3GPP 24.501 v20.0.0 — the document's own text

5.5.1.2.5 Initial registration not accepted by the network

Taught in 4. Inside TS 24.501, the document at the centre (CT1 — the group that writes what your phone says, overview).

If the initial registration request cannot be accepted by the network, the AMF shall send a REGISTRATION REJECT message to the UE including an appropriate 5GMM cause value.

If the initial registration request is rejected due to general NAS level mobility management congestion control, the network shall set the 5GMM cause value to #22 "congestion" and assign a value for back-off timer T3346.

If the initial registration request is rejected due to general NAS level mobility management congestion control for an SNPN providing access for localized services in SNPN, the network may set an appropriate cause value other than 5GMM cause value to #22 "congestion" and does not assign a value for back-off timer T3346.

In NB-N1 mode, if the registration request is rejected due to operator determined barring (see 3GPP TS 29.503 [20AB]), the network shall set the 5GMM cause value to #22 "congestion" and assign a value for back-off timer T3346.

If the REGISTRATION REJECT message with 5GMM cause #76, #78, #81 or #82 was received without integrity protection, then the UE shall discard the message. If the REGISTRATION REJECT message with 5GMM cause #62 was received without integrity protected, the behaviour of the UE is specified in clause 5.3.20.2.

Based on operator policy, if the initial registration request is rejected due to core network redirection for CIoT optimizations, the network shall set the 5GMM cause value to #31 "Redirection to EPC required".

NOTE 1: The network can take into account the UE's S1 mode capability, the EPS CIoT network behaviour supported by the UE or the EPS CIoT network behaviour supported by the EPC to determine the rejection with the 5GMM cause value #31 "Redirection to EPC required".

If the initial registration request is rejected because:

all the S-NSSAI(s) included in the requested NSSAI are rejected; and
the UE set the NSSAA bit in the 5GMM capability IE to:

"Network slice-specific authentication and authorization supported" and:

void;
all default S-NSSAIs are not allowed; or

iii) network slice-specific authentication and authorization has failed or been revoked for all default S-NSSAIs and based on network local policy, the network decides not to initiate the network slice-specific re-authentication and re-authorization procedures for any default S-NSSAI requested by the UE; or

"Network slice-specific authentication and authorization not supported" and all default S-NSSAIs are either not allowed or are subject to network slice-specific authentication and authorization;

void
void

the network shall set the 5GMM cause value of the REGISTRATION REJECT message to #62 "No network slices available".

If the 5GMM cause value is set to #62 "No network slices available", the network shall include, in the rejected NSSAI of the REGISTRATION REJECT message, all the S-NSSAI(s) which were included in the requested NSSAI.

If the UE has set the ER-NSSAI bit to "Extended rejected NSSAI supported" in the 5GMM capability IE of the REGISTRATION REQUEST message, the rejected S-NSSAI(s) shall be included in the Extended rejected NSSAI IE of the REGISTRATION REJECT message. Otherwise, the rejected S-NSSAI(s) shall be included in the Rejected NSSAI IE of the REGISTRATION REJECT message.

If the Extended rejected NSSAI IE is included in the REGISTRATION REJECT message and mapped S-NSSAI(s) are required as specified in clause 4.6.1, the AMF shall provide mapped S-NSSAI(s) for the rejected NSSAI.

If the UE supports extended rejected NSSAI and the AMF determines that maximum number of UEs reached for one or more S-NSSAIs in the requested NSSAI as specified in clause 4.6.2.5, the AMF shall include the rejected NSSAI containing one or more S-NSSAIs with the rejection cause "S-NSSAI not available due to maximum number of UEs reached" in the Extended rejected NSSAI IE in the REGISTRATION REJECT message. In addition, the AMF may include a back-off timer value for each S-NSSAI with the rejection cause "S-NSSAI not available due to maximum number of UEs reached" in the Extended rejected NSSAI IE of the REGISTRATION REJECT message.

If the AMF receives the initial registration request along with the authenticated indication over N2 reference point on non-3GPP access and does not receive the indication that authentication by the home network is not required over N12 reference point, or the 5G-RG acting on behalf of an AUN3 device is not allowed to access 5GS as specified in 3GPP TS 23.316 [6D], the network shall set the 5GMM cause value to #72 "Non-3GPP access to 5GCN not allowed".

If the initial registration request from a UE supporting CAG is rejected due to CAG restrictions, the network shall set the 5GMM cause value to #76 "Not authorized for this CAG or authorized for CAG cells only" and should include the "CAG information list" in the CAG information list IE or the Extended CAG information list IE in the REGISTRATION REJECT message.

NOTE 2: The network cannot be certain that "CAG information list" stored in the UE is updated as result of sending of the REGISTRATION REJECT message with the CAG information list IE or the Extended CAG information list IE, as the REGISTRATION REJECT message is not necessarily delivered to the UE (e.g. due to abnormal radio conditions).

NOTE 3: The "CAG information list" can be provided by the AMF and include no entry if no "CAG information list" exists in the subscription.

NOTE 4: If the UE supports extended CAG information list, the CAG information list can be included either in the CAG information list IE or Extended CAG information list IE.

NOTE 4A: It is unexpected for network to send REGISTRATION REJECT message to the UE with 5GMM cause value #76 in non-CAG cell and not indicate "Indication that the UE is only allowed to access 5GS via CAG cells" for the serving PLMN in the Extended CAG information list or the CAG information list.

If the UE does not support extended CAG information list, the CAG information list shall not be included in the Extended CAG information list IE.

If the initial registration request from a UE not supporting CAG is rejected due to CAG restrictions, the network shall operate as described in bullet j) of clause 5.5.1.2.8.

If the UE's initial registration request is via:

a satellite NG-RAN cell; or
a non-satellite NG-RAN cell where the PLMN supports selected features that are normally applied in the satellite access and the UE indicates NonSATLSP supported,

and the network using the User Location Information provided by the NG-RAN, see 3GPP TS 38.413 [31], is able to determine that the UE is in a location where the network is not allowed to operate, the network shall set the 5GMM cause value in the REGISTRATION REJECT message to #78 "PLMN not allowed to operate at the present UE location".

NOTE 5: When the UE is accessing network for emergency services, it is up to operator and regulatory policies whether the network needs to determine if the UE is in a location where network is not allowed to operate.

NOTE 5A: While location determination is ongoing to ensure that operator and regulatory policies are met, the AMF can perform DNN-based or S-NSSAI based congestion control as specified in clauses 5.3.10 and 5.3.11 to prevent the UE from accessing network.

If the AMF receives the initial registration request including the service-level device ID set to the CAA-level UAV ID in the Service-level-AA container IE and the AMF determines that the UE is not allowed to use UAS services via 5GS based on the user's subscription data and the operator policy, the AMF shall return a REGISTRATION REJECT message with 5GMM cause #79 "UAS services not allowed".

If the UE initiates the registration procedure for disaster roaming services and the AMF determines that it does not support providing disaster roaming services for the determined PLMN with disaster condition to the UE, then the AMF shall send a REGISTRATION REJECT message with 5GMM cause #80 "Disaster roaming for the determined PLMN with disaster condition not allowed".

If the AMF receives the initial registration request over non-3GPP access and detects that the N3IWF used by the UE is not compatible with the allowed NSSAI and the UE has indicated its support for slice-based N3IWF selection in the REGISTRATION REQUEST message, the AMF may send a REGISTRATION REJECT message with 5GMM cause #81 "Selected N3IWF is not compatible with the allowed NSSAI" and may provide information for a suitable N3IWF in the REGISTRATION REJECT message indicating the suitable N3IWF that is compatible with the requested NSSAI.

If the AMF receives the initial registration request over non-3GPP access and detects that the TNGF used by the UE is not compatible with the allowed NSSAI and the UE has indicated its support for slice-based TNGF selection in the REGISTRATION REQUEST message, the AMF may send a REGISTRATION REJECT message with 5GMM cause #82 "Selected TNGF is not compatible with the allowed NSSAI" and may provide information for a suitable TNAN in the TNAN information IE in the REGISTRATION REJECT message indicating the suitable TNGF that is compatible with the requested NSSAI.

NOTE 5AA: Based on implementation the AMF can also take energy related local configuration for the N3IWF/TNGF (see 3GPP TS 23.501 [8]) into consideration when the AMF needs to provide information for a suitable N3IWF/TNGF.

If the AMF received multiple TAIs from the satellite NG-RAN as described in 3GPP TS 23.501 [8], and determines that, by UE subscription and operator's preferences, all of the received TAIs are forbidden for roaming or for regional provision of service, the AMF shall include the TAI(s) in:

the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for roaming" IE; or
the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for regional provision of service" IE; or
both;

in the REGISTRATION REJECT message.

Regardless of the 5GMM cause value received in the REGISTRATION REJECT message via satellite NG-RAN,

if the UE receives the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for roaming" IE and the Access technology utilization control IE is not included in the REGISTRATION REJECT message, the UE shall store the TAI(s) belonging to the serving PLMN or equivalent PLMN(s) and ignore the TAI(s) which do not belong to the serving PLMN or equivalent PLMN(s) included in the IE, if not already stored, into the list of "5GS forbidden tracking areas for roaming"; and
if the UE receives the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for regional provision of service" IE in the REGISTRATION REJECT message, the UE shall store the TAI(s) belonging to the serving PLMN or equivalent PLMN(s) and ignore the TAI(s) which do not belong to the serving PLMN or equivalent PLMN(s) included in the IE, if not already stored, into the list of "5GS forbidden tracking areas for regional provision of service".

If:

the UE indicates support of the access technology utilization control in the REGISTRATION REQUEST message over 3GPP access;

a1) the registration request is not for the disaster roaming services;

the network decides to apply the access technology utilization control based on the operator policy; and
the secure exchange of NAS messages via a NAS signalling connection is established between the UE and the AMF;

the AMF shall send the integrity protected REGISTRATION REJECT message with the 5GMM cause value set to #15 "No suitable cells in tracking area" and include the Access technology utilization control IE with the type of access technology utilization control set to "current PLMN". In the Access technology utilization control IE, the AMF shall indicate that the access technology of the NG-RAN cell on which the REGISTRATION REQUEST message was received is restricted.

NOTE 5B: Other restricted access technologies can be indicated in the Access technology utilization control IE, if any.

Furthermore, the UE shall take the following actions depending on the 5GMM cause value received in the REGISTRATION REJECT message.

#3 (Illegal UE); or

#6 (Illegal ME).

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI.

In case of PLMN, the UE shall consider the USIM as invalid for 5GS services until switching off, the UICC containing the USIM is removed or the timer T3245 expires as described in clause 5.3.19A.1;

In case of SNPN, if the UE is not performing initial registration for onboarding services in SNPN and the UE does not support access to an SNPN using credentials from a credentials holder and does not support equivalent SNPNs, the UE shall consider the selected entry of the "list of subscriber data" with the SNPN identity of the current SNPN as invalid until the UE is switched off, the entry is updated or the timer T3245 expires as described in clause 5.3.19A.2. In case of SNPN, if the UE is not performing initial registration for onboarding services in SNPN and the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs, or both, the UE shall consider the selected entry of the "list of subscriber data" as invalid for 3GPP access until the UE is switched off, the entry is updated or the timer T3245 expires as described in clause 5.3.19A.2. Additionally, if EAP based primary authentication and key agreement procedure using EAP-AKA' or 5G AKA based primary authentication and key agreement procedure was performed in the current SNPN, the UE shall consider the USIM as invalid for the current SNPN until switching off, the UICC containing the USIM is removed or the timer T3245 expires as described in clause 5.3.19A.2.

If the UE is not performing initial registration for onboarding services in SNPN, the UE shall delete the list of equivalent PLMNs (if any) or the list of equivalent SNPNs (if any), and enter the state 5GMM-DEREGISTERED.NO-SUPI. If the message has been successfully integrity checked by the NAS, then the UE shall:

set the counter for "SIM/USIM considered invalid for GPRS services" events and the counter for "USIM considered invalid for 5GS services over non-3GPP access" events in case of PLMN if the UE maintains these counters; or
set the counter for "the entry for the current SNPN considered invalid for 3GPP access" events and the counter for "the entry for the current SNPN considered invalid for non-3GPP access" events in case of SNPN if the UE maintains these counters;

to a UE implementation-specific maximum value.

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall handle the EMM parameters EMM state, EPS update status, 4G-GUTI, last visited registered TAI, TAI list and eKSI as specified in 3GPP TS 24.301 [15] for the case when the EPS attach request procedure is rejected with the EMM cause with the same value. The USIM shall be considered as invalid also for non-EPS services until switching off, the UICC containing the USIM is removed or the timer T3245 expires as described in clause 5.3.7a in 3GPP TS 24.301 [15]. If the message has been successfully integrity checked by the NAS and the UE maintains a counter for "SIM/USIM considered invalid for non-GPRS services", then the UE shall set this counter to a UE implementation-specific maximum value.

If the UE is performing initial registration for onboarding services in SNPN, the UE shall reset the registration attempt counter, store the SNPN identity in the "permanently forbidden SNPNs for onboarding services in SNPN" list, enter state 5GMM-DEREGISTERED.PLMN-SEARCH, and perform an SNPN selection or an SNPN selection for onboarding services according to 3GPP TS 23.122 [5]. If the message has been successfully integrity checked by the NAS, the UE shall set the SNPN-specific attempt counter for the current SNPN to the UE implementation-specific maximum value.

If the message has been successfully integrity checked by the NAS and the UE also supports the registration procedure over the other access, the UE shall in addition handle 5GMM parameters and 5GMM state for this access, as described for this 5GMM cause value.

#7 (5GS services not allowed).

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI.

In case of PLMN, the UE shall consider the USIM as invalid for 5GS services until switching off, the UICC containing the USIM is removed or the timer T3245 expires as described in clause 5.3.19A.1;

In case of SNPN, if the UE is not performing initial registration for onboarding services in SNPN and the UE does not support access to an SNPN using credentials from a credentials holder and does not support equivalent SNPNs, the UE shall consider the selected entry of the "list of subscriber data" with the SNPN identity of the current SNPN as invalid for 5GS services until the UE is switched off, the entry is updated or the timer T3245 expires as described in clause 5.3.19A.2. In case of SNPN, if the UE is not performing initial registration for onboarding services in SNPN and the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs, or both, the UE shall consider the selected entry of the "list of subscriber data" as invalid for 3GPP access until the UE is switched off, the entry is updated or the timer T3245 expires as described in clause 5.3.19A.2. Additionally, if EAP based primary authentication and key agreement procedure using EAP-AKA' or 5G AKA based primary authentication and key agreement procedure was performed in the current SNPN, the UE shall consider the USIM as invalid for the current SNPN until switching off, the UICC containing the USIM is removed or the timer T3245 expires as described in clause 5.3.19A.2.

If the UE is not performing initial registration for onboarding services in SNPN, the UE shall enter the state 5GMM-DEREGISTERED.NO-SUPI. If the message has been successfully integrity checked by the NAS, then the UE shall:

set the counter for "SIM/USIM considered invalid for GPRS services" events and the counter for "USIM considered invalid for 5GS services over non-3GPP access" events in case of PLMN if the UE maintains these counters; or
set the counter for "the entry for the current SNPN considered invalid for 3GPP access" events and the counter for "the entry for the current SNPN considered invalid for non-3GPP access" events in case of SNPN if the UE maintains these counters;

to a UE implementation-specific maximum value.

#10 (Implicitly de-registered).

5GMM cause #10 is only applicable when received from a wireline access network by the 5G-RG acting on behalf of the AUN3 device and indicates that there is no 5G-RG connected to the same wireline. 5GMM cause #10 received when the 5G-RG is not acting on behalf of the AUN3 or received from a 5G access network other than a wireline access network is considered as abnormal cases and the behaviour of the UE is specified in clause 5.5.1.2.7.

When received over wireline access network, the 5G-RG acting on behalf of the AUN3 device shall abort the initial registration procedure that was initiated on behalf of the AUN3 device. The 5G-RG shall set its 5GS update status to 5U2 NOT UPDATED (and shall store it according to clause 5.1.3.2.2), shall delete its 5G-GUTI, last visited registered TAI, TAI list, ngKSI, and shall reset its registration attempt counter, and shall enter the state 5GMM-DEREGISTERED.

#11 (PLMN not allowed).

This cause value received from a cell belonging to an SNPN and the UE is operating in SNPN access operation mode is considered as an abnormal case and the behaviour of the UE is specified in clause 5.5.1.2.7.

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall in addition handle the EMM parameters EMM state, EPS update status, 4G-GUTI, last visited registered TAI, TAI list, eKSI and attach attempt counter as specified in 3GPP TS 24.301 [15] for the case when the EPS attach request procedure is rejected with the EMM cause with the same value.

If the message has been successfully integrity checked by the NAS and the UE also supports the registration procedure over the other access to the same PLMN, the UE shall in addition handle 5GMM parameters and 5GMM state for this access, as described for this 5GMM cause value.

#12 (Tracking area not allowed).

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall delete last visited registered TAI and TAI list. If the UE is not registering or has not registered to the same PLMN over both 3GPP access and non-3GPP access, the UE shall additionally delete 5G-GUTI and ngKSI. Additionally, the UE shall reset the registration attempt counter.

If:

the UE is not operating in SNPN access operation mode and the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for regional provision of service" IE is not included in the REGISTRATION REJECT message, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for regional provision of service" and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE. If the REGISTRATION REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for regional provision of service" for non-integrity protected NAS reject message; or
the UE is operating in SNPN access operation mode, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for regional provision of service" for the current SNPN and the selected entry of the "list of subscriber data" or the selected PLMN subscription, and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE. If the REGISTRATION REJECT is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for regional provision of service" for the current SNPN and the selected entry of the "list of subscriber data" or the selected PLMN subscription, for non-integrity protected NAS reject message. If the SNPN is an SNPN selected for localized services in SNPN (see 3GPP TS 23.122 [5] clause 3.9), the UE shall store the current TAI in the list of "5GS forbidden tracking areas for regional provision of service" for the current SNPN and the selected entry of the "list of subscriber data" or the selected PLMN subscription, along with the GIN(s) broadcasted by the SNPN if any.

#13 (Roaming not allowed in this tracking area).

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall delete last visited registered TAI and TAI list. If the UE is not registering or has not registered to the same PLMN over both 3GPP access and non-3GPP access, the UE shall additionally delete 5G-GUTI, ngKSI and the list of equivalent PLMNs (if available) or the list of equivalent SNPNs (if available). Additionally, the UE shall reset the registration attempt counter.

If:

the UE is not operating in SNPN access operation mode and the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for roaming" IE is not included in the REGISTRATION REJECT message, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE or optionally 5GMM-DEREGISTERED.PLMN-SEARCH. If the REGISTRATION REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for non-integrity protected NAS reject message; or
the UE is operating in SNPN access operation mode, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and the selected entry of the "list of subscriber data" or the selected PLMN subscription, and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE or optionally 5GMM-DEREGISTERED.PLMN-SEARCH. If the REGISTRATION REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and the selected entry of the "list of subscriber data" or the selected PLMN subscription, for non-integrity protected NAS reject message. If the SNPN is an SNPN selected for localized services in SNPN (see 3GPP TS 23.122 [5] clause 3.9), the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and the selected entry of the "list of subscriber data" or the selected PLMN subscription, along with the GIN(s) broadcasted by the SNPN if any.

For 3GPP access, if the UE is registered in S1 mode and operating in dual-registration mode, the PLMN that the UE chooses to register in is specified in clause 4.8.3. Otherwise the UE shall perform a PLMN selection or SNPN selection according to 3GPP TS 23.122 [5].

For non-3GPP access, the UE shall perform network selection as defined in 3GPP TS 24.502 [18].

#15 (No suitable cells in tracking area).

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall delete any last visited registered TAI and TAI list. If the UE is not registering or has not registered to the same PLMN over both 3GPP access and non-3GPP access, the UE shall additionally delete 5G-GUTI and ngKSI. Additionally, the UE shall reset the registration attempt counter.

If:

the UE is not operating in SNPN access operation mode;
the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for roaming" IE is not included in the REGISTRATION REJECT message;

iii) the Extended 5GMM cause IE with value "Satellite NG-RAN not allowed in PLMN" is not included in the REGISTRATION REJECT message or the REGISTRATION REJECT message is not integrity protected; and

the Access technology utilization control IE is not included in the REGISTRATION REJECT message or the REGISTRATION REJECT message is not integrity protected,

then the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE.

If the UE stores the current TAI in the list of "5GS forbidden tracking areas for roaming" and the REGISTRATION REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for non-integrity protected NAS reject message; or

the UE is operating in SNPN access operation mode, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and the selected entry of the "list of subscriber data" or the selected PLMN subscription, and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE. If the REGISTRATION REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and the selected entry of the "list of subscriber data" or the selected PLMN subscription, for non-integrity protected NAS reject message. If the SNPN is an SNPN selected for localized services in SNPN (see 3GPP TS 23.122 [5] clause 3.9), the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and the selected entry of the "list of subscriber data" or the selected PLMN subscription, along with the GIN(s) broadcasted by the SNPN if any.

Additionally, the UE shall:

if the Extended 5GMM cause IE with value "Satellite NG-RAN not allowed in PLMN" is included in the REGISTRATION REJECT message,

the message has been successfully integrity checked by the NAS; and the UE is configured for "Satellite Access Disabling for 5GMM cause #15" as specified in 3GPP TS 24.368 [17] or 3GPP TS 31.102 [22] and set to enabled, then the UE shall disable satellite NG-RAN capability (see clause 4.9.4); or
otherwise, the UE shall ignore the Extended 5GMM cause IE;

if the Access technology utilization control IE with the type of access technology utilization control set to "current PLMN" is included in the REGISTRATION REJECT message,

the message has been successfully integrity checked by the NAS; the UE shall store the received access technology utilization control information together with the PLMN identity of the current PLMN in the list of "PLMNs with associated access technology restrictions" as specified in clause 4.2A.2; or
otherwise, the UE shall ignore the Access technology utilization control IE; and

search for a suitable cell in another tracking area according to 3GPP TS 38.304 [28] or 3GPP TS 36.304 [25C].

If received over non-3GPP access the cause shall be considered as an abnormal case and the behaviour of the UE for this case is specified in clause 5.5.1.2.7.

#22 (Congestion).

If the T3346 value IE is present in the REGISTRATION REJECT message and the value indicates that this timer is neither zero nor deactivated, the UE shall proceed as described below; otherwise it shall be considered as an abnormal case and the behaviour of the UE for this case is specified in clause 5.5.1.2.7.

The UE shall abort the initial registration procedure, set the 5GS update status to 5U2 NOT UPDATED, reset the registration attempt counter and enter state 5GMM-DEREGISTERED.ATTEMPTING-REGISTRATION.

The UE shall stop timer T3346 if it is running.

If the REGISTRATION REJECT message is integrity protected, the UE shall start timer T3346 with the value provided in the T3346 value IE.

If the REGISTRATION REJECT message is not integrity protected, the UE shall start timer T3346 with a random value from the default range specified in 3GPP TS 24.008 [12].

The UE stays in the current serving cell and applies the normal cell reselection process. The initial registration procedure is started if still needed when timer T3346 expires or is stopped.

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall handle the EMM parameters EMM state, EPS update status, and attach attempt counter as specified in 3GPP TS 24.301 [15] for the case when the EPS attach request procedure is rejected with the EMM cause with the same value.

If the UE is registering for onboarding services in SNPN, the UE may enter the state 5GMM-DEREGISTERED.PLMN-SEARCH and perform an SNPN selection or an SNPN selection for onboarding services according to 3GPP TS 23.122 [5].

#27 (N1 mode not allowed).

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. Additionally, the UE shall reset the registration attempt counter and shall enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE. If the message has been successfully integrity checked by the NAS, the UE shall set:

the PLMN-specific N1 mode attempt counter for 3GPP access and the PLMN-specific N1 mode attempt counter for non-3GPP access for that PLMN in case of PLMN; or
the SNPN-specific attempt counter for 3GPP access for the current SNPN in case of SNPN and the SNPN-specific attempt counter for non-3GPP access for the current SNPN;

to the UE implementation-specific maximum value.

The UE shall disable the N1 mode capability for the specific access type for which the message was received (see clause 4.9).

If the message has been successfully integrity checked by the NAS, the UE shall disable the N1 mode capability also for the other access type (see clause 4.9).

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall in addition set the EPS update status to EU3 ROAMING NOT ALLOWED and shall delete any 4G-GUTI, last visited registered TAI, TAI list and eKSI. Additionally, the UE shall reset the attach attempt counter and enter the state EMM-DEREGISTERED.

#31 (Redirection to EPC required).

5GMM cause #31 received by a UE that has not indicated support for CIoT optimizations or not indicated support for S1 mode or received by a UE over non-3GPP access is considered as an abnormal case and the behaviour of the UE is specified in clause 5.5.1.2.7.

The UE shall enable the E-UTRA capability if it was disabled, disable the N1 mode capability for 3GPP access (see clause 4.9.2) and enter the 5GMM-DEREGISTERED.NO-CELL-AVAILABLE.

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall handle the EMM parameters EMM state, EPS update status, 4G-GUTI, TAI list, eKSI and attach attempt counter as specified in 3GPP TS 24.301 [15] for the case when the EPS attach procedure is rejected with the EMM cause with the same value.

#36 (IAB-node operation not authorized).

This cause value is only applicable when received over 3GPP access by a UE operating as an IAB-node. This cause value received from a 5G access network other than 3GPP access or received by a UE not operating as an IAB-node is considered as an abnormal case and the behaviour of the UE is specified in clause 5.5.1.2.7.

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI.

If:

the UE is not operating in SNPN access operation mode,

the UE shall delete the list of equivalent PLMNs and reset the registration attempt counter and store the PLMN identity in the forbidden PLMN list as specified in clause 5.3.13A and if the UE is configured to use timer T3245 then the UE shall start timer T3245 and proceed as described in clause 5.3.19a.1. The UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform a PLMN selection according to 3GPP TS 23.122 [5]. If the message has been successfully integrity checked by the NAS and the UE maintains the PLMN-specific attempt counter for 3GPP access for that PLMN, the UE shall set the PLMN-specific attempt counter for 3GPP access for that PLMN to the UE implementation-specific maximum value; and
If the UE is operating in single-registration mode, the UE shall in addition handle the EMM parameters EMM state, EPS update status, 4G-GUTI, last visited registered TAI, TAI list, eKSI and attach attempt counter as specified in 3GPP TS 24.301 [15] for the case when the EPS attach request procedure is rejected with the EMM cause with the same value; or

the UE is operating in SNPN access operation mode,

the UE shall delete the list of equivalent SNPNs (if available). The UE shall reset the registration attempt counter and store the SNPN identity in the "temporarily forbidden SNPNs" list for 3GPP access and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, the selected entry of the "list of subscriber data" or the selected PLMN subscription or "temporarily forbidden SNPNs for access for localized services in SNPN" list if the SNPN is an SNPN selected for localized services in SNPN (see 3GPP TS 23.122 [5]) for 3GPP access and the selected entry of the "list of subscriber data" or the selected PLMN subscription or the selected PLMN subscription or in the "temporarily forbidden SNPNs for onboarding services in SNPN" list, if the UE is performing initial registration for onboarding services in SNPN, for 3GPP access. If the UE supports access to an SNPN using credentials from a credentials holder, the UE shall store the SNPN identity in the "temporarily forbidden SNPNs" list along with the GIN(s) broadcasted by the SNPN if any, for the selected entry of the "list of subscriber data" or the selected PