value IE for the same DNN from the network; and

2) shall not send another PDU SESSION ESTABLISHMENT REQUEST message without a DNN and with request type different from "initial emergency request" and different from "existing emergency PDU session", or another PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for a non-emergency PDU session established without a DNN provided by the UE, if no DNN was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", until the UE is switched off, the USIM is removed, the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder, or the UE receives a PDU SESSION MODIFICATION COMMAND message for a non-emergency PDU session established without a DNN provided by the UE, or a PDU SESSION AUTHENTICATION COMMAND message for a non-emergency PDU session established without a DNN provided by the UE, or a PDU SESSION RELEASE COMMAND message without the Back-off timer value IE for a non-emergency PDU session established without a DNN provided by the UE.

The timer T3396 remains deactivated upon a PLMN change or inter-system change; and

c) if the timer value indicates zero, the UE:

1) shall stop timer T3396 associated with the corresponding DNN, if running, and may send another PDU SESSION ESTABLISHMENT REQUEST message or PDU SESSION MODIFICATION REQUEST message for the same DNN; and

2) if no DNN was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop timer T3396 associated with no DNN, if running, and may send another PDU SESSION ESTABLISHMENT REQUEST message without a DNN, or another PDU SESSION MODIFICATION REQUEST message without a DNN provided by the UE.

When the timer T3396 is running or the timer is deactivated, the UE is allowed to initiate a PDU session establishment procedure for emergency services.

If the timer T3396 is running when the UE enters state 5GMM-DEREGISTERED, the UE remains switched on, and the USIM in the UE (if any) remains the same and the entry in the "list of subscriber data" to which timer T3396 is associated (if any) is not updated, then timer T3396 is kept running until it expires or it is stopped.

If the UE is switched off when the timer T3396 is running, and if the USIM in the UE (if any) remains the same and the entry in the "list of subscriber data" to which timer T3396 is associated (if any) is not updated when the UE is switched on, the UE shall behave as follows:

– let t1 be the time remaining for T3396 timeout at switch off and let t be the time elapsed between switch off and switch on. If t1 is greater than t, then the timer shall be restarted with the value t1 – t. If t1 is equal to or less than t, then the timer need not be restarted. If the UE is not capable of determining t, then the UE shall restart the timer with the value t1.

If:

– the 5GSM cause value #67 "insufficient resources for specific slice and DNN" and the Back-off timer value IE are included in the PDU SESSION ESTABLISHMENT REJECT message; or

– an indication that the 5GSM message was not forwarded due to S-NSSAI and DNN based congestion control is received along a Back-off timer value and a PDU SESSION ESTABLISHMENT REQUEST message with the PDU session ID IE set to the PDU session ID of the PDU session;

the UE shall ignore the Re-attempt indicator IE provided by the network, if any, and take different actions depending on the timer value received for timer T3584 in the Back-off timer value IE or depending on the Back-off timer value received from the 5GMM sublayer (if the UE is a UE configured for high priority access in selected PLMN or SNPN, exceptions are specified in subclause 6.2.8):

a) If the timer value indicates neither zero nor deactivated, the UE shall stop timer T3584 associated with the same [S-NSSAI, DNN] combination as that the UE provided during the PDU session establishment, if it is running. If the timer value indicates neither zero nor deactivated and no DNN was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop timer T3584 associated with [S-NSSAI, no DNN] combination as that the UE provided during the PDU session establishment, if it is running. If the timer value indicates neither zero nor deactivated and no S-NSSAI was provided during the PDU session establishment, the UE shall stop timer T3584 associated with [no S-NSSAI, DNN] combination as that the UE provided during the PDU session establishment, if it is running. If the timer value indicates neither zero nor deactivated and neither S-NSSAI nor DNN was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop timer T3584 associated with [no S-NSSAI, no DNN] combination as that the UE provided during the PDU session establishment, if it is running. The timer T3584 to be stopped includes the timer T3584 applied for all the PLMNs, if running, and the timer T3584 applied for the registered PLMN, if running. The UE shall then start timer T3584 with the value provided in the Back-off timer value IE or with the Back-off timer value received from the 5GMM sublayer and:

1) shall not send another PDU SESSION ESTABLISHMENT REQUEST message, or PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for the same [S-NSSAI, DNN] combination that was sent by the UE, until timer T3584 expires or timer T3584 is stopped;

2) shall not send another PDU SESSION ESTABLISHMENT REQUEST message with request type different from "initial emergency request" and different from "existing emergency PDU session", or another PDU SESSION MODIFICATION REQUEST with exception of those identified in subclause 6.4.2.1, message for the same [S-NSSAI, no DNN] combination that was sent by the UE, if no DNN was provided during the PDU session establishment, until timer T3584 expires or timer T3584 is stopped;

3) shall not send another PDU SESSION ESTABLISHMENT REQUEST message, or another PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for the same [no S-NSSAI, DNN] combination that was sent by the UE, if no S-NSSAI was provided during the PDU session establishment, until timer T3584 expires or timer T3584 is stopped; and

4) shall not send another PDU SESSION ESTABLISHMENT REQUEST message with request type different from "initial emergency request" and different from "existing emergency PDU session", or another PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for the same [no S-NSSAI, no DNN] combination that was sent by the UE, if neither S-NSSAI nor DNN was provided during the PDU session establishment, until timer T3584 expires or timer T3584 is stopped.

The UE shall not stop timer T3584 upon a PLMN change or inter-system change;

b) if the timer value indicates that this timer is deactivated, the UE:

1) shall stop timer T3584 associated with the same [S-NSSAI, DNN] combination as that the UE provided during the PDU session establishment (including the timer T3584 applied for all the PLMNs, if running, and the timer T3584 applied for the registered PLMN, if running), if it is running. The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message, or PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for the same [S-NSSAI, DNN] combination that was sent by the UE, until the UE is switched off, the USIM is removed, the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder, or the UE receives a PDU SESSION MODIFICATION COMMAND message for the same [S-NSSAI, DNN] combination from the network, or a PDU SESSION AUTHENTICATION COMMAND message for the same [S-NSSAI, DNN] combination from the network, or a PDU SESSION RELEASE COMMAND message without the Back-off timer value IE for the same [S-NSSAI, DNN] combination from the network;

2) shall stop timer T3584 associated with the same [S-NSSAI, no DNN] combination as that the UE provided during the PDU session establishment (including the timer T3584 applied for all the PLMNs, if running, and the timer T3584 applied for the registered PLMN, if running), if it is running. The UE shall not send a PDU SESSION ESTABLISHMENT REQUEST message with request type different from "initial emergency request" and different from "existing emergency PDU session", or a PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for the same [S-NSSAI, no DNN] combination that was sent by the UE, if no DNN was provided during the PDU session establishment, until the UE is switched off, the USIM is removed, the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" if the UE supports access to an SNPN using credentials from a credentials holder, or the UE receives an PDU SESSION MODIFICATION COMMAND message for a non-emergency PDU session established for the same [S-NSSAI, no DNN] combination from the network, or a PDU SESSION AUTHENTICATION COMMAND message for a non-emergency PDU session established for the same [S-NSSAI, DNN] combination from the network, or a PDU SESSION RELEASE COMMAND message without the Back-off timer value IE for a non-emergency PDU session established for the same [S-NSSAI, no DNN] combination from the network;

3) shall stop timer T3584 associated with the same [no S-NSSAI, DNN] combination as that the UE provided during the PDU session establishment (including the timer T3584 applied for all the PLMNs, if running, and the timer T3584 applied for the registered PLMN, if running), if it is running. The UE shall not send a PDU SESSION ESTABLISHMENT REQUEST message, or a PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for the same [no S-NSSAI, DNN] combination that was sent by the UE, if no S-NSSAI was provided during the PDU session establishment, until the UE is switched off, the USIM is removed, the entry in the "list of subscriber data" for the current SNPN is updated, or the UE receives a PDU SESSION MODIFICATION COMMAND message for the same [no S-NSSAI, DNN] combination from the network, or a PDU SESSION AUTHENTICATION COMMAND message for a non-emergency PDU session established for the same [no S-NSSAI, no DNN] combination from the network, or a PDU SESSION RELEASE COMMAND message without the Back-off timer value IE for the same [no S-NSSAI, DNN] combination from the network; and

4) shall stop timer T3584 associated with the same [no S-NSSAI, no DNN] combination as that the UE provided during the PDU session establishment (including the timer T3584 applied for all the PLMNs, if running, and the timer T3584 applied for the registered PLMN, if running), if it is running. The UE shall not send a PDU SESSION ESTABLISHMENT REQUEST message with request type different from "initial emergency request" and different from "existing emergency PDU session", or a PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for the same [no S-NSSAI, no DNN] combination that was sent by the UE, if neither S-NSSAI nor DNN was provided during the PDU session establishment, until the UE is switched off, the USIM is removed, the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder, or the UE receives an PDU SESSION MODIFICATION COMMAND message for a non-emergency PDU session established for the same [no S-NSSAI, no DNN] combination from the network or a PDU SESSION RELEASE COMMAND message without the Back-off timer value IE for a non-emergency PDU session established for the same [no S-NSSAI, no DNN] combination from the network.

The timer T3584 remains deactivated upon a PLMN change or inter-system change; and

c) if the timer value indicates zero, the UE:

If the Back-off timer value IE is not included or no Back-off timer value is received from the 5GMM sublayer, then the UE may send another PDU SESSION ESTABLISHMENT REQUEST message or PDU SESSION MODIFICATION REQUEST message for the same [S-NSSAI, DNN] combination, or for the same [S-NSSAI, no DNN] combination, or for the same [no S-NSSAI, DNN] combination, or for the same [no S-NSSAI, no DNN] combination.

When the timer T3584 is running or the timer is deactivated, the UE is allowed to initiate a PDU session establishment procedure for emergency services.

If the timer T3584 is running when the UE enters state 5GMM-DEREGISTERED, the UE remains switched on, and the USIM in the UE (if any) remains the same and the entry in the "list of subscriber data" to which timer T3584 is associated (if any) is not updated, then timer T3584 is kept running until it expires or it is stopped.

If the UE is switched off when the timer T3584 is running, and if the USIM in the UE (if any) remains the same and the entry in the "list of subscriber data" to which timer T3584 is associated (if any) is not updated when the UE is switched on, the UE shall behave as follows:

– let t1 be the time remaining for T3584 timeout at switch off and let t be the time elapsed between switch off and switch on. If t1 is greater than t, then the timer shall be restarted with the value t1 – t. If t1 is equal to or less than t, then the timer need not be restarted. If the UE is not capable of determining t, then the UE shall restart the timer with the value t1.

If:

– the 5GSM cause value #69 "insufficient resources for specific slice" and the Back-off timer value IE are included in the PDU SESSION ESTABLISHMENT REJECT message; or

– an indication that the 5GSM message was not forwarded due to S-NSSAI only based congestion control is received along a Back-off timer value and a PDU SESSION ESTABLISHMENT REQUEST message with the PDU session ID IE set to the PDU session ID of the PDU session;

the UE shall ignore the Re-attempt indicator IE provided by the network, if any, and take different actions depending on the timer value received for timer T3585 in the Back-off timer value IE or depending on the Back-off timer value received from the 5GMM sublayer (if the UE is a UE configured for high priority access in selected PLMN or SNPN, exceptions are specified in subclause 6.2.8):

a) If the timer value indicates neither zero nor deactivated and an S-NSSAI was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop timer T3585 associated with the corresponding S-NSSAI, if it is running. If the timer value indicates neither zero nor deactivated and no S-NSSAI was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop timer T3585 associated with no S-NSSAI if it is running. The timer T3585 to be stopped includes:

– the timer T3585 applied for all the PLMNs and for the access over which the PDU SESSION ESTABLISHMENT REJECT is received, if running;

– the timer T3585 applied for all the PLMNs and for both 3GPP access type and non-3GPP access type, if running;

– the timer T3585 applied for the registered PLMN and for the access over which the PDU SESSION ESTABLISHMENT REJECT is received, if running; and

– the timer T3585 applied for the registered PLMN and for both 3GPP access type and non-3GPP access type, if running;

The UE shall then start timer T3585 with the value provided in the Back-off timer value IE or with the Back-off timer value received from the 5GMM sublayer and:

The UE shall not stop timer T3585 upon a PLMN change or inter-system change;

b) if the timer value indicates that this timer is deactivated and an S-NSSAI was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop timer T3585 associated with the corresponding S-NSSAI, if it is running. If the timer value indicates that this timer is deactivated and no S-NSSAI was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop timer T3585 associated with no S-NSSAI if it is running. The timer T3585 to be stopped includes:

– the timer T3585 applied for all the PLMNs and for the access over which the PDU SESSION ESTABLISHMENT REJECT is received, if running;

– the timer T3585 applied for all the PLMNs and for both 3GPP access type and non-3GPP access type, if running;

– the timer T3585 applied for the registered PLMN and for the access over which the PDU SESSION ESTABLISHMENT REJECT is received, if running; and

– the timer T3585 applied for the registered PLMN and for both 3GPP access type and non-3GPP access type, if running;

The UE:

1) shall not send another PDU SESSION ESTABLISHMENT REQUEST message with request type different from "initial emergency request" and different from "existing emergency PDU session", or another PDU SESSION MODIFICATION REQUEST with exception of those identified in subclause 6.4.2.1, for a non-emergency PDU session for the same S-NSSAI until the UE is switched off, the USIM is removed, the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder, or the UE receives a PDU SESSION MODIFICATION COMMAND message for a non-emergency PDU session for the same S-NSSAI from the network, or a PDU SESSION AUTHENTICATION COMMAND message for a non-emergency PDU session for the same S-NSSAI from the network, or a PDU SESSION RELEASE COMMAND message without the Back-off timer value IE for the same S-NSSAI from the network; and

2) shall not send another PDU SESSION ESTABLISHMENT REQUEST message without an S-NSSAI and with request type different from "initial emergency request" and different from "existing emergency PDU session", or another PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for a non-emergency PDU session established without an S-NSSAI provided by the UE, if no S-NSSAI was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", until the UE is switched off, the USIM is removed, the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder, or the UE receives a PDU SESSION MODIFICATION COMMAND message for a non-emergency PDU session established without an S-NSSAI provided by the UE, or a PDU SESSION AUTHENTICATION COMMAND message for a non-emergency PDU session established without an S-NSSAI provided by the UE, or a PDU SESSION RELEASE COMMAND message without the Back-off timer value IE for a non-emergency PDU session established without an S-NSSAI provided by the UE.

The timer T3585 remains deactivated upon a PLMN change or inter-system change; and

c) if the timer value indicates zero, the UE:

1) shall stop timer T3585 associated with the corresponding S-NSSAI (including the timer T3585 applied for all the PLMNs, if running, and the timer T3585 applied for the registered PLMN, if running), if running, and may send another PDU SESSION ESTABLISHMENT REQUEST message or PDU SESSION MODIFICATION REQUEST message for the same S-NSSAI; and

2) if no S-NSSAI was provided during the PDU session establishment and the request type was different from "initial emergency request " and different from "existing emergency PDU session", the UE shall stop timer T3585 associated with no S-NSSAI, if running, and may send another PDU SESSION ESTABLISHMENT REQUEST message without an S-NSSAI (including the timer T3585 applied for all the PLMNs, if running, and the timer T3585 applied for the registered PLMN, if running), or another PDU SESSION MODIFICATION REQUEST message without an S-NSSAI provided by the UE.

