4.7 Default NAS message and information element contents

36.5083GPPCommon test environments for User Equipment (UE) conformance testingEvolved Universal Terrestrial Radio Access (E-UTRA) and Evolved Packet Core (EPC)Release 17TS

Tools: ARFCN - Frequency Conversion for 5G NR/LTE/UMTS/GSM

This clause contains the default values of common NAS messages and information elements, which apply to all test cases unless otherwise specified. All the messages and information elements are listed in alphabetical order.

4.7.1 Security protected NAS messages

In subclauses 4.7.2 and 4.7.3 in this document, all the NAS messages are described in the plain NAS message format.

When a NAS message is security protected, the message shall be contained by SECURITY PROTECTED NAS MESSAGE unless contained by another NAS message.

The default contents of SECURITY PROTECTED NAS MESSAGE message are defined in table 4.7.1-1.

Table 4.7.1-1: SECURITY PROTECTED NAS MESSAGE

Derivation Path: 24.301 clause 8.2.23
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0001’B	Integrity protected	UNCIPHERED
	‘0010’B	Integrity protected and ciphered	CIPHERED
	‘0011’B	Integrity protected with new EPS security context	UNCIPHERED-NEW
	‘0100’B	Integrity protected and ciphered with new EPS security context	CIPHERED-NEW
	‘0101’B	Integrity protected and partially ciphered NAS message	CIPHERED-PARTIALLY
Message authentication code	The calculated value of MAC-I for this message.	The value of MAC-I is calculated by SS using Sequence number sent by UE.	SENT-BY-SS
	The same value as the XMAC-I value calculated by SS.		SENT-BY-UE
Sequence number	The internal counter of the SS		SENT-BY-SS
	Any allowed value		SENT-BY-UE
NAS message	Set according to specific message content

Condition	Explanation
UNCIPHERED	This condition applies to unciphered NAS message exchange
CIPHERED	This condition applies to ciphered NAS message exchange
UNCIPHERED-NEW	This condition applies to unciphered NAS message exchange with new EPS security context
CIPHERED-NEW	This condition applies to ciphered NAS message exchange with new EPS security context
CIPHERED-PARTIALLY	This condition applies to partially ciphered NAS message exchange
SENT-BY-SS	Use for the message sent from SS to UE
SENT-BY-UE	Use for the message sent from UE to SS

When a valid NAS security context exists, unless specified otherwise in other clauses of the present specification or in a test case, for every DL NAS message sent within SECURITY PROTECTED NAS MESSAGE message, the condition CIPHERED applies.

4.7.2 Contents of EMM messages

– ATTACH ACCEPT

This message is sent by the SS to the UE.

Table 4.7.2-1: ATTACH ACCEPT

Derivation Path: 24.301 clause 8.2.1
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
Attach accept message identity	‘0100 0010’B	Attach accept
EPS attach result	‘0001’B	EPS only	EPS_only
	‘0010’B	combined EPS/IMSI attach	combined_EPS_IMSI
Spare half octet	‘0000’B
T3412 value
Timer value	‘0 0000’B
Unit	‘111’B	value indicates that the timer is deactivated.
TAI list
Length of tracking area identity list contents	‘0000 0110’B	6 octets
Partial tracking area identity list 1
Number of elements	‘0 0000’B	1 element
Type of list	’00’B	list of TACs belonging to one PLMN, with non-consecutive TAC values
MCC	See table 4.4.2-2 in this document	For NAS test cases, see table 6.3.2.2-1.
MNC	See table 4.4.2-2 in this document	For NAS test cases, see table 6.3.2.2-1.
TAC 1	See table 4.4.2-2 in this document	For NAS test cases, see table 6.3.2.2-1.
ESM message container	ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message to activate the default bearer
ESM message container	ESM DUMMY MESSAGE		CIoT_Attach_WithoutPDN
GUTI
Length of EPS mobile identity contents	‘0000 1011’B	11 octets
Type of identity	‘110’B	GUTI
Odd/even indication	‘0’B	even number of identity digits and also when the GUTI is used
MCC	See table 4.4.2-2 in this document	For NAS test cases, see table 6.3.2.2-1.
MNC	See table 4.4.2-2 in this document	For NAS test cases, see table 6.3.2.2-1.
MME Group ID	See table 4.4.2-2 in this document	For NAS test cases, see table 6.3.2.2-1.
MME Code	See table 4.4.2-2 in this document	For NAS test cases, see table 6.3.2.2-1.
M-TMSI	See table 4.4.2-2 in this document	For NAS test cases, see table 6.3.2.2-1.
Location area identification	Not present		EPS_only
Location area identification			combined_EPS_IMSI
MCC	MCC of the EUTRA cell from which this message is sent
MNC	MCC of the EUTRA cell from which this message is sent
LAC	1
MS identity	Not present		EPS_only
MS identity			combined_EPS_IMSI
Length of mobile identity contents	‘0000 0101’B	5 octets
Type of identity	‘100’B	TMSI/P-TMSI/M-TMSI
Odd/even indication	‘0’B	even number of identity digits and also when the TMSI/P-TMSI or TMGI and optional MBMS Session Identity is used
TMSI	TMSI-1
EMM cause	Not present
T3402 value	Not present
T3423 value	Not present
Equivalent PLMNs	Not present
Emergency number list	Not present
EPS network feature support	‘0000 0011’B	IMS voice over PS session in S1 mode supported, emergency bearer services in S1 mode supported
EPS network feature support	‘0000 0001’B	IMS voice over PS session in S1 mode supported	Rel-8
EPS network feature support	‘1000 0011 0000 1111’B	IMS voice over PS session in S1 mode, emergency bearer services in S1 mode, CP CIoT, ePCO, HC-CP CIoT, S1-U data and UP CIoT supported	CIoT
EPS network feature support	‘1100 0000 0000 1100’B	CIoT control plane optimization indicated, Attach Without PDN supported, ePCO supported, Header Compression for CIoT control plane supported	CIoT_CP AND pc_NB
EPS network feature support	‘1000 0000 0000 1011’B	CP CIoT supported, ePCO supported, S1-U data transfer supported, CIoT user plane optimization indicated	CIoT_UP AND pc_NB
EPS network feature support	‘1000 0000 0000 1010’B	CP CIoT supported, ePCO supported, S1-U data transfer only indicated	S1-U Only AND pc_NB
EPS network feature support	‘0010 0000 0000 0000’B	EXTENDED SERVICE REQUEST for packet services indicated	ESRPS
EPS network feature support	‘0000 0011 0000 1000’B	– IMS voice over PS session in S1 mode supported – emergency bearer services in S1 mode supported – ePCO supported – Interworking without N26 interface not supported	NR
Additional update result	Not present
Additional update result	‘0010’ B	“SMS only”	additional_update_result_SMS OR CIoT_SMSOnly
T3412 extended value	Not present		Rel-10
T3324 value	Not present
Extended DRX parameters	Not present
DCN-ID	Not present
SMS services status	Not present
Non-3GPP NW provided policies	Not present
T3448 value	Not present
Network policy	Not present
T3447 value	Not present
Extended emergency number list	Not present
Ciphering key data	Not present
UE radio capability ID	The same value as received in UE radio capability ID; if any of the SECURITY MODE COMPLETE message		RACS
UE radio capability ID deletion indication	Not present
Negotiated IMSI offset	Not present

Condition	Explanation
EPS_only	This condition applies if the UE is configured to initiate EPS attach or if explicitly specified.
combined_EPS_IMSI	This condition applies if the UE is configured to initiate combined EPS/IMSI attach or if explicitly specified. This condition does not apply for NB-S1.
additional_update_result_SMS	If the UE requested “SMS only” in the Additional update type IE and combined_EPS_IMSI condition applies
CIoT_Attach_WithoutPDN	If the UE wants to attach without PDN for CIoT optimization
CIoT_CP	If test case requires control plane CIoT optimization
CIoT_SMSOnly	If SMS Only is indicated in the ATTACH REQ received earlier
CIoT_UP	If test case requires user plane CIoT optimization
S1-U data Only	If S1-U data transfer Only is indicated
CIoT	If in the last ATTACH REQUEST, the UE network capability was included with the “CP CIoT” (octet 8, bit 3) or the “UP CIoT” and “S1-U data” (octet 8, bit 4 and bit 5). Note 1: This condition is only applicable for E-UTRA UEs (TS 36.523-2 A.4.1-1/1 or A.4.1-1/2).
ESRPS	If the test case requires the network to indicate support of EXTENDED SERVICE REQUEST for packet services (ESRPS)
NR	Used in NR test cases (TS 38.523-1 [71])
RACS	Used in RACS test cases (TS 36.523-1 [18]) If pc_EPC_RACS

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– ATTACH COMPLETE

This message is sent by the UE to the SS.

Table 4.7.2-2: ATTACH COMPLETE

Derivation Path: 24.301 clause 8.2.2
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
Attach complete message identity	‘0100 0011’B	Attach complete
ESM message container	ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT message
ESM message container	ESM DUMMY MESSAGE		CIoT_Attach_WithoutPDN

Condition		Explanation
CIoT_Attach_WithoutPDN	If the UE wants to attach without PDN for CIoT optimization

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– ATTACH REJECT

This message is sent by the SS to the UE.

Table 4.7.2-3: ATTACH REJECT

Derivation Path: 24.301 clause 8.2.3
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
Attach reject message identity	‘0100 0100’B	Attach reject
EMM cause	Set according to specific message content.
ESM message container	Set according to specific message content.

NOTE: If this message includes the EMM cause set to #3, #6, #7, #8, #11, #12, #13, #14, #15, #25 or #35, it is sent within SECURITY PROTECTED NAS MESSAGE message. Otherwise this message is sent without integrity protection.

– ATTACH REQUEST

This message is sent by the UE to the SS.

Table 4.7.2-4: ATTACH REQUEST

Derivation Path: 24.301 clause 8.2.4
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
Attach request message identity	‘0100 0001’B	Attach request
EPS attach type	‘0001’B	EPS attach	EPS_only
	‘0010’B	combined EPS/IMSI attach	combined_EPS_IMSI
NAS key set identifier	Any allowed value
EPS mobile identity	Any allowed value
UE network capability	Any allowed value
UE network capability			EN-DC
All octets with the exception of octet 9, bit 5	Any allowed value
Dual connectivity with NR (DCNR) (octet 9, bit 5)	1	dual connectivity with NR supported
UE network capability			NR
All octets with the exception of octet 8, bit 8 and octet 9, bit 6	Any allowed value
Extended protocol configuration options (ePCO) (octet 8, bit 8)	‘1’	Extended protocol configuration options IE supported
N1 mode supported (N1mode) (octet 9, bit 6)	1	N1 mode supported
UE network capability			pc_EPC_RACS
All octets with the exception of octet 10, bit 1	Any allowed value
Radio capability signalling optimisation (RACS) capability (octet 10, bit 1)	1
ESM message container	PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN
ESM message container	ESM DUMMY MESSAGE		CIoT_Attach_WithoutPDN
Old P-TMSI signature	Not present or any allowed value
Additional GUTI	Not present or any allowed value
Last visited registered TAI	Not present or any allowed value
DRX parameter	Not present or any allowed value
MS network capability	Not present or any allowed value
Old location area identification	Not present or any allowed value
TMSI status	Not present or any allowed value
Mobile station classmark 2	Not present or any allowed value
Mobile station classmark 3	Not present or any allowed value
Supported Codecs	Not present or any allowed value
Additional update type	Not present		EPS_only
Additional update type	Any allowed value		EPS_only_with_SMS
Additional update type	Not present or any allowed value		combined_EPS_IMSI or CIoT
Voice domain preference and UE’s usage setting	Not present or any allowed value
Device properties	Not present or any allowed value
Old GUTI type	Not present or any allowed value
MS network feature support	Not present or any allowed value
TMSI based NRI container	Not present or any allowed value
T3324 value	Not present or any allowed value
T3412 extended value	Not present or any allowed value
Extended DRX parameters	Not present or any allowed value
UE additional security capability	Any allowed value (NOTE 1, NOTE 2)		EN-DC OR NR
UE status	Not present or any allowed value
Additional information requested	Not present or any allowed value
UE radio capability ID availability	Not present or any allowed value		pc_EPC_RACS
Requested IMSI offset	Not present or any allowed value
NOTE 1: For a UE supporting dual connectivity with NR, if the UE supports one of the encryption algorithms for 5GS in bits 8 to 5 of octet 3, it shall support the same algorithms for E-UTRAN as specified in 3GPP TS 33.401 [41]. NOTE 2: For a UE supporting dual connectivity with NR, if the UE supports one of the integrity protection algorithms for 5GS in bits 8 to 5 of octet 5, it shall support the same algorithms for E-UTRAN as specified in 3GPP TS 33.401 [41].

Condition	Explanation
EPS_only	See the definition below table 4.7.2-1.
combined_EPS_IMSI	See the definition below table 4.7.2-1.
CIoT_Attach_WithoutPDN	If the UE wants to attach without PDN for CIoT optimization
EPS_only_with_SMS	If the UE wants to perform EPS attach with SMS only for CIoT optimization
CIoT	If UE supports CIoT Optimisation
EN-DC	Used in E-UTRA-NR dual connectivity test cases (TS 38.523-1 [71])
NR	Used in NR test cases (TS 38.523-1 [71])

NOTE: This message is sent integrity protected when a valid security context exists and without integrity protection otherwise.

– AUTHENTICATION FAILURE

This message is sent by the UE to the SS.

Table 4.7.2-5: AUTHENTICATION FAILURE

Derivation Path: 24.301 clause 8.2.5
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
Authentication failure message type	‘0101 1100’B	Authentication failure
EMM cause	‘0001 0100’B	Mac failure
Authentication failure parameter	Not present	See TS 24.301 [28] subclause 8.2.5.2

NOTE: The security protection of this message is the same as the previous AUTHENTICATION REQUEST message.

– AUTHENTICATION REJECT

This message is sent by the SS to the UE.

Table 4.7.2-6: AUTHENTICATION REJECT

Derivation Path: 24.301 clause 8.2.6
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
Authentication reject message type	‘0101 0100’B	Authentication reject

NOTE: This message is sent without integrity protection.

– AUTHENTICATION REQUEST

This message is sent by the SS to the UE.

Table 4.7.2-7: AUTHENTICATION REQUEST

Derivation Path: 24.301 clause 8.2.7
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
Authentication request message type	‘0101 0010’B	Authentication request
NAS key set identifier_ASME
NAS key set identifier	An arbitrarily selected value between ‘000’B and ‘110’B, different from the valid NAS key set identifier of the UE if such a value exists.
TSC	‘0’B	native security context (for KSI_ASME)
Spare half octet	‘0000’B
Authentication parameter RAND (EPS challenge)	An arbitrarily selected 128 bits value
Authentication parameter AUTN (EPS challenge)	See TS 24.301 [28] subclause 9.9.3.2

NOTE: Within a test execution this message is sent without integrity protection before NAS security mode control procedure has been successfully completed; and sent integrity protected and ciphered within SECURITY PROTECTED NAS MESSAGE message after NAS security mode control procedure has been successfully completed. SS does not maintain information for NAS security mode control procedure after a TC is completed.

– AUTHENTICATION RESPONSE

This message is sent by the UE to the SS.

Table 4.7.2-8: AUTHENTICATION RESPONSE

Derivation Path: 24.301 clause 8.2.8
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
Authentication response message type	‘0101 0011’B	Authentication response
Authentication response parameter	See TS 24.301 [28] subclause 9.9.3.4

NOTE: When sent in response to an AUTHENTICATION REQUEST message which is not integrity protected and not ciphered, the AUTHENTICATION RESPONSE message may be sent integrity protected when a valid security context exists and without integrity protection otherwise.

– CS SERVICE NOTIFICATION

This message is sent by the SS to the UE.

Table 4.7.2-8A: CS SERVICE NOTIFICATION

Derivation Path: 24.301 clause 8.2.9
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
CS service notification message identity	‘01100100’B	CS Service notification
Paging identity	‘1’B	TMSI
CLI	Not present
SS Code	Not present
LCS indicator	Not present
LCS client identity	Not present

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– CONTROL PLANE SERVICE REQUEST

This message is sent by the UE to the SS.

Table 4.7.2-28: CONTROL PLANE SERVICE REQUEST

Derivation Path: 24.301 clause 8.2.33
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
Control plane service request message identity	‘0100 1101’B	Control plane service request
Data service type
Data service type value	Any allowed value
"Active" flag	‘0’B	No radio bearer establishment requested
NAS key set identifier
NAS key set identifier	The valid NAS key set identifier of the UE
TSC	‘0’B	native security context (for KSI_ASME)
ESM message container	Not present or PDN CONNECTIVITY REQUEST message to request PDN connectivity to the default PDN
NAS message container	Not present or set according to specific message content
EPS bearer context status	Not present or (octet 3 = ‘00100000’B and octet 4 = ‘00000000’B)
Device properties	Not present or Any allowed value

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message as an integrity protected message. If the ESM Message Container or NAS message container is present, this element is ciphered – so the whole message is then integrity protected and partially ciphered.

– DETACH ACCEPT (UE originating detach)

This message is sent by the SS to the UE.

Table 4.7.2-9: DETACH ACCEPT

Derivation Path: 24.301 clause 8.2.10.1
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
Detach accept message identity	‘0100 0110’B	Detach accept

NOTE: This message is sent using the same security protection as in the previous DETACH REQUEST message received from the UE.

– DETACH ACCEPT (UE terminated detach)

This message is sent by the UE to the SS.

Table 4.7.2-10: DETACH ACCEPT

Derivation Path: 24.301 clause 8.2.10.2
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
Detach accept message identity	‘0100 0110’B	Detach accept

NOTE: This message is sent without integrity protection before NAS security mode control procedure has been successfully completed and sent within SECURITY PROTECTED NAS MESSAGE message after NAS security mode control procedure has been successfully completed.

– DETACH REQUEST (UE originating detach)

This message is sent by the UE to the SS.

Table 4.7.2-11: DETACH REQUEST

Derivation Path: 24.301 clause 8.2.11.1
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
Detach request message identity	‘0100 0101’B	Detach request
Detach type
Type of detach	‘001’B	EPS detach	EPS_only
	‘011’B	combined EPS/IMSI detach	Combined_EPS_IMSI
Switch off	‘1’B	switch off
NAS key set identifier
NAS key set identifier	The valid NAS key set identifier.
TSC	Any Value
GUTI or IMSI	If the UE has a valid GUTI, set to the GUTI, otherwise set to the IMSI of the UE.

Condition	Explanation
EPS_only	See the definition below table 4.7.2-1.
Combined_EPS_IMSI	See the definition below table 4.7.2-1.

NOTE: This message is sent with integrity protection before SS has started the ciphering and integrity and ciphered protected after SS has started the ciphering.

– DETACH REQUEST (UE terminated detach)

This message is sent by the SS to the UE.

Table 4.7.2-12: DETACH REQUEST

Derivation Path: 24.301 clause 8.2.11.2
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
Detach request message identity	‘0100 0101’B	Detach request
Detach type	Set according to specific message content.
Spare half octet	‘0000’B
EMM cause	Set according to specific message content.

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– DOWNLINK NAS TRANSPORT

This message is sent by the SS to the UE.

Table 4.7.2-12A: DOWNLINK NAS TRANSPORT

Derivation Path: 24.301 clause 8.2.12
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
Downlink NAS transport message identity	‘0110 0010’B	Downlink NAS transport
NAS message container	Set according to specific message content

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– EMM INFORMATION

This message is sent by the SS to the UE.

Table 4.7.2-13: EMM INFORMATION

Derivation Path: 24.301 clause 8.2.13
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
EMM information message identity	‘0110 0001’B	EMM information
Full name for network	Set according to specific message content.
Short name for network	Set according to specific message content.
Local time zone	Set according to specific message content.
Universal time and local time zone	Set according to specific message content.
Network daylight saving time	Set according to specific message content.

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– EMM STATUS

This message is sent by the UE or by the SS.

Table 4.7.2-14: EMM STATUS

Derivation Path: 24.301 clause 8.2.14
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
EMM status message identity	‘0110 0000’B	EMM status
EMM cause	Set according to specific message content.

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– EXTENDED SERVICE REQUEST

This message is sent by the UE to the SS.

Table 4.7.2-14A: EXTENDED SERVICE REQUEST

Derivation Path: 24.301 clause 8.2.15
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
Extended service request message identity	‘0100 1100’B	Extended service request
Service type	‘0001’B	mobile terminating CS fallback or 1xCS fallback
NAS key set identifier
NAS key set identifier	The valid NAS key set identifier.
TSC	‘0’B	native security context (for KSI_ASME)
M-TMSI	If the UE has a valid M-TMSI, set to the M-TMSI, otherwise set to the IMSI of the UE.
CSFB response	’001’B	CS fallback accepted by the UE
UE request type	Not present or any allowed value
Paging restriction	Not present

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– GUTI REALLOCATION COMMAND

This message is sent by the SS to the UE.

Table 4.7.2-15: GUTI REALLOCATION COMMAND

Derivation Path: 24.301 clause 8.2.16
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
GUTI reallocation command message identity	‘0101 0000’B	GUTI reallocation command
GUTI	Set according to specific message content.
TAI list	Set according to specific message content.

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– GUTI REALLOCATION COMPLETE

This message is sent by the UE to the SS.

Table 4.7.2-16: GUTI REALLOCATION COMPLETE

Derivation Path: 24.301 clause 8.2.17
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
GUTI reallocation complete message identity	‘0101 0001’B	GUTI reallocation complete

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– IDENTITY REQUEST

This message is sent by the SS to the UE.

Table 4.7.2-17: IDENTITY REQUEST

Derivation Path: 24.301 clause 8.2.18
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
Identity request message identity	‘0101 0101’B	Identity request
Identity type	‘0001’B	IMSI
Spare half octet	‘0000’B

– IDENTITY RESPONSE

This message is sent by the UE to the SS.

Table 4.7.2-18: IDENTITY RESPONSE

Derivation Path: 24.301 clause 8.2.19
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
Identity response message	‘0101 0110’B	Identity response
Mobile identity	IMSI of the UE

– SECURITY MODE COMMAND

This message is sent by the SS to the UE.

Table 4.7.2-19: SECURITY MODE COMMAND

Derivation Path: 24.301 clause 8.2.20
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
Security mode command message identity	‘0101 1101’B	Security mode command
Selected NAS security algorithms
Type of integrity protection algorithm	Set according to PIXIT parameter for default integrity protection algorithm		For SIG
	0(reserved or eia0)	This IE is set to one of the algorithms supported by the UE as indicated in the IE "UE network capability" in the ATTACH REQUEST message.	For RF
	eia1
	eia2
Type of ciphering algorithm	Set according to PIXIT parameter for default ciphering algorithm		For SIG
	eea0		For RF
NAS key set identifier
NAS key set identifier	The valid NAS key set identifier.
TSC	‘0’B	native security context (for KSI_ASME)
Spare half octet	‘0000’B
Replayed UE security capabilities	Set according to the received UE security capabilities
IMEISV request	Not present
Replayed nonce_UE	Not present
Nonce_MME	Not present
Hash_MME	Not present
Replayed UE additional security capability	Set to the value received in the Attach/TAU Request		EN-DC_duringRegistration
UE radio capability ID request	1	UE radio capability ID requested	RACS and UE radio capability ID availability is set in Attach/TAU Request

Condition	Explanation
For SIG	Used for signalling test cases
For RF	Used for RF/RRM test cases
EN-DC_duringRegistration	If the UE supports E-UTRA-NR dual connectivity NR ([71] pc_EN_DC) and this message is sent during an Attach or TAU procedure
RACS	Used in RACS test cases (TS 36.523-1 [18]) If pc_EPC_RACS

NOTE: This message is always sent integrity protected with new EPS security context.

– SECURITY MODE COMPLETE

This message is sent by the UE to the SS.

Table 4.7.2-20: SECURITY MODE COMPLETE

Derivation Path: 24.301 clause 8.2.21
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
Security mode complete message identity	‘0101 1110’B	Security mode complete
IMEISV	Not present
UE radio capability ID	Any allowed value		pc_EPC_RACS

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message with new EPS security context.

– SECURITY MODE REJECT

This message is sent by the UE to the SS.

Table 4.7.2-21: SECURITY MODE REJECT

Derivation Path: 24.301 clause 8.2.22
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
Security mode reject message identity	‘0101 1111’B	Security mode reject
EMM cause	The value is set according to specific message content.

– SERVICE ACCEPT

This message is sent by the SS to the UE.

Table 4.7.2-21A: SERVICE ACCEPT

Derivation Path: 24.301 clause 8.2.34
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
Service accept message identity	‘0100 1111’B	Service accept
EPS bearer context status	The same value as the value set in CONTROL PLANE SERVICE REQUEST
EPS additional request result	Not present

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– SERVICE REJECT

This message is sent by the SS to the UE.

Table 4.7.2-22: SERVICE REJECT

Derivation Path: 24.301 clause 8.2.24
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
Service reject message identity	‘0100 1110’B	Service reject
EMM cause	Set according to specific message content.
T3442 value	Not present

– SERVICE REQUEST

This message is sent by the UE to the SS.

Table 4.7.2-23: SERVICE REQUEST

Derivation Path: 24.301 clause 8.2.25
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘1100’B	Security header for the SERVICE REQUEST message
KSI and sequence number
Sequence number (short)	The 5 least significant bits of the NAS COUNT value applicable when this message is sent for sequence number.
KSI	The effective KSI value.
Message authentication code (short)	The 2 least significant octets of the resulting message authentication code

– TRACKING AREA UPDATE ACCEPT

This message is sent by the SS to the UE.

Table 4.7.2-24: TRACKING AREA UPDATE ACCEPT

Derivation Path: 24.301 clause 8.2.26
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
Tracking area update accept message identity	‘0100 1001’B	Tracking area update accept
EPS update result	‘0000’B	TA updated	TA_only
	‘0001’B	combined TA/LA updated	combined_TA_LA
Spare half octet	‘0000’B
T3412 value	Not present		Periodic
T3412 value
Timer value	‘0 0000’B
Unit	‘111’B	value indicates that the timer is deactivated.
GUTI
Length of EPS mobile identity contents	‘0000 1011’B	11 octets
Type of identity	‘110’B	GUTI
Odd/even indication	‘0’B	even number of identity digits and also when the GUTI is used
MCC	See table 4.4.2-2 in this document	For NAS test cases, see table 6.3.2.2-1.
MNC	See table 4.4.2-2 in this document	For NAS test cases, see table 6.3.2.2-1.
MME Group ID	See table 4.4.2-2 in this document	For NAS test cases, see table 6.3.2.2-1.
MME Code	See table 4.4.2-2 in this document	For NAS test cases, see table 6.3.2.2-1.
M-TMSI	See table 4.4.2-2 in this document	For NAS test cases, see table 6.3.2.2-1.
TAI list
Length of tracking area identity list contents	‘0000 0110’B	6 octets
Partial tracking area identity list 1
Number of elements	‘0 0000’B	1 element
Type of list	’00’B	list of TACs belonging to one PLMN, with non-consecutive TAC values
MCC	See table 4.4.2-2 in this document	For NAS test cases, see table 6.3.2.2-1.
MNC	See table 4.4.2-2 in this document	For NAS test cases, see table 6.3.2.2-1.
TAC 1	See table 4.4.2-2 in this document	For NAS test cases, see table 6.3.2.2-1.
EPS bearer context status	The same value as the value set in TRACKING AREA UPDATE REQUEST message
Location area identification	Not present		TA_only
Location area identification			combined_TA_LA
MCC	MCC of the EUTRA cell from which this message is sent
MNC	MCC of the EUTRA cell from which this message is sent
LAC	1
MS identity	Not present		TA_only
MS identity			combined_TA_LA
Length of mobile identity contents	‘0000 0101’B	5 octets
Type of identity	‘100’B	TMSI/P-TMSI/M-TMSI
Odd/even indication	‘0’B	even number of identity digits and also when the TMSI/P-TMSI or TMGI and optional MBMS Session Identity is used
TMSI	TMSI-1
EMM cause	Not present
T3402 value	Not present
T3423 value	Not present
Equivalent PLMNs	Not present
Emergency number list	Not present
EPS network feature support	0000 0001’B	IMS voice over PS session in S1 mode supported
EPS network feature support	‘1100 0000 0000 1100’B	CIoT control plane optimization indicated, Attach Without PDN supported, ePCO supported, Header Compression for CIoT control plane supported	(CIoT_CP OR CIoT_CP_SMSOnly) AND pc_NB
EPS network feature support	‘1000 0000 0000 1011’B	CP CIoT supported, ePCO supported, S1-U data transfer supported, CIoT user plane optimization indicated	CIoT_UP AND pc_NB
EPS network feature support	‘1000 0000 0000 1010’B	CP CIoT supported, ePCO supported, S1-U data transfer Only indicated	S1-U Only AND pc_NB
EPS network feature support	‘0000 0011 0000 1000’B	– IMS voice over PS session in S1 mode supported – emergency bearer services in S1 mode supported – ePCO supported – Interworking without N26 interface not supported	NR
Additional update result	Not present
Additional update result	‘0010’ B	“SMS only”	TAU_additional_update_result_SMS OR CIoT_CP_SMSOnly
T3412 extended value	Not present		Rel-10
T3324 value	Not present
Extended DRX parameters	Not present
Header compression configuration status	Not present or set according to specific message content
DCN-ID	Not present
SMS services status	Not present
Non-3GPP NW provided policies	Not present
T3448 value	Not present
Network policy	Not present
T3447 value	Not present
Extended emergency number list	Not present
Ciphering key data	Not present
UE radio capability ID	The same value as received in UE radio capability ID; if any of the SECURITY MODE COMPLETE message		RACS
UE radio capability ID deletion indication	Not present
Negotiated IMSI offset IE	Not present
EPS additional request result	Not present

Condition	Explanation
TA_only	This condition applies if the UE is configured to initiate EPS attach or if explicitly specified.
combined_TA_LA	This condition applies if the UE is configured to initiate combined EPS/IMSI attach or if explicitly specified. This condition does not apply for NB-S1.
Periodic	This condition applies if in the last TRACKING AREA UPDATE REQUEST sent prior to this message, the EPS update type Value = ‘011’B (periodic updating).
TAU_additional_update_result_SMS	If the UE requested "SMS only" in the Additional update type IE and combined_TA_LA.
CIoT_CP	If test case requires control plane CIoT optimization
CIoT_CP_SMSOnly	If test case requires control plane CIoT optimization and SMS Only is indicated
CIoT_UP	If test case requires user plane CIoT optimization
S1-U data Only	If S1-U data transfer Only is indicated
NR	Used in NR test cases (TS 38.523-1 [71])
RACS	Used in RACS test cases (TS 36.523-1 [18]) If pc_EPC_RACS

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– TRACKING AREA UPDATE COMPLETE

This message is sent by the UE to the SS.

Table 4.7.2-25: TRACKING AREA UPDATE COMPLETE

Derivation Path: 24.301 clause 8.2.27
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
Tracking area update complete message identity	‘0100 1010’B	Tracking area update complete

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– TRACKING AREA UPDATE REJECT

This message is sent by the SS to the UE.

Table 4.7.2-26: TRACKING AREA UPDATE REJECT

Derivation Path: 24.301 clause 8.2.28
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
Tracking area update reject message identity	‘0100 1011’B	Tracking area update reject
EMM cause	Set according to specific message content.

– TRACKING AREA UPDATE REQUEST

This message is sent by the UE to the SS.

Table 4.7.2-27: TRACKING AREA UPDATE REQUEST

Derivation Path: 24.301 clause 8.2.29
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
Tracking area update request message identity	‘0100 1000’B	Tracking area update request
EPS update type
EPS update type Value	‘000’B	TA updating	TA_only
	‘001’B	Combined TA/LA updating	combined_TA_LA
"Active" flag	‘0’B	No bearer establishment requested
NAS key set identifier
NAS key set identifier	The valid NAS key set identifier of the UE
TSC	‘0’B	native security context (for KSI_ASME)
Old GUTI	Any allowed value
Non-current native NAS key set identifier	Not present
GPRS ciphering key sequence number	Not present
Old P-TMSI signature	Not present
Additional GUTI	Not present
Nonce_UE	Not present
UE network capability	Not present or any allowed value
UE network capability			EN-DC
All octets with the exception of octet 9, bit 5	Any allowed value
Dual connectivity with NR (DCNR) (octet 9, bit 5)	1	dual connectivity with NR supported
UE network capability			NR
All octets with the exception of octet 8, bit 8 and octet 9, bit 6	Any allowed value
Extended protocol configuration options (ePCO) (octet 8, bit 8)	1	ePCO supported
N1 mode supported (N1mode) (octet 9, bit 6)	1	N1 mode supported
UE network capability			pc_EPC_RACS
All octets with the exception of octet 10, bit 1	Any allowed value
Radio capability signalling optimisation (RACS) capability (octet 10, bit 1)	1
Last visited registered TAI	Not present or any allowed value
DRX parameter	Not present or any allowed value
UE radio capability information update needed	Not present or any allowed value
EPS bearer context status	Not present or (octet 3 = ‘00100000’B and octet 4 = ‘00000000’B)
MS network capability	Not present or any allowed value
Old location area identification	Not present or any allowed value
TMSI status	Not present or any allowed value
Mobile station classmark 2	Not present or any allowed value
Mobile station classmark 3	Not present or any allowed value
Supported Codecs	Not present or any allowed value
Additional update type	Not present		TA_only
Additional update type	Not present or any allowed value		combined_TA_LA
Additional update type	Any allowed value		TA_only_with_SMS
Additional update type	Not present or any allowed value		CIoT
Voice domain preference and UE’s usage setting	Not present or any allowed value
Old GUTI type	Not present or any allowed value
Device properties	Not present or any allowed value
MS network feature support	Not present or any allowed value
TMSI based NRI container	Not present or any allowed value
T3324 value	Not present or any allowed value
T3412 extended value	Not present or any allowed value
Extended DRX parameters	Not present or any allowed value
UE additional security capability	Any allowed value (NOTE 1, NOTE 2)		EN-DC OR NR
UE status	Not present or any allowed value
Additional information requested	Not present or any allowed value
UE radio capability ID availability	Not present or any allowed value		pc_EPC_RACS
Requested IMSI offset	Not present or any allowed value
UE request type	Not present or any allowed value
Paging restriction	Not present or any allowed value
NOTE 1: For a UE supporting dual connectivity with NR, if the UE supports one of the encryption algorithms for 5GS in bits 8 to 5 of octet 3, it shall support the same algorithms for E-UTRAN as specified in 3GPP TS 33.401 [41]. NOTE 2: For a UE supporting dual connectivity with NR, if the UE supports one of the integrity protection algorithms for 5GS in bits 8 to 5 of octet 5, it shall support the same algorithms for E-UTRAN as specified in 3GPP TS 33.401 [41].

Condition	Explanation
TA_only	See the definition below table 4.7.2-24.
combined_TA_LA	See the definition below table 4.7.2-24.
EPS_only_with_SMS	If the UE wants to update for EPS attach with SMS only for CIoT optimization
CIoT	If UE supports CIoT Optimisation
EN-DC	Used in E-UTRA-NR dual connectivity test cases (TS 38.523-1 [71])
NR	Used in NR test cases (TS 38.523-1 [71])

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– UPLINK NAS TRANSPORT

This message is sent by the UE to the SS.

Table 4.7.2-27A: UPLINK NAS TRANSPORT

Derivation Path: 24.301 clause 8.2.30
Information Element	Value/remark	Comment	Condition
Protocol discriminator	EMM
Security header type	‘0000’B	Plain NAS message, not security protected
Uplink NAS transport message identity	‘0100 0011’B	Uplink NAS transport
NAS message container	Set according to specific message content

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

4.7.3 Contents of ESM messages

– ACTIVATE DEDICATED EPS BEARER CONTEXT ACCEPT

This message is sent by the UE to the SS.

Table 4.7.3-1: ACTIVATE DEDICATED EPS BEARER CONTEXT ACCEPT

Derivation Path: 24.301 clause 8.3.1
Information Element	Value/remark	Comment	Condition
Protocol discriminator	ESM
EPS bearer identity	The same value as the value set in ACTIVATE DEDICATED EPS BEARER CONTEXT REQUEST message
Procedure transaction identity	‘0000 0000’B	No procedure transaction identity assigned
Activate dedicated EPS bearer context accept message identity	‘1100 0110’B	Activate dedicated EPS bearer context accept
Protocol configuration options	Not present or any allowed value		NOT (pc_NB or pc_NonIP_PDN)
Protocol configuration options	Not present		pc_NB or pc_NonIP_PDN
NBIFOM container	Not present or any allowed value
Extended protocol configuration options	Not present or any allowed value

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– ACTIVATE DEDICATED EPS BEARER CONTEXT REJECT

This message is sent by UE to the SS.

Table 4.7.3-2: ACTIVATE DEDICATED EPS BEARER CONTEXT REJECT

Derivation Path: 24.301 clause 8.3.2
Information Element	Value/remark	Comment	Condition
Protocol discriminator	ESM
EPS bearer identity	The same value as the value set in ACTIVATE DEDICATED EPS BEARER CONTEXT REQUEST message.
Procedure transaction identity	‘0000 0000’B	No procedure transaction identity assigned
Activate dedicated EPS bearer context reject message identity	‘1100 0111’B	Activate dedicated EPS bearer context reject
ESM cause	The value is set according to specific message content.
Protocol configuration options	Not present
NBIFOM container	Not present or any allowed value
Extended protocol configuration options	Not present or any allowed value

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– ACTIVATE DEDICATED EPS BEARER CONTEXT REQUEST

This message is sent by the SS to the UE.

Table 4.7.3-3: ACTIVATE DEDICATED EPS BEARER CONTEXT REQUEST

Derivation Path: 24.301 clause 8.3.3
Information Element	Value/remark	Comment	Condition
Protocol discriminator	ESM
EPS bearer identity	Arbitrarily selected value between ‘0101’B and ‘1111’B.
Procedure transaction identity	‘0000 0000’B	No procedure transaction identity assigned	NETWORK-INITIATED
	The same value as the value set in BEARER RESOURCE MODIFICATION REQUEST message or BEARER RESOURCE ALLOCATION REQUEST message		UE-INITIATED
Activate dedicated EPS bearer context request message identity	‘1100 0101’B	Activate dedicated EPS bearer context request
Linked EPS bearer identity	The EPS bearer identity of the associated default bearer
Spare half octet	‘0000’B
EPS QoS	See Reference dedicated EPS bearer context #1 in table 6.6.2-1
TFT	See Reference dedicated EPS bearer context #1 in table 6.6.2-1
Transaction identifier	Not present
	Distinct value between 0 and 127 calculated on basis of the EPS bearer identity.		pc_UTRAN AND/OR pc_GERAN
Negotiated QoS	See Reference dedicated EPS bearer context #1 in table 6.6.2-1
Negotiated LLC SAPI	See Reference dedicated EPS bearer context #1 in table 6.6.2-1
Radio priority	See Reference dedicated EPS bearer context #1 in table 6.6.2-1
Packet flow Identifier	Not present
	‘0000 0000’B	Best Effort	pc_GERAN
Protocol configuration options	See Reference dedicated EPS bearer context #1 in table 6.6.2-1		NOT (pc_NB or pc_NonIP_PDN)
Protocol configuration options	Not present		pc_NB or pc_NonIP_PDN
WLAN offload container	Not present
NBIFOM container	Not present
Extended protocol configuration options	Not present		NOT (pc_NB or pc_NonIP_PDN)
Extended protocol configuration options	See Reference dedicated EPS bearer context #1 in table 6.6.2-1		pc_NB or pc_NonIP_PDN

Condition	Explanation
NETWORK-INITIATED	Network initiated ESM procedures
UE-INITIATED	UE initiated ESM procedures

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT

This message is sent by the UE to the SS.

Table 4.7.3-4: ACTIVATE DEFAULT EPS BEARER CONTEXT ACCEPT

Derivation Path: 24.301 clause 8.3.4
Information Element	Value/remark	Comment	Condition
Protocol discriminator	ESM
EPS bearer identity	The same value as the value set in ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message
Procedure transaction identity	‘0000 0000’B	No procedure transaction identity assigned
Activate default EPS bearer context accept message identity	‘1100 0010’B	Activate default EPS bearer context accept
Protocol configuration options	Not present or any allowed value		NOT (pc_NB or pc_NonIP_PDN)
Protocol configuration options	Not present		pc_NB or pc_NonIP_PDN
Extended protocol configuration options	Not present or any allowed value

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– ACTIVATE DEFAULT EPS BEARER CONTEXT REJECT

This message is sent by UE to the SS.

Table 4.7.3-5: ACTIVATE DEFAULT EPS BEARER CONTEXT REJECT

Derivation Path: 24.301 clause 8.3.5
Information Element	Value/remark	Comment	Condition
Protocol discriminator	ESM
EPS bearer identity	The same value as the value set in ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message.
Procedure transaction identity	‘0000 0000’B	No procedure transaction identity assigned
Activate default EPS bearer context reject message identity	‘1100 0011’B	Activate default EPS bearer context reject
ESM cause	The value is set according to specific message content.
Protocol configuration options	Not present
Extended protocol configuration options	Not present

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST

This message is sent by the SS to the UE.

Table 4.7.3-6: ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST

Derivation Path: 24.301 clause 8.3.6
Information Element	Value/remark	Comment	Condition
Protocol discriminator	ESM
EPS bearer identity	An arbitrarily selected value between ‘0101’B and ‘1111’B.
Procedure transaction identity	The same value as the value set in the latest PDN CONNECTIVITY REQUEST message sent prior to this message.
Activate default EPS bearer context request message identity	‘1100 0001’B	Activate default EPS bearer context request
EPS QoS	See Reference default EPS bearer context #1 in table 6.6.1-1		NOT IMS_PDN_ConnEstab
EPS QoS	See Reference default EPS bearer context #2 in table 6.6.1-1		IMS_PDN_ConnEstab
Access point name	The SS defines a Default APN		NOT IMS_PDN_ConnEstab AND NOT APN_Provided
Access point name	APN as provided in ESM INFORMATION RESPONSE or PDN CONNECTIVITY REQUEST		NOT IMS_PDN_ConnEstab AND APN_Provided
Access point name	IMS. mnc<MNC>.mcc<MCC>.gprs The <MNC> and <MCC> are set to the same values as in IMSI.		IMS_PDN_ConnEstab AND NOT APN_Provided
Access point name	Use APN Network Identifier provided in ESM INFORMATION RESPONSE or PDN CONNECTIVITY REQUEST message and the APN Operator Identifier mnc<MNC>.mcc<MCC>.gprs. The <MNC> and <MCC> are set to the same values as in IMSI.		IMS_PDN_ConnEstab AND APN_Provided
PDN address			IPv4
Length of PDN address contents	5 octets
PDN type value	‘001’B	IPv4
PDN address information	IPv4 address	The SS provides a valid IPv4 address	NOT IPv4-DHCP
	0.0.0.0	DHCPv4 is to be used to allocate the IPv4 address	IPv4-DHCP
PDN address			IPv6
Length of PDN address contents	9 octets
PDN type value	‘010’B	IPv6
PDN address information	IPv6 interface identifier	The SS provides a valid IPv6 interface identifier
PDN address			IPv4v6
Length of PDN address contents	13 octets
PDN type value	‘011’B	IPv4v6
PDN address information (Octets 4 to 11)	IPv6 interface identifier	The SS provides a valid IPv6 interface identifier
PDN address information (Octets 12 to 15)	IPv4 address	The SS provides a valid IPv4 address	NOT IPv4-DHCP
	0.0.0.0	DHCPv4 is to be used to allocate the IPv4 address	IPv4-DHCP
PDN address			CIoT_CP_NON_IP
Length of PDN address contents	2 octets
PDN type value	‘101’B	Non-IP PDN
PDN address information (Octets 4 to 7)	Coded as 0	spare
Transaction identifier	Not present
Transaction identifier	Distinct value between 0 and 127 calculated on basis of the EPS bearer identity.		pc_UTRAN AND/OR pc_GERAN
Negotiated QoS	See Reference default EPS bearer context #1 in table 6.6.1-1
Negotiated LLC SAPI	See Reference default EPS bearer context #1 in table 6.6.1-1
Radio priority	See Reference default EPS bearer context #1 in table 6.6.1-1
Packet flow Identifier	Not present
Packet flow Identifier	‘0000 0000’B	Best Effort	pc_GERAN
APN-AMBR	See Reference default EPS bearer context #1 in table 6.6.1-1
ESM cause	Not present
Protocol configuration options	Not present		pc_NB or pc_NonIP_PDN
Protocol configuration options			NOT (pc_NB or pc_NonIP_PDN)
Configuration protocol	See Reference default EPS bearer context #1 in table 6.6.1-1
Container ID 1	‘0001’H		P-CSCF IPv6
Length of container ID 1 contents		Length value determined by the TTCN implementation
Container ID 1 contents	IPv6 address	P-CSCF IPv6 Address
Container ID 2	‘000C’H		P-CSCF IPv4
Length of container ID 2 contents		Length value determined by the TTCN implementation
Container ID 2 contents	IPv4 address	P-CSCF IPv4 Address
Container ID n	‘0003’H	n assigned to next available number	DNS IPv6
Length of container ID n contents		Length value determined by the TTCN implementation
Container ID n contents	IPv6 address	DNS IPv6 Address
Container ID n+1	‘000D’H	n assigned to next available number	DNS IPv4
Length of container ID n+1 contents		Length value determined by the TTCN implementation
Container ID n+1 contents	IPv4 address	DNS IPv4 Address
Container ID n+2	‘001D’H	n assigned to next available number	Interworking_with_5GS
Length of container ID n+2 contents		Length value determined by the TTCN implementation
Container ID n+2 contents	Session-AMBR	Session-AMBR
Session AMBR
Unit for Session-AMBR for downlink	‘000 00101’	Value is incremented in multiples of 256 Kbps
Session-AMBR for downlink	‘0000 0000 0000 0100’B	1024 Kbps
Unit for Session-AMBR for uplink	‘000 00101’	Value is incremented in multiples of 256 Kbps
Session-AMBR for uplink	‘0000 0000 0000 0100’B	1024 Kbps
Container ID n+3	‘001C’H	n assigned to next available number	Interworking_with_5GS
Length of container ID n+3 contents		Length value determined by the TTCN implementation
Container ID n+3 contents	QoS rules	QoS rules according to TS 38.508-1 [67] Table 4.8.2.1-1	NOT IMS_PDN_ConnEstab
Container ID n+3 contents	QoS rules	QoS rules according to TS 38.508-1 [67] Table 4.8.2.1-2	IMS_PDN_ConnEstab
Container ID n+4	‘001F’H	n assigned to next available number	Interworking_with_5GS
Length of container ID n+4 contents		Length value determined by the TTCN implementation
Container ID n+4 contents	Qos flow descriptions	Qos flow descriptions according to TS 38.508-1 [67] 4.8.2.3-1 with condition Interworking_with_EPS	NOT IMS_PDN_ConnEstab
Container ID n+4 contents	Qos flow descriptions	Qos flow descriptions refer to TS 38.508-1 [67] 4.8.2.3-2 with condition Interworking_with_EPS	IMS_PDN_ConnEstab
Container ID n+5	‘001B’H	n assigned to next available number	Interworking_with_5GS
Length of container ID n+5 contents		Length value determined by the TTCN implementation
Container ID n+5 contents (Octet 1)	‘0000 0001’B	SST of S-NSSAI same as the allowed NSSAI in TS 38.508-1 [67] Table 4.7.1-7: REGISTRATION ACCEPT
Container ID n+5 contents (Octets 2 to 4)	PLMN ID	PLMD ID same as TS 38.508-1 [67] Table 6.3.2.2-1
WLAN offload indication	Not present
WLAN offload indication			WLAN
WLAN offload acceptability	‘0001’B	Offloading the traffic of the PDN connection via a WLAN when in S1 mode is acceptable
NBIFOM container	Not present
Header compression configuration	Not present or set according to specific message content
Control plane only indication	Not present
Control plane only indication	‘0001’B		CIoT_ControlPlane_PDN
Extended protocol configuration options	Not present		NOT (pc_NB or pc_NonIP_PDN)
Extended protocol configuration options			pc_NB or pc_NonIP_PDN
Configuration protocol	See Reference default EPS bearer context #1 in table 6.6.1-1
Container ID n	‘0003’H	n assigned to next available number	DNS IPv6
Length of container ID n contents		Length value determined by the TTCN implementation
Container ID n contents	IPv6 address	DNS IPv6 Address
Container ID n+1	‘000D’H	n assigned to next available number	DNS IPv4
Length of container ID n+1 contents		Length value determined by the TTCN implementation
Container ID n+1 contents	IPv4 address	DNS IPv4 Address
Serving PLMN rate control	Not present
Serving PLMN rate control	‘FFFF’H	Maximum number of ESM DATA TRANSPORT messages allowed per 6 min interval is not restricted	CIoT_ControlPlane_PDN

Condition	Explanation
IPv4	If in the last PDN CONNECTIVITY REQUEST sent prior to this message, the PDN type = ‘001’B
IPv6	If in the last PDN CONNECTIVITY REQUEST sent prior to this message, the PDN type = ‘010’B
IPv4v6	If in the last PDN CONNECTIVITY REQUEST sent prior to this message, the PDN type = ‘011’B
IPv4-DHCP	If in the last PDN CONNECTIVITY REQUEST or ESM INFORMATION RESPONSE sent prior to this message, the IE Protocol configuration options contains a configuration protocol option = ‘000B00H’ ("IPv4 address allocation via DHCPv4", length of contents = 0). Note 1: This condition is used in conjunction with IPv4 or IPv4v6 as indicated in the "PDN address row" just above. Note 2: If both messages, PDN CONNECTIVITY REQUEST and ESM INFORMATION RESPONSE, are received and contain a Protocol configuration options IE then the IE from the message which is received later shall be used.
P-CSCF IPv6	If in the last PDN CONNECTIVITY REQUEST or ESM INFORMATION RESPONSE sent prior to this message, the Protocol configuration options and the additional parameter list was included with a “P-CSCF IPv6 Address Request” Note 1: This condition is only applicable for UEs with IMS support (TS 36.523-2 A.4.4-1/25). Note 2: If both messages, PDN CONNECTIVITY REQUEST and ESM INFORMATION RESPONSE, are received and contain a Protocol configuration options IE then the IE from the message which is received later shall be used.
P-CSCF IPv4	If in the last PDN CONNECTIVITY REQUEST or ESM INFORMATION RESPONSE sent prior to this message, the Protocol configuration options and the additional parameter list was included with a “P-CSCF IPv4 Address Request” Note 1: This condition is only applicable for UEs with IMS support (TS 36.523-2 A.4.4-1/25). Note 2: If both messages, PDN CONNECTIVITY REQUEST and ESM INFORMATION RESPONSE, are received and contain a Protocol configuration options IE then the IE from the message which is received later shall be used.
DNS IPv6	If in the last PDN CONNECTIVITY REQUEST or ESM INFORMATION RESPONSE sent prior to this message, the Protocol configuration options and the additional parameter list was included with a “DNS IPv6 Address Request”. Note: If both messages, PDN CONNECTIVITY REQUEST and ESM INFORMATION RESPONSE, are received and contain a Protocol configuration options IE then the IE from the message which is received later shall be used.
DNS IPv4	If in the last PDN CONNECTIVITY REQUEST or ESM INFORMATION RESPONSE sent prior to this message, the Protocol configuration options and the additional parameter list was included with a “DNS IPv4 Address Request”. Note: If both messages, PDN CONNECTIVITY REQUEST and ESM INFORMATION RESPONSE, are received and contain a Protocol configuration options IE then the IE from the message which is received later shall be used.
APN_Provided	If in the last PDN CONNECTIVITY REQUEST or ESM INFORMATION RESPONSE sent prior to this message an Access Point Name was included NOTE: APN_Provided is equivalent to pc_Provide_IMS_APN for establishment of the first PDN connectivity during initial registration and if the first PDN is IMS (see table 4.7.3-14)
IMS_PDN_ConnEstab	If this message refers to establishment of connectivity to the IMS PDN (only applicable if the UE supports IMS according to TS 36.523-2 A.4.4-1/25).
WLAN	If the message is being sent for RAN Assisted WLAN interworking.
CIoT_ControlPlane_PDN	If the associated PDN connection is only for control plane CIoT optimization
CIoT_CP_NON_IP	If the UE requests a Non-IP type PDN
Interworking_with_5GS	If the UE has indicated support of N1, then the SS shall include these IEs to provide details for the interworking with 5GS. Applicable to 5G test cases defined in TS 38.523-1 [71].

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– BEARER RESOURCE ALLOCATION REJECT

This message is sent by the SS to the UE.

Table 4.7.3-6A: BEARER RESOURCE ALLOCATION REJECT

Derivation Path: 24.301 clause 8.3.7
Information Element	Value/remark	Comment	Condition
Protocol discriminator	ESM
EPS bearer identity	‘0000’B	No EPS bearer identity assigned
Procedure transaction identity	The value indicated in BEARER RESOURCE ALLOCATION REQUEST message.
Bearer resource allocation reject message identity	‘1101 0101’B	Bearer resource allocation reject
ESM cause	Set according to specific message content.
Protocol configuration options	Not present
NBIFOM container	Not present
Extended protocol configuration options	Not present

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– BEARER RESOURCE ALLOCATION REQUEST

This message is sent by the UE to the SS.

Table 4.7.3-6B: BEARER RESOURCE ALLOCATION REQUEST

Derivation Path: 24.301 clause 8.3.8
Information Element	Value/remark	Comment	Condition
Protocol discriminator	ESM
EPS bearer identity	‘0000’B	No EPS bearer identity assigned
Procedure transaction identity	Any value from 1 to 254
Bearer resource allocation request message identity	‘1101 0100’B	Bearer resource allocation request
Linked EPS bearer identity	The EPS bearer identity of the associated default bearer.
Spare half octet	‘0000’B
Traffic flow aggregate
Number of packet filters	Greater than 0 and less than or equal to 16
E bit	Any allowed value
TFT operation code	‘001’B	Create new TFT
Packet filter list	Any allowed value
Parameters list	Not present or any allowed value
Required traffic flow QoS	Any allowed value
Protocol configuration options	Not present or any allowed value
NBIFOM container	Not present or any allowed value
Extended protocol configuration options	Not present or any allowed value

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– BEARER RESOURCE MODIFICATION REJECT

This message is sent by the SS to the UE.

Table 4.7.3-7: BEARER RESOURCE MODIFICATION REJECT

Derivation Path: 24.301 clause 8.3.9
Information Element	Value/remark	Comment	Condition
Protocol discriminator	ESM
EPS bearer identity	‘0000’B	No EPS bearer identity assigned
Procedure transaction identity	The value indicated in BEARER RESOURCE MODIFICATION REQUEST message.
Bearer resource modification reject message identity	‘1101 0111’B	Bearer resource modification reject
ESM cause	Set according to specific message content.
Protocol configuration options	Not present
NBIFOM container	Not present
Extended protocol configuration options	Not present

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– BEARER RESOURCE MODIFICATION REQUEST

This message is sent by the UE to the SS.

Table 4.7.3-8: BEARER RESOURCE MODIFICATION REQUEST

Derivation Path: 24.301 clause 8.3.10
Information Element	Value/remark	Comment	Condition
Protocol discriminator	ESM
EPS bearer identity	‘0000’B	No EPS bearer identity assigned
Procedure transaction identity	Any value from 1 to 254
Bearer resource modification request message identity	‘1101 0110’B	Bearer resource modification request
EPS bearer identity for packet filter	The EPS bearer identity of the associated dedicated EPS bearer related with packet filter.
Spare half octet	‘0000’B
Traffic flow aggregate	Any allowed value
Traffic flow aggregate			RELEASE-REQUESTED
Number of packet filters	Greater than 0 and less than or equal to 16
E bit	Any allowed value
TFT operation code	‘101’B	Delete packet filters from existing TFT
Packet filter list	Any allowed value
Parameters list	Not present or any allowed value
Required traffic flow QoS	Not present or any allowed value
ESM cause	Not present
	‘0010 0100’B	Regular deactivation	RELEASE-REQUESTED
Protocol configuration options	Not present or any allowed value
NBIFOM container	Not present or any allowed value
Header compression configuration	Not present or any allowed value
Extended protocol configuration options	Not present or any allowed value

Condition	Explanation
RELEASE-REQUESTED	UE requests the release of bearer resources.

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

Table 4.7.3-9: (Void)

Table 4.7.3-10: (Void)

– DEACTIVATE EPS BEARER CONTEXT ACCEPT

This message is sent by the UE to the SS.

Table 4.7.3-11: DEACTIVATE EPS BEARER CONTEXT ACCEPT

Derivation Path: 24.301 clause 8.3.9
Information Element	Value/remark	Comment	Condition
Protocol discriminator	ESM
EPS bearer identity	The same value as the value set in DEACTIVATE EPS BEARER CONTEXT REQUEST message.
Procedure transaction identity	‘0000 0000’B	No procedure transaction identity assigned
Deactivate EPS bearer context accept message identity	‘1100 1110’B	Deactivate EPS bearer context accept
Protocol configuration options	Not present or any allowed value
Extended protocol configuration options	Not present or any allowed value

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– DEACTIVATE EPS BEARER CONTEXT REQUEST

This message is sent by the SS to the UE.

Table 4.7.3-12: DEACTIVATE EPS BEARER CONTEXT REQUEST

Derivation Path: 24.301 clause 8.3.10
Information Element	Value/remark	Comment	Condition
Protocol discriminator	ESM
EPS bearer identity	Set according to specific message content.
Procedure transaction identity	‘0000 0000’B	No procedure transaction identity assigned	NETWORK-INITIATED
	The same value as the value set in PDN DISCONNECT REQUEST message or BEARER RESOURCE MODIFICATION REQUEST message.		UE-INITIATED
Deactivate EPS bearer context request message identity	‘1100 1101’B	Deactivate EPS bearer context request
ESM cause	Set according to specific message content.
Protocol configuration options	Not present
NBIFOM container	Not present
Extended protocol configuration options	Not present

Condition	Explanation
NETWORK-INITIATED	Network initiated ESM procedures
UE-INITIATED	UE initiated ESM procedures

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– ESM DATA TRANSPORT

This message is sent by the UE or by the SS.

Table 4.7.3-12A: ESM DATA TRANSPORT

Derivation Path: 24.301 clause 8.3.25
Information Element	Value/remark	Comment	Condition
Protocol discriminator	ESM
EPS bearer identity	‘0000’B	No EPS bearer identity assigned
Procedure transaction identity	Any value from 1 to 254
ESM data transport message identity	‘1110 1011’B	ESM data transport
User data container	set according to specific message content
Release assistance indication	Not present or set according to specific message content

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– ESM DUMMY MESSAGE

This message is sent by the SS to the UE or by the UE to the SS.

Table 4.7.3-12B: ESM DUMMY MESSAGE

Derivation Path: 24.301 clause 8.3.12A
Information Element	Value/remark	Comment	Condition
Protocol discriminator	ESM
EPS bearer identity	‘0000’B	No EPS bearer identity assigned
Procedure transaction identity	The value indicated in ESM DUMMY MESSAGE message.
ESM information request message identity	‘1101 1100’B	ESM dummy message

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– ESM INFORMATION REQUEST

This message is sent by the SS to the UE.

Table 4.7.3-13: ESM INFORMATION REQUEST

Derivation Path: 24.301 clause 8.3.11
Information Element	Value/remark	Comment	Condition
Protocol discriminator	ESM
EPS bearer identity	‘0000’B	No EPS bearer identity assigned
Procedure transaction identity	The value indicated in PDN CONNECTIVITY REQUEST message.
ESM information request message identity	‘1101 1001’B	ESM information request

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– ESM INFORMATION RESPONSE

This message is sent by the UE to the SS.

Table 4.7.3-14: ESM INFORMATION RESPONSE

Derivation Path: 24.301 clause 8.3.12
Information Element	Value/remark	Comment	Condition
Protocol discriminator	ESM
EPS bearer identity	‘0000’B	No EPS bearer identity assigned
Procedure transaction identity	The same value as the value set in ESM INFORMATION REQUEST message.
ESM information response message identity	‘1101 1010’B	ESM information response
Access point name	Not present or any allowed value		Internet_APN
Access point name	Not present		IMS_APN_Default
Access point name	Any allowed value		IMS_APN_Provided
Protocol configuration options	Not present or any allowed value		NOT (pc_NB or pc_NonIP_PDN)
Protocol configuration options	If present including at least the following container		Interworking_with_5GS
Container ID n	‘001A’H	n assigned to next available number
Length of container ID n contents		1 octet
Container ID n contents	PDU session ID	PDU session ID assigned by the UE
Protocol configuration options	Not present		pc_NB or pc_NonIP_PDN
Extended protocol configuration options	Not present or any allowed value
Extended protocol configuration options	If present including at least the following container		Interworking_with_5GS
Container ID n	‘001A’H	n assigned to next available number
Length of container ID n contents		1 octet
Container ID n contents	PDU session ID	PDU session ID assigned by the UE

Condition	Expression	Explanation
IMS_APN_Provided	pc_IMS AND NOT pc_Provide_IMS_as_second_APN AND pc_Provide_IMS_APN	IMS APN shall be provided by the UE:
IMS_APN_Default	pc_IMS AND NOT pc_Provide_IMS_as_second_APN AND NOT pc_Provide_IMS_APN	No IMS APN shall be provided by the UE; IMS APN is default APN
Internet_APN	NOT pc_IMS OR pc_Provide_IMS_as_second_APN
Interworking_with_5GS		If the UE has indicated support of N1, then the SS shall include this IE to provide details for the interworking with 5GS. Applicable to 5G test cases defined in TS 38.523-1 [71]. Note: The PDU session ID container shall be sent in either the Protocol configuration options or the Extended protocol configuration options IE.

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– ESM STATUS

This message is sent by the UE or by the SS.

Table 4.7.3-15: ESM STATUS

Derivation Path: 24.301 clause 8.3.13
Information Element	Value/remark	Comment	Condition
Protocol discriminator	ESM
EPS bearer identity	Set according to specific message content.
Procedure transaction identity	‘0000 0000’B	No procedure transaction identity assigned
ESM status message identity	‘1110 1000’B	ESM status
ESM cause	Set according to specific message content.

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– MODIFY EPS BEARER CONTEXT ACCEPT

This message is sent by the UE to the SS.

Table 4.7.3-16: MODIFY EPS BEARER CONTEXT ACCEPT

Derivation Path: 24.301 clause 8.3.14
Information Element	Value/remark	Comment	Condition
Protocol discriminator	ESM
EPS bearer identity	The same value as the value set in MODIFY EPS BEARER CONTEXT REQUEST message.
Procedure transaction identity	‘0000 0000’B	No procedure transaction identity assigned
Modify EPS bearer context accept message identity	‘1100 1010’B	Modify EPS bearer context accept
Protocol configuration options	Not present or any allowed value
NBIFOM container	Not present or any allowed value
Extended protocol configuration options	Not present or any allowed value

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– MODIFY EPS BEARER CONTEXT REJECT

This message is sent by the UE to the SS.

Table 4.7.3-17: MODIFY EPS BEARER CONTEXT REJECT

Derivation Path: 24.301 clause 8.3.15
Information Element	Value/remark	Comment	Condition
Protocol discriminator	ESM
EPS bearer identity	The same value as the value set in MODIFY EPS BEARER CONTEXT REQUEST message.
Procedure transaction identity	‘0000 0000’B	No procedure transaction identity assigned
Modify EPS bearer context reject message identity	‘1100 1011’B	Modify EPS bearer context reject
ESM cause	The value is set according to specific message content.
Protocol configuration options	Not present
NBIFOM container	Not present
Extended protocol configuration options	Not present

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– MODIFY EPS BEARER CONTEXT REQUEST

This message is sent by the SS to the UE.

Table 4.7.3-18: MODIFY EPS BEARER CONTEXT REQUEST

Derivation Path: 24.301 clause 8.3.16
Information Element	Value/remark	Comment	Condition
Protocol discriminator	ESM
EPS bearer identity	Set according to specific message content.
Procedure transaction identity	‘0000 0000’B	No procedure transaction identity assigned	NETWORK-INITIATED
	The same value as the value set in BEARER RESOURCE MODIFICATION REQUEST message or BEARER RESOURCE ALLOCATION REQUEST message.		UE-INITIATED
Modify EPS bearer context request message identity	‘1100 1001’B	Modify EPS bearer context request
New EPS QoS	Use the same value as used in Activate EPS Bearer Context Request message
TFT	According to reference dedicated EPS bearer context #2 except for TFT operation code which is set to ‘100’B and TFT identifier is set to ‘00110000’B..
New QoS	Not Present.
Negotiated LLC SAPI	Not Present.
Radio priority	Not Present.
Packet flow Identifier	Not Present.
	‘0000 0000’B	Best Effort	pc_GERAN
APN-AMBR	Not Present.
Protocol configuration options	Not present
WLAN offload container	Not present
NBIFOM container	Not present
Header compression configuration	Not present
Extended protocol configuration options	Not present

Condition	Explanation
NETWORK-INITIATED	Network initiated ESM procedures
UE-INITIATED	UE initiated ESM procedures

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– NOTIFICATION

This message is sent by the SS to the UE.

Table 4.7.3-18A: NOTIFICATION

Derivation Path: 24.301 clause 8.3.18A
Information Element	Value/remark	Comment	Condition
Protocol discriminator	ESM
EPS bearer identity	‘0000’B	No EPS bearer identity assigned
	The same value as the value set in ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST message for IMS signalling.		SRVCC-HO-CANCELLED
Procedure transaction identity	‘0000 0000’B	No procedure transaction identity assigned
Notification message identity	‘1101 1011’B	Notification
Notification indicator	‘0000 0001’B	SRVCC handover cancelled, IMS session re-establishment required	SRVCC-HO-CANCELLED

Condition	Explanation
SRVCC-HO-CANCELLED	Used if SRVCC handover is cancelled.

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– PDN CONNECTIVITY REJECT

This message is sent by the SS to the UE.

Table 4.7.3-19: PDN CONNECTIVITY REJECT

Derivation Path: 24.301 clause 8.3.17
Information Element	Value/remark	Comment	Condition
Protocol discriminator	ESM
EPS bearer identity	‘0000’B	No EPS bearer identity assigned
Procedure transaction identity	The same value as the value set in PDN CONNECTIVITY REQUEST message.
PDN connectivity reject message identity	‘1101 0001’B	PDN connectivity reject
ESM cause	The value is set according to specific message content.
Protocol configuration options	Not present
NBIFOM container	Not present
Extended protocol configuration options	Not present

– PDN CONNECTIVITY REQUEST

This message is sent by the UE to the SS.

Table 4.7.3-20: PDN CONNECTIVITY REQUEST

Derivation Path: 24.301 clause 8.3.20
Information Element	Value/remark	Comment	Condition
Protocol discriminator	ESM
EPS bearer identity	‘0000’B	No EPS bearer identity assigned
Procedure transaction identity	Any value from 1 to 254
PDN connectivity request message identity	‘1101 0000’B	PDN connectivity request
Request type	‘0001’B	initial request
PDN type	Any value between ‘001’B, ‘010’B, ‘011’B and ‘100’B	The allowed values are respectively IPv4, IPv6, IPv4v6 and "unused but interpreted as IPv6 by the network"
PDN type	‘101’B	Non-IP	CIoT_CP_NON_IP
ESM information transfer flag	Not present or any allowed value
Access point name	Not present	The value is mandatory when the PDN CONNECTIVITY REQUEST message is sent together with an ATTACH REQUEST message.
Protocol configuration options	Not present or any allowed value	The value received from the UE does not affect the possible verdict associated with the message when received by the SS. The SS shall remember if this IE is present and its contents because this affects subsequent SS behaviour, e.g. coding of ACTIVATE DEFAULT EPS BEARER CONTEXT REQUEST.	NOT (pc_NB or pc_NonIP_PDN)
Protocol configuration options	Not present		pc_NB or pc_NonIP_PDN
Protocol configuration options	If present including at least the following container		Interworking_with_5GS
Container ID n	‘001A’H	n assigned to next available number
Length of container ID n contents		1 octet
Container ID n contents	PDU session ID	PDU session ID assigned by the UE
NBIFOM container	Not present or any allowed value
Header compression configuration	Not present or any allowed value
Extended protocol configuration options	Not present or any allowed value
Extended protocol configuration options	If present including at least the following container		Interworking_with_5GS
Container ID n	‘001A’H	n assigned to next available number
Length of container ID n contents		1 octet
Container ID n contents	PDU session ID	PDU session ID assigned by the UE

Condition

Explanation

CIoT_CP_NON_IP

If the UE requests a Non-IP type PDN

Interworking_with_5GS

If the UE has indicated support of N1, then the SS shall include this IE to provide details for the interworking with 5GS. Applicable to 5G test cases defined in TS 38.523-1 [71].

Note: The PDU session ID container shall be sent in either the Protocol configuration options or the Extended protocol configuration options IE.

– PDN DISCONNECT REJECT

This message is sent by the SS to the UE.

Table 4.7.3-21: PDN DISCONNECT REJECT

Derivation Path: 24.301 clause 8.3.19
Information Element	Value/remark	Comment	Condition
Protocol discriminator	ESM
EPS bearer identity	‘0000’B	No EPS bearer identity assigned
Procedure transaction identity	The value indicated in PDN DISCONNECT REQUEST message.
PDN disconnect reject message identity	‘1101 0011’B	PDN disconnect reject
ESM cause	Set according to specific message content.
Protocol configuration options	Not present
Extended protocol configuration options	Not present

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.

– PDN DISCONNECT REQUEST

This message is sent by the UE to the SS.

Table 4.7.3-22: PDN DISCONNECT REQUEST

Derivation Path: 24.301 clause 8.3.20
Information Element	Value/remark	Comment	Condition
Protocol discriminator	ESM
EPS bearer identity	‘0000’B	No EPS bearer identity assigned
Procedure transaction identity	Any value from 1 to 254
PDN disconnect request message identity	‘1101 0010’B	PDN disconnect request
Linked EPS bearer identity	The EPS bearer identity of the associated default bearer.
Spare half octet	‘0000’B
Protocol configuration options	Not present or any allowed value
Extended protocol configuration options	Not present or any allowed value

NOTE: This message is always sent within SECURITY PROTECTED NAS MESSAGE message.