If the 5GSM congestion re-attempt indicator IE with the ABO bit set to "The back-off timer is applied in all PLMNs" is included in the PDU SESSION ESTABLISHMENT REJECT message with the 5GSM cause value #69 "insufficient resources for specific slice", then the UE shall apply the timer T3585 for all the PLMNs. Otherwise, the UE shall apply the timer T3585 for the registered PLMN. Additionally, if the 5GSM congestion re-attempt indicator IE with the CATBO bit set to "The back-off timer is applied in the current access type" is included in the PDU SESSION ESTABLISHMENT REJECT message with the 5GSM cause value #69 "insufficient resources for specific slice", then the UE shall apply the timer T3585 for the current access type. Otherwise, the UE shall apply the timer T3585 for both 3GPP access type and non-3GPP access type and the UE shall stop any running timer T3585 for the applied PLMN and for the access different from the access from which the PDU SESSION ESTABLISHMENT REJECT message is received.

When the timer T3585 is running or the timer is deactivated, the UE is allowed to initiate a PDU session establishment procedure for emergency services.

If the timer T3585 is running when the UE enters state 5GMM-DEREGISTERED, the UE remains switched on, and the USIM in the UE (if any) remains the same and the entry in the "list of subscriber data" to which timer T3585 is associated (if any) is not updated, then timer T3585 is kept running until it expires or it is stopped.

If the UE is switched off when the timer T3585 is running, and if the USIM in the UE (if any) remains the same and the entry in the "list of subscriber data" to which timer T3585 is associated (if any) is not updated when the UE is switched on, the UE shall behave as follows:

let t1 be the time remaining for T3585 timeout at switch off and let t be the time elapsed between switch off and switch on. If t1 is greater than t, then the timer shall be restarted with the value t1 – t. If t1 is equal to or less than t, then the timer need not be restarted. If the UE is not capable of determining t, then the UE shall restart the timer with the value t1.

NOTE: As described in this subclause, upon PLMN change or inter-system change, the UE does not stop the timer T3584 or T3585. This means the timer T3584 or T3585 can still be running or be deactivated for the given 5GSM procedure, the PLMN, the S-NSSAI and optionally the DNN combination when the UE returns to the PLMN or when it performs inter-system change back from S1 mode to N1 mode. Thus the UE can still be prevented from sending another PDU SESSION ESTABLISHMENT REQUEST or PDU SESSION MODIFICATION REQUEST message in the PLMN for the same S-NSSAI and optionally the same DNN.

Upon PLMN change, if T3584 is running or is deactivated for an S-NSSAI, a DNN, and old PLMN, but T3584 is not running and is not deactivated for the S-NSSAI, the DNN, and new PLMN, then the UE is allowed to send a PDU SESSION ESTABLISHMENT REQUEST message for the same S-NSSAI and the same DNN in the new PLMN.

Upon PLMN change, if T3585 is running or is deactivated for an S-NSSAI and old PLMN, but T3585 is not running and is not deactivated for the S-NSSAI and new PLMN, then the UE is allowed to send a PDU SESSION ESTABLISHMENT REQUEST message for the same S-NSSAI in the new PLMN.

6.4.1.4.3 Handling of network rejection not due to congestion control

If the 5GSM cause value is different from #26 "insufficient resources", #28 "unknown PDU session type", #39 "reactivation requested", #46 "out of LADN service area", #50 "PDU session type IPv4 only allowed", #51 "PDU session type IPv6 only allowed", #54 "PDU session does not exist", #57 "PDU session type IPv4v6 only allowed", #58 "PDU session type Unstructured only allowed", #61 "PDU session type Ethernet only allowed", #67 "insufficient resources for specific slice and DNN", #68 "not supported SSC mode", and #69 "insufficient resources for specific slice", #86 "UAS services not allowed", and #33 "requested service option not subscribed" upon sending PDU SESSION ESTABLISHMENT REQUEST to establish an MA PDU session, and the Back-off timer value IE is included, the UE shall behave as follows: (if the UE is a UE configured for high priority access in selected PLMN or SNPN, exceptions are specified in subclause 6.2.12):

a) if the timer value indicates neither zero nor deactivated and:

1) if the UE provided a DNN and S-NSSAI to the network during the PDU session establishment and the 5GSM cause value is different from #27 "missing or unknown DNN", the UE shall start the back-off timer with the value provided in the Back-off timer value IE for the PDU session establishment procedure and [PLMN, DNN, (mapped) HPLMN S-NSSAI] combination. The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same DNN and (mapped) HPLMN S-NSSAI in the current PLMN, until the back-off timer expires, the UE is switched off, the USIM is removed, or the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder;

2) if the UE provided a DNN to the network during the PDU session establishment and the 5GSM cause value is #27 "missing or unknown DNN", the UE shall start the back-off timer with the value provided in the Back-off timer value IE for the PDU session establishment procedure and [PLMN, DNN] combination. The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same DNN in the current PLMN, until the back-off timer expires, the UE is switched off, the USIM is removed, or the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder;

3) if the UE did not provide a DNN or S-NSSAI or any of the two parameters to the network during the PDU session establishment and the 5GSM cause value is different from #27 "missing or unknown DNN", it shall start the back-off timer accordingly for the PDU session establishment procedure and the [PLMN, DNN, no S-NSSAI], [PLMN, no DNN, (mapped) HPLMN S-NSSAI] or [PLMN, no DNN, no S-NSSAI] combination. Dependent on the combination, the UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same [PLMN, DNN, no S-NSSAI], [PLMN, no DNN, (mapped) HPLMN S-NSSAI] or [PLMN, no DNN, no S-NSSAI] combination in the current PLMN, until the back-off timer expires, the UE is switched off, the USIM is removed, or the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder; or

4) if the UE did not provide a DNN to the network during the PDU session establishment and the 5GSM cause value is #27 "missing or unknown DNN", it shall start the back-off timer accordingly for the PDU session establishment procedure and the [PLMN, no DNN] combination. The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same [PLMN, no DNN] in the current PLMN, until the back-off timer expires, the UE is switched off, the USIM is removed, or the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder;

b) if the timer value indicates that this timer is deactivated and:

1) if the UE provided a DNN and S-NSSAI to the network during the PDU session establishment and the 5GSM cause value is different from #27 "missing or unknown DNN", the UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same DNN and (mapped) HPLMN S-NSSAI in the current PLMN, until the UE is switched off, the USIM is removed, or the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder;

2) if the UE provided a DNN to the network during the PDU session establishment and the 5GSM cause value is #27 "missing or unknown DNN", the UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same DNN in the current PLMN, until the UE is switched off, the USIM is removed, or the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder;

3) if the UE did not provide a DNN or S-NSSAI or any of the two parameters to the network during the PDU session establishment and the 5GSM cause value is different from #27 "missing or unknown DNN", the UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same [PLMN, DNN, no S-NSSAI], [PLMN, no DNN, (mapped) HPLMN S-NSSAI] or [PLMN, no DNN, no S-NSSAI] combination in the current PLMN, until the UE is switched off, the USIM is removed, or the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder; or

4) if the UE did not provide a DNN to the network during the PDU session establishment and the 5GSM cause value is #27 "missing or unknown DNN", the UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same [PLMN, no DNN] in the current PLMN, until the UE is switched off, the USIM is removed, or the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder; and

c) if the timer value indicates zero and the 5GSM cause value is different from #27 "missing or unknown DNN", the UE may send another PDU SESSION ESTABLISHMENT REQUEST message for the same combination of [PLMN, DNN, (mapped) HPLMN S-NSSAI], [PLMN, DNN, no S-NSSAI], [PLMN, no DNN, (mapped) HPLMN S-NSSAI], or [PLMN, no DNN, no S-NSSAI] in the current PLMN. If the timer value indicates zero and the 5GSM cause value is #27 "missing or unknown DNN", the UE may send another PDU SESSION ESTABLISHMENT REQUEST message for the same combination of [PLMN, DNN], or [PLMN, no DNN] in the current PLMN.

If the Back-off timer value IE is not included, then the UE shall ignore the Re-attempt indicator IE provided by the network in the PDU SESSION ESTABLISHMENT REJECT message, if any.

a) Additionally, if the 5GSM cause value is #8 "operator determined barring", #32 "service option not supported", #33 "requested service option not subscribed" upon sending PDU SESSION ESTABLISHMENT REQUEST not to establish an MA PDU session, or #70 "missing or unknown DNN in a slice", then:

1) the UE not operating in SNPN access operation mode shall proceed as follows:

i) if the UE is registered in the HPLMN or in a PLMN that is within the EHPLMN list, the UE shall behave as described above in the present subclause using the configured SM Retry Timer value as specified in 3GPP TS 24.368 [17] or in USIM file NAS_CONFIG as specified in 3GPP TS 31.102 [22], if available, as back-off timer value; and

NOTE 1: The way to choose one of the configured SM Retry Timer values for back-off timer value is up to UE implementation if the UE is configured with:
– an SM Retry Timer value in ME as specified in 3GPP TS 24.368 [17]; and
– an SM Retry Timer value in USIM file NAS_CONFIG as specified in 3GPP TS 31.102 [22].

ii) otherwise, if the UE is not registered in its HPLMN or in a PLMN that is within the EHPLMN list, or if the SM Retry Timer value is not configured, the UE shall behave as described above in the present subclause, using the default value of 12 minutes for the back-off timer; or

2) the UE operating in SNPN access operation mode shall proceed as follows:

i) if:

A) the SM Retry Timer value for the current SNPN as specified in 3GPP TS 24.368 [17] is available; or

B) the UE used the USIM for registration to the current SNPN and the SM Retry Timer value in USIM file NAS_CONFIG as specified in 3GPP TS 31.102 [22] is available;

then the UE shall behave as described above in the present subclause using the configured SM Retry Timer value as back-off timer value; or

NOTE 2: The way to choose one of the configured SM Retry Timer values for back-off timer value is up to UE implementation if both conditions in bullets A) and B) above are satisfied.

ii) otherwise, the UE shall behave as described above in the present subclause, using the default value of 12 minutes for the back-off timer.

b) For 5GSM cause value #27 "missing or unknown DNN", then:

1) the UE not operating in SNPN access operation mode shall proceed as follows:

i) if the UE is registered in the HPLMN or in a PLMN that is within the EHPLMN list, the UE shall start the back-off timer with the configured SM Retry Timer value as specified in 3GPP TS 24.368 [17] or in USIM file NAS_CONFIG as specified in 3GPP TS 31.102 [22], if available, as back-off timer value for the PDU session establishment procedure and the [PLMN, DNN] or [PLMN, no DNN] combination. The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same DNN in the current PLMN, until the back-off timer expires, the UE is switched off or the USIM is removed; and

NOTE 3: The way to choose one of the configured SM Retry Timer values for back-off timer value is up to UE implementation if the UE is configured with:
– an SM Retry Timer value in ME as specified in 3GPP TS 24.368 [17]; and
– an SM Retry Timer value in USIM file NAS_CONFIG as specified in 3GPP TS 31.102 [22].

ii) otherwise, if the UE is not registered in its HPLMN or in a PLMN that is within the EHPLMN list, or if the SM Retry Timer value is not configured, the UE shall start the back-off timer with the default value of 12 minutes as back-off timer value for the PDU session establishment procedure and the [PLMN, DNN] or [PLMN, no DNN] combination. The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same DNN in the current PLMN, until the back-off timer expires, the UE is switched off or the USIM is removed; or

2) the UE operating in SNPN access operation mode shall proceed as follows:

i) if:

A) the SM Retry Timer value for the current SNPN as specified in 3GPP TS 24.368 [17] is available; or

B) the UE used the USIM for registration to the current SNPN and the SM Retry Timer value in USIM file NAS_CONFIG as specified in 3GPP TS 31.102 [22] is available;

then:

– if the UE does not support access to an SNPN using credentials from a credentials holder, the UE shall start the back-off timer with the configured SM Retry Timer value as back-off timer value for the PDU session establishment procedure and the [SNPN, DNN] or [SNPN, no DNN] combination. The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same DNN in the current SNPN, until the back-off timer expires, the UE is switched off, or the entry in the "list of subscriber data" for the current SNPN is updated; and

– if the UE supports access to an SNPN using credentials from a credentials holder, the UE shall start the back-off timer with the configured SM Retry Timer value as back-off timer value for the PDU session establishment procedure and the [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, DNN] or [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN] combination. The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same DNN in the current SNPN using the selected entry in the "list of subscriber data" or selected PLMN subscription, until the back-off timer expires, the UE is switched off, the UICC containing the USIM is removed or the selected entry of the "list of subscriber data" is updated; or

NOTE 4: The way to choose one of the configured SM Retry Timer values for back-off timer value is up to UE implementation if both conditions in bullets A) and B) above are satisfied.

ii) otherwise:

– if the UE does not support access to an SNPN using credentials from a credentials holder, the UE shall start the back-off timer with the default value of 12 minutes as back-off timer value for the PDU session establishment procedure and the [SNPN, DNN] or [SNPN, no DNN] combination. The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same DNN in the current SNPN, until the back-off timer expires, the UE is switched off, or the entry in the "list of subscriber data" for the current SNPN is updated; and

– if the UE supports access to an SNPN using credentials from a credentials holder, the UE shall start the back-off timer with the default value of 12 min as back-off timer value for the PDU session establishment procedure and the [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, DNN] or [SNPN, selected entry in the "list of subscriber data" or selected PLMN subscription, no DNN] combination. The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same DNN in the current SNPN using the selected entry of the "list of subscriber data", until the back-off timer expires, the UE is switched off, the UICC containing the USIM is removed or the selected entry of the "list of subscriber data" is updated; and

c) For 5GSM cause values different from #8 "operator determined barring", #27 "missing or unknown DNN", #32 "service option not supported", #33 "requested service option not subscribed" and #70 "missing or unknown DNN in a slice", the UE behaviour regarding the start of a back-off timer is unspecified.

The UE shall not stop any back-off timer:

a) upon a PLMN change;

b) upon an inter-system change; or

c) upon registration over another access type.

If the network indicates that a back-off timer for the PDU session establishment procedure is deactivated, then it remains deactivated;

a) upon a PLMN change;

b) upon an inter-system change; or

c) upon registration over another access type.

NOTE 5: This means the back-off timer can still be running or be deactivated for the given 5GSM procedure when the UE returns to the PLMN or when it performs inter-system change back from S1 mode to N1 mode. Thus, the UE can still be prevented from sending another PDU SESSION ESTABLISHMENT REQUEST message for the combination of [PLMN, DNN, (mapped) HPLMN S-NSSAI], [PLMN, DNN, no S-NSSAI], [PLMN, no DNN, (mapped) HPLMN S-NSSAI], [PLMN, no DNN, no S-NSSAI] , [PLMN, DNN], or [PLMN, no DNN] in the PLMN.

If the back-off timer is started upon receipt of a PDU SESSION ESTABLISHMENT REJECT (i.e. the timer value was provided by the network, a configured value is available or the default value is used as explained above) or the back-off timer is deactivated, the UE behaves as follows:

a) after a PLMN change:

1) the UE may send a PDU SESSION ESTABLISHMENT REQUEST message for the combination of [new PLMN, DNN, (mapped) HPLMN S-NSSAI], [new PLMN, DNN, no S-NSSAI], [new PLMN, no DNN, (mapped) HPLMN S-NSSAI], or [new PLMN, no DNN, no S-NSSAI] in the new PLMN, if the back-off timer is not running and is not deactivated for the PDU session establishment procedure and the combination of [new PLMN, DNN, (mapped) HPLMN S-NSSAI], [new PLMN, DNN, no S-NSSAI], [new PLMN, no DNN, (mapped) HPLMN S-NSSAI], or [new PLMN, no DNN, no S-NSSAI];

2) as an implementation option, for the 5GSM cause value #8 "operator determined barring", #32 "service option not supported", #33 "requested service option not subscribed" and #70 "missing or unknown DNN in a slice", if the network does not include a Re-attempt indicator IE, the UE may decide not to automatically send another PDU SESSION ESTABLISHMENT REQUEST message for the same combination of [PLMN, DNN, (mapped) HPLMN S-NSSAI], [PLMN, DNN, no S-NSSAI], [PLMN, no DNN, (mapped) HPLMN S-NSSAI], or [PLMN, no DNN, no S-NSSAI] using the same PDU session type if the UE is registered to a new PLMN which is in the list of equivalent PLMNs; and

3) as an implementation option, for the 5GSM cause value #27 "missing or unknown DNN", if the network does not include a Re-attempt indicator IE, the UE may decide not to automatically send another PDU SESSION ESTABLISHMENT REQUEST message for the same combination of [PLMN, DNN] or [PLMN, no DNN] using the same PDU session type if the UE is registered to a new PLMN which is in the list of equivalent PLMNs;

b) if the network does not include the Re-attempt indicator IE to indicate whether re-attempt in S1 mode is allowed, or the UE ignores the Re-attempt indicator IE, e.g. because the Back-off timer value IE is not included, then:

1) if the UE is registered in its HPLMN or in a PLMN that is within the EHPLMN list and the back-off timer is running for the combination of [PLMN, DNN, (mapped) HPLMN S-NSSAI] or [PLMN, DNN, no S-NSSAI], the UE shall apply the configured SM_RetryAtRATChange value as specified in 3GPP TS 24.368 [17] or in USIM file NAS_CONFIG as specified in 3GPP TS 31.102 [22], if available, to determine whether the UE may attempt a PDN connectivity procedure for the same [PLMN, DNN] combination in S1 mode. If the back-off timer is running for the combination of [PLMN, no DNN, (mapped) HPLMN S-NSSAI] or [PLMN, no DNN, no S-NSSAI], the same applies for the PDN connectivity procedure for the [PLMN, no DNN] combination in S1 mode accordingly; and

NOTE 6: The way to choose one of the configured SM_RetryAtRATChange values for back-off timer value is up to UE implementation if the UE is configured with:
– an SM_RetryAtRATChange value in ME as specified in 3GPP TS 24.368 [17]; and
– an SM_RetryAtRATChange value in USIM file NAS_CONFIG as specified in 3GPP TS 31.102 [22].

2) if the UE is not registered in its HPLMN or in a PLMN that is within the EHPLMN list, or if the NAS configuration MO as specified in 3GPP TS 24.368 [17] is not available and the value for inter-system change is not configured in the USIM file NAS_CONFIG, then the UE behaviour regarding a PDN connectivity procedure for the same [PLMN, DNN] or [PLMN, no DNN] combination in S1 mode is unspecified; and

c) if the network includes the Re-attempt indicator IE indicating that re-attempt in an equivalent PLMN is not allowed, then depending on the timer value received in the Back-off timer value IE, for each combination of a PLMN from the equivalent PLMN list and the respective [DNN, (mapped) HPLMN S-NSSAI], [DNN, no S-NSSAI], [no DNN, (mapped) HPLMN S-NSSAI], or [no DNN, no S-NSSAI] combination, the UE shall start a back-off timer for the PDU session establishment procedure with the value provided by the network, or deactivate the respective back-off timer as follows:

1) if the Re-attempt indicator IE additionally indicates that re-attempt in S1 mode is allowed, the UE shall start or deactivate the back-off timer for N1 mode only; and

2) otherwise, the UE shall start or deactivate the back-off timer for S1 and N1 mode.

If the back-off timer for a [PLMN, DNN] or [PLMN, no DNN] combination, was started or deactivated in S1 mode upon receipt of PDN CONNECTIVITY REJECT message (see 3GPP TS 24.301 [15]) and the network indicated that re-attempt in N1 mode is allowed, then this back-off timer does not prevent the UE from sending a PDU SESSION ESTABLISHMENT REQUEST message in this PLMN for the same DNN, or without DNN, after inter-system change to N1 mode. If the network indicated that re-attempt in N1 mode is not allowed, the UE shall not send any PDU SESSION ESTABLISHMENT REQUEST message in this PLMN for the same DNN in combination with any S-NSSAI or without S-NSSAI, or in this PLMN without DNN in combination with any S-NSSAI or without S-NSSAI, after inter-system change to N1 mode until the timer expires, the UE is switched off or the USIM is removed.

NOTE 7: The back-off timer is used to describe a logical model of the required UE behaviour. This model does not imply any specific implementation, e.g. as a timer or timestamp.

NOTE 8: Reference to back-off timer in this section can either refer to use of timer T3396 or to use of a different packet system specific timer within the UE. Whether the UE uses T3396 as a back-off timer or it uses different packet system specific timers as back-off timers is left up to UE implementation.

When the back-off timer is running or the timer is deactivated, the UE is allowed to initiate a PDU session establishment procedure if the procedure is for emergency services.

If the 5GSM cause value is #28 "unknown PDU session type" and the PDU SESSION ESTABLISHMENT REQUEST message contained a PDU session type IE indicating a PDU session type, the UE shall ignore the Back-off timer value IE and Re-attempt indicator IE provided by the network, if any. The UE may send another PDU SESSION ESTABLISHMENT REQUEST message to establish a new PDU session with the PDU session type IE indicating another PDU session type, e.g. using another value which can be used for the rejected component in the same route selection descriptor as specified in 3GPP TS 24.526 [19]. The behaviour of the UE for 5GSM cause value #28 also applies if the PDU session is a MA PDU Session.

If the 5GSM cause value is #39 "reactivation requested", the UE shall ignore the Back-off timer value IE and Re-attempt indicator IE provided by the network, if any.

NOTE 9: Further UE behaviour upon receipt of 5GSM cause value #39 is up to the UE implementation.

If the 5GSM cause value is #46 "out of LADN service area", the UE shall ignore the Back-off timer value IE and Re-attempt indicator IE provided by the network, if any. If the UE is not located inside the LADN service area, the UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message or another PDU SESSION MODIFICATION REQUEST message except for indicating a change of 3GPP PS data off UE status for the LADN DNN provided by the UE during the PDU session establishment procedure until the LADN information for the specific LADN DNN is updated as described in subclause 5.4.4 and subclause 5.5.1. If the UE is not located inside the LADN service area, the UE shall not indicate the PDU session(s) for the LADN DNN provided by the UE during the PDU session establishment procedure in the Uplink data status IE included in the SERVICE REQUEST message until the LADN information for the specific LADN DNN is updated as described in subclause 5.4.4 and subclause 5.5.1.

NOTE 10: Based on UE implementation, the UE locating inside the LADN service area can send another PDU SESSION ESTABLISHMENT REQUEST message or PDU SESSION MODIFICATION REQUEST message for the LADN DNN which was rejected with the 5GSM cause value #46 "out of LADN service area".

If the 5GSM cause value is #50 "PDU session type IPv4 only allowed", #51 "PDU session type IPv6 only allowed", #57 "PDU session type IPv4v6 only allowed", #58 "PDU session type Unstructured only allowed", or #61 "PDU session type Ethernet only allowed", the UE shall ignore the Back-off timer value IE provided by the network, if any. The UE shall evaluate the URSP rules if available as specified in 3GPP TS 24.526 [19]. The UE shall not subsequently send another PDU SESSION ESTABLISHMENT REQUEST message for the same DNN (or no DNN, if no DNN was indicated by the UE) and the same (mapped) HPLMN S-NSSAI (or no S-NSSAI, if no S-NSSAI was indicated by the UE) to obtain a PDU session type different from the one allowed by the network until any of the following conditions is fulfilled:

a) the UE is registered to a new PLMN which was not in the list of equivalent PLMNs at the time when the PDU SESSION ESTABLISHMENT REJECT message was received;

b) the UE is registered to a new PLMN which was in the list of equivalent PLMNs at the time when the PDU SESSION ESTABLISHMENT REJECT message was received, and either the network did not include a Re-attempt indicator IE in the PDU SESSION ESTABLISHMENT REJECT message or the Re-attempt indicator IE included in the message indicated that re-attempt in an equivalent PLMN is allowed;

c) void;

d) the UE is switched off; or

e) the USIM is removed, the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder.

For the 5GSM cause values #50 "PDU session type IPv4 only allowed", #51 "PDU session type IPv6 only allowed", #57 "PDU session type IPv4v6 only allowed", #58 "PDU session type Unstructured only allowed", and #61 "PDU session type Ethernet only allowed", the UE shall ignore the value of the RATC bit in the Re-attempt indicator IE provided by the network, if any.

NOTE 11: For the 5GSM cause values #50 "PDU session type IPv4 only allowed", #51 "PDU session type IPv6 only allowed", #57 "PDU session type IPv4v6 only allowed", #58 "PDU session type Unstructured only allowed", and #61 "PDU session type Ethernet only allowed", re-attempt in S1 mode for the same DNN (or no DNN, if no DNN was indicated by the UE) is only allowed using the PDU session type(s) indicated by the network.

If the 5GSM cause value is #54 "PDU session does not exist", the UE shall ignore the Back-off timer value IE and Re-attempt indicator IE provided by the network, if any. If the PDU session establishment procedure is to perform handover of an existing PDU session between 3GPP access and non-3GPP access, the UE shall release locally the existing PDU session with the PDU session ID included in the PDU SESSION ESTABLISHMENT REJECT message. The UE may initiate another UE-requested PDU session establishment procedure with the request type set to "initial request" in the subsequent PDU SESSION ESTABLISHMENT REQUEST message to establish a PDU session with the same DNN (or no DNN, if no DNN was indicated by the UE) and the same (mapped) HPLMN S-NSSAI (or no S-NSSAI, if no S-NSSAI was indicated by the UE).

NOTE 12: User interaction is necessary in some cases when the UE cannot re-establish the PDU session(s) automatically.

If the 5GSM cause value is #68 "not supported SSC mode", the UE shall ignore the Back-off timer value IE and Re-attempt indicator IE provided by the network, if any. The UE shall evaluate the URSP rules if available as specified in 3GPP TS 24.526 [19]. The UE shall not subsequently send another PDU SESSION ESTABLISHMENT REQUEST message for the same DNN (or no DNN, if no DNN was indicated by the UE) and the same (mapped) HPLMN S-NSSAI (or no S-NSSAI, if no S-NSSAI was indicated by the UE) using the same SSC mode or an SSC mode which was not included in the Allowed SSC mode IE until any of the following conditions is fulfilled:

a) the UE is registered to a new PLMN which was not in the list of equivalent PLMNs at the time when the PDU SESSION ESTABLISHMENT REJECT message was received;

b) the SSC mode which is used to access to the DNN (or no DNN, if no DNN was indicated by the UE) and the (mapped) HPLMN S-NSSAI (or no S-NSSAI, if no S-NSSAI was indicated by the UE) is changed by the UE which subsequently requests a new SSC mode in the Allowed SSC mode IE or no SSC mode;

c) the UE is switched off; or

d) the USIM is removed, the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder.

If the UE receives the 5GSM cause value is #33 "requested service option not subscribed" upon sending PDU SESSION ESTABLISHMENT REQUEST to establish an MA PDU session, the UE shall ignore the Back-off timer value IE and Re-attempt indicator IE provided by the network, if any. The UE shall evaluate URSP rules, if available, as specified in 3GPP TS 24.526 [19] and the UE may send PDU SESSION ESTABLISHMENT REQUEST after evaluating those URSP rules.

If the 5GSM cause value is #86 "UAS services not allowed", the UE shall ignore the Back-off timer value IE and Re-attempt indicator IE provided by the network, if any, and shall behave as specified in subcluase 6.4.1.4.1.

Upon receipt of an indication from 5GMM sublayer that the 5GSM message was not forwarded because the DNN is not supported or not subscribed in a slice along with a PDU SESSION ESTABLISHMENT REQUEST message with the PDU session ID IE set to the PDU session ID of the PDU session, the UE shall stop timer T3580, shall abort the procedure and shall behave as follows:

a) if the timer value indicates neither zero nor deactivated, the UE shall start the back-off timer with the value received from the 5GMM sublayer for the PDU session establishment procedure and the [PLMN, DNN, S-NSSAI] combination or the [PLMN, DNN, no S-NSSAI] combination, if no S-NSSAI was provided during the PDU session establishment. The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message in the PLMN for the same DNN and the same S-NSSAI that were sent by the UE, or for the same DNN and no S-NSSAI if S-NSSAI that was not sent by the UE, until:

1) the back-off timer expires;

2) the UE is switched off;

3) the USIM is removed the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder; or

4) the DNN is included in the LADN information and the network provides the LADN information during the registration procedure or the generic UE configuration update procedure;

b) if the timer value is not received from the 5GMM sublayer or the timer value indicates that this timer is deactivated, the UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message in the PLMN for the same DNN and the same S-NSSAI that were sent by the UE, or for the same DNN and no S-NSSAI if S-NSSAI that was not sent by the UE, until:

1) the UE is switched off;

2) the USIM is removed, the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder; or

3) the DNN is included in the LADN information and the network provides the LADN information during the registration procedure or the generic UE configuration update procedure; and

c) if the timer value indicates zero, the UE may send another PDU SESSION ESTABLISHMENT REQUEST message for the same combination of [PLMN, DNN, S-NSSAI], [PLMN, DNN, no S-NSSAI] in the current PLMN.

6.4.1.5 Handling the maximum number of established PDU sessions

The maximum number of PDU sessions which a UE can establish in a PLMN or SNPN is limited by whichever is the lowest of: the maximum number of PDU session IDs allowed by the protocol (as specified in 3GPP TS 24.007 [11] subclause 11.2.3.1b), the PLMN’s or SNPN’s maximum number of PDU sessions and the UE’s implementation-specific maximum number of PDU sessions.

If during a UE-requested PDU session establishment procedure the 5GSM sublayer in the UE receives an indication that the 5GSM message was not forwarded because:

a) the PLMN’s maximum number of PDU sessions has been reached, then the UE determines the PLMN’s maximum number of PDU sessions as the number of active PDU sessions it has; or

b) the SNPN’s maximum number of PDU sessions has been reached, then the UE determines the SNPN’s maximum number of PDU sessions as the number of active PDU sessions it has and associates the determined maximum number of PDU sessions with:

1) the entry in the "list of subscriber data" for the current SNPN if the UE does not support access to an SNPN using credentials from a credentials holder; or

2) the selected entry of the "list of subscriber data" or the selected PLMN subscription if the UE supports access to an SNPN using credentials from a credentials holder.

NOTE 1: In some situations, when attempting to establish multiple PDU sessions, the number of active PDU sessions that the UE has when 5GMM cause #65 is received is not equal to the maximum number of PDU sessions reached in the network.

NOTE 2: When the network supports emergency services, it is not expected that 5GMM cause #65 is returned by the network when the UE requests an emergency PDU session.

NOTE 3: There is only one maximum number of PDU sessions for a PLMN regardless of which access the PDU session exists in.

NOTE 4: An MA PDU session which (only) has a PDN connection established as a user-plane resource is counted as an active PDU session when determining the PLMN’s maximum number of PDU sessions.

The PLMN’s maximum number of PDU sessions applies to the PLMN in which the 5GMM cause #65 "maximum number of PDU sessions reached" is received. When the UE is switched off or when the USIM is removed, the UE shall clear all previous determinations representing PLMN’s maximum number of PDU sessions.

The SNPN’s maximum number of PDU sessions applies to the SNPN in which the 5GMM cause #65 "maximum number of PDU sessions reached" is received. When the UE is switched off, the UE shall clear all previous determinations representing SNPN’s maximum number of PDU sessions. In addition:

a) if the UE does not support access to an SNPN using credentials from a credentials holder and the entry in the "list of subscriber data" for the current SNPN is updated, then the UE shall clear all previous determinations representing SNPN’s maximum number of PDU sessions associated with the entry in the "list of subscriber data" for the current SNPN; and

b) if the UE supports access to an SNPN using credentials from a credentials holder and:

1) the selected entry of the "list of subscriber data" is updated, then UE shall clear all previous determinations representing SNPN’s maximum number of PDU sessions associated with the selected entry in the "list of subscriber data"; or

2) the USIM associated with the selected PLMN subscription is removed, then UE shall clear all previous determinations representing SNPN’s maximum number of PDU sessions associated with the selected PLMN subscription.

Upon successful registration with a new PLMN or SNPN, the UE may clear previous determinations representing any PLMN’s or SNPN’s maximum number(s) of PDU sessions.

If the maximum number of established PDU sessions is reached at the UE and the upper layers of the UE request connectivity to a DNN the UE shall not send a PDU SESSION ESTABLISHMENT REQUEST message unless an established PDU session is released. If the UE needs to release an established PDU session, choosing which PDU session to release is implementation specific, however the UE shall not release the emergency PDU session.

If the UE needs to release a PDU session in order to request an emergency PDU session, it shall either perform a local release of a PDU session or release a PDU session via explicit signalling. If the UE performs a local release, the UE shall:

a) if the PDU session is an MA PDU session:

1) perform a registration procedure for mobility and periodic registration update to indicate PDU session status to the network over each access that user plane resources have been established; and

2) perform a normal and periodic tracking area updating to indicate EPS bearer context status to the network as specified in clause 5.5.3.2.2 of 3GPP TS 24.301 [15] when a PDN connection has been established as a user plance resource; or

b) if the PDU session is a single access PDU session, perform a registration procedure for mobility and periodic registration update to indicate PDU session status to the network over the access the PDU session is associated with.

6.4.1.5A Handling the maximum number of allowed active user-plane resources for PDU sessions of UEs in NB-N1 mode

For a UE in NB-N1 mode, the UE’s maximum number of supported user-plane resources is two (as defined in 3GPP TS 36.300 [25B]) when the UE sets the Multiple user-plane resources support bit to "Multiple user-plane resources supported" during the registration procedure for initial registration or for mobility and periodic registration update, and one otherwise.

For a UE operating in NB-N1 mode, if:

a) the UE’s maximum number of supported user-plane resources is one, then only one PDU session can have active user-plane resources even though that UE might have established more than one PDU session; or

b) the UE’s maximum number of supported user-plane resources is two, then only two PDU sessions can have active user-plane resources even though that UE might have established more than two PDU sessions.

When the maximum number of active user-plane resources is reached and upper layers request for more user-plane resources for PDU sessions other than the PDU sessions with those active user-plane resources, the UE can choose to release one or more of the PDU sessions with active user-plane resources to cater for the upper layer request. The choice of which PDU sessions to be released is implementation specific. However if there is a PDU session with an active user-plane that is used for exception data reporting (see subclause 6.2.13), that PDU session shall not be released.

If the maximum number of active user-plane resources is reached and the upper layers of the UE request user-plane resources for exception data reporting (see subclause 6.2.13), the UE shall release a PDU session that has user-plane resources to cater for the request for exception data reporting. The choice of which PDU session to be released is implementation specific.

If the UE decides to release one or more active user-plane resources to cater for upper layer request, the UE shall release the PDU session via explicit 5GSM signalling.

6.4.1.6 Abnormal cases in the UE

The following abnormal cases can be identified:

a) Expiry of timer T3580

The UE shall, on the first expiry of the timer T3580:

– if the PDU SESSION ESTABLISHMENT REQUEST message was sent with request type set to "initial emergency request" or "existing emergency PDU session", then the UE may:

a) inform the upper layers of the failure of the procedure; or

NOTE 1: This can result in the upper layers requesting another emergency call attempt using domain selection as specified in 3GPP TS 23.167 [6].

b) de-register locally, if not de-registered already, attempt initial registration for emergency services.

If the UE sent the PDU SESSION ESTABLISHMENT REQUEST message in order to perform a handover of an existing emergency PDU session between 3GPP access and non-3GPP access, the UE shall consider that the emergency PDU session is associated with the source access type.

– otherwise, retransmit the PDU SESSION ESTABLISHMENT REQUEST message and the PDU session information which was transported together with the initial transmission of the PDU SESSION ESTABLISHMENT REQUEST message and shall reset and start timer T3580, if still needed. This retransmission can be repeated up to four times, i.e. on the fifth expiry of timer T3580, the UE shall abort the procedure, release the allocated PTI and enter the state PROCEDURE TRANSACTION INACTIVE. If the UE sent the PDU SESSION ESTABLISHMENT REQUEST message in order to perform a handover of an existing non-emergency PDU session between 3GPP access and non-3GPP access, the UE shall consider that the PDU session is associated with the source access type.

b) Upon receiving an indication that the 5GSM message was not forwarded due to routing failure along with a PDU SESSION ESTABLISHMENT REQUEST message with the PDU session ID IE set to the same value as the PDU session ID that was sent by the UE, the UE shall stop timer T3580 and shall abort the procedure. If the UE sent the PDU SESSION ESTABLISHMENT REQUEST message in order to perform a handover of an existing PDU session between 3GPP access and non-3GPP access, the UE shall consider that the PDU session is associated with the source access type.

b1) Upon receiving an indication that the 5GSM message was not forwarded due to service area restrictions along with a PDU SESSION ESTABLISHMENT REQUEST message with the PDU session ID IE set to the same value as the PDU session ID that was sent by the UE, the UE shall stop timer T3580 and shall abort the procedure. If the UE sent the PDU SESSION ESTABLISHMENT REQUEST message in order to perform a handover of an existing PDU session between 3GPP access and non-3GPP access, the UE shall consider that the PDU session is associated with the source access type.

b2) Upon receiving an indication that the 5GSM message was not forwarded because the UE is registered to a PLMN via a satellite NG-RAN cell that is not allowed to operate at the present UE location along with a PDU SESSION ESTABLISHMENT REQUEST message with the PDU session ID IE set to the same value as the PDU session ID that was sent by the UE, the UE shall stop timer T3580 and shall abort the procedure. The UE shall not trigger the PDU session establishment procedure until the UE is deregistered from the PLMN.

b3) Upon receiving an indication that the 5GSM message was not forwarded because the UE is marked in the UE’s 5GMM context that it is not allowed to request UAS services along with a PDU SESSION ESTABLISHMENT REQUEST message with the PDU session ID IE set to the same value as the PDU session ID that was sent by the UE, the UE shall stop timer T3580 and shall abort the procedure. The UE shall not trigger the PDU session establishment procedure until the UE is deregistered from the PLMN.

b4) Upon receiving an indication that the 5GSM message was not forwarded because the PLMN’s maximum number of PDU sessions has been reached along with a PDU SESSION ESTABLISHMENT REQUEST message with the PDU session ID IE set to the same value as the PDU session ID that was sent by the UE, the UE shall stop timer T3580 and shall abort the procedure.

c) Collision of UE-requested PDU session establishment procedure and network-requested PDU session release procedure.

If the UE receives a PDU SESSION RELEASE COMMAND message after sending a PDU SESSION ESTABLISHMENT REQUEST message to the network, and the PDU session ID in the PDU SESSION RELEASE COMMAND message is the same as the PDU session ID in the PDU SESSION ESTABLISHMENT REQUEST message:

i) if the UE-requested PDU session establishment procedure was to request the establishment of user plane resources on the second access for an MA PDU session established on a first access and the Access type IE is not included in PDU SESSION RELEASE COMMAND or the Access type IE included in PDU SESSION RELEASE COMMAND indicates the first access, the UE shall proceed with the network-requested PDU session release procedure, abort the UE-requested PDU session establishment procedure, stop timer T3580, release the allocated PTI and enter the state PROCEDURE TRANSACTION INACTIVE;

ii) if the PDU SESSION ESTABLISHMENT REQUEST message was sent with request type set to "existing PDU session" or "existing emergency PDU session" in order to perform a handover of an existing PDU session between 3GPP access and non-3GPP access, the UE shall abort the PDU session establishment procedure and proceed with the network-requested PDU session release procedure; or

iii) otherwise, the UE shall ignore the PDU SESSION RELEASE COMMAND message and proceed with the UE-requested PDU session establishment procedure.

d) Inter-system change from N1 mode to S1 mode triggered during UE-requested PDU session establishment procedure.

If the UE-requested PDU session establishment procedure is triggered for handover of an existing PDU session from non-3GPP access to 3GPP access, and the inter-system change from N1 mode to S1 mode is triggered by the NG-RAN and the UE did not receive response to PDU session establishment request, then the UE shall abort the procedure, stop timer T3580, and notify the upper layer of the handover failure.

NOTE 2: This can result in the upper layer requesting re-initiation of handover from non-3GPP access to 3GPP access after the inter-system change is completed, if still required.

e) For an MA PDU session established on a single access, upon receipt of a PDU SESSION ESTABLISHMENT ACCEPT message over the other access, if any value of the selected PDU session type, selected SSC mode, 5GSM cause, PDU address, S-NSSAI, DNN IEs in the PDU SESSION ESTABLISHMENT ACCEPT message is different from the corresponding stored value, the UE shall perform a local release of the MA PDU session, and perform the registration procedure for mobility and periodic registration update with a REGISTRATION REQUEST message including the PDU session status IE over both accesses.

f) For an MA PDU session has a PDN connection as a user-plane resource, upon receipt of a PDU SESSION ESTABLISHMENT ACCEPT message over non-3GPP access, if any value of the selected PDU session type, selected SSC mode, 5GSM cause, PDU address, S-NSSAI, DNN IEs in the PDU SESSION ESTABLISHMENT ACCEPT message is different from the corresponding stored mapped value, the UE shall perform a local release of the MA PDU session, perform the registration procedure for mobility and periodic registration update with a REGISTRATION REQUEST message including the PDU session status IE over non-3GPP access, and perform the tracking area updating procedure as specified in clause 5.5.3.2.2 of 3GPP TS 24.301 [15] with a TRACKING AREA UPDATE REQUEST message including EPS bearer context status IE.

g) Collision of UE-requested PDU session establishment procedure initiated to perform handover of an existing PDU session from non-3GPP access to 3GPP access and a notification from the network with access type indicating non-3GPP access.

If the UE receives a notification from the network with access type indicating non-3GPP access after sending a PDU SESSION ESTABLISHMENT REQUEST message to perform handover of an existing PDU session from non-3GPP access to 3GPP access, the UE shall abort the PDU session establishment procedure, stop timer T3580, proceed with the service request procedure to perform handover of existing PDU session(s) from non-3GPP access to 3GPP access.

h) Collision of UE-requested PDU session establishment procedure and N1 NAS signalling connection release

The UE may immediately retransmit the PDU SESSION ESTABLISHMENT REQUEST message and stop, reset and restart timer T3580, if the following conditions apply:

1) The original UE-requested PDU session establishment procedure was initiated over an existing N1 NAS signalling connection;

2) the previous transmission of the PDU SESSION ESTABLISHMENT REQUEST message was not initiated due to timer T3580 expiry; and

3) no 5GSM message related to the PDU session (e.g. PDU SESSION AUTHENTICATION COMMAND message) was received after the PDU SESSION ESTABLISHMENT REQUEST message was transmitted.

i) Collision of UE-requested PDU session establishment procedure and network-requested PDU session modification procedure

If the UE receives a PDU SESSION MODIFICATION COMMAND message after sending a PDU SESSION ESTABLISHMENT REQUEST message to the network, and the PDU session ID in the PDU SESSION MODIFICATION COMMAND message is the same as the PDU session ID in the PDU SESSION ESTABLISHMENT REQUEST message:

i) if the UE-requested PDU session establishment procedure was to request the establishment of user plane resources on the second access for an MA PDU session established on a first access, the UE shall proceed with both the UE-requested PDU session establishment procedure and the network-requested PDU session modification procedure; or

ii) if the PDU SESSION ESTABLISHMENT REQUEST message was sent with request type set to "existing PDU session" or "existing emergency PDU session" in order to perform a handover of an existing PDU session between 3GPP access and non-3GPP access, the UE shall proceed with the UE-requested PDU session establishment procedure and abort the network-requested PDU session modification procedure.

6.4.1.7 Abnormal cases on the network side

The following abnormal cases can be identified:

a) If the received request type is "initial emergency request" and there is an existing emergency PDU session for the UE, regardless whether the PDU session ID in the PDU SESSION ESTABLISHMENT REQUEST message is identical to the PDU session ID of the existing PDU session, the SMF shall locally release the existing emergency PDU session and proceed the new PDU SESSION ESTABLISHMENT REQUEST message

b) The information for the PDU session authentication and authorization by the external DN in PDU DN request container is not compliant with local policy and user’s subscription data

If the PDU session being established is a non-emergency PDU session, the request type is not set to "existing PDU session", the PDU session authentication and authorization by the external DN is required due to local policy and user’s subscription data and the information for the PDU session authentication and authorization by the external DN in the SM PDU DN request container IE is not compliant with the local policy and user’s subscription data, the SMF shall reject the PDU session establishment request including the 5GSM cause #29 "user authentication or authorization failed", in the PDU SESSION ESTABLISHMENT REJECT message.

c) UE-requested PDU session establishment with request type set to "initial request" for an existing PDU session:

If the SMF receives a PDU SESSION ESTABLISHMENT REQUEST message with a PDU session ID identical to the PDU session ID of an existing PDU session and with request type set to "initial request", the SMF shall locally release the existing PDU session and proceed with the PDU session establishment procedure.

d) UE-requested PDU session establishment with request type "existing PDU session" or "existing emergency PDU session" for a PDU session that does not exist:

If the SMF receives a PDU SESSION ESTABLISHMENT REQUEST message with request type set to "existing PDU session" or "existing emergency PDU session", and the SMF does not have any information about that PDU session, then the SMF shall reject the PDU session establishment procedure with the 5GSM cause set to #54 "PDU session does not exist" in the PDU SESSION ESTABLISHMENT REJECT message.

e) 5G access network cannot forward the message:

If the SMF determines based on content of the n2SmInfo attribute specified in 3GPP TS 29.502 [20A] that the DL NAS TRANSPORT message carrying the PDU SESSION ESTABLISHMENT ACCEPT was not forwarded to the UE by the 5G access network, then the SMF shall reject the PDU session establishment procedure with the 5GSM cause set to #26 "insufficient resources" in the PDU SESSION ESTABLISHMENT REJECT message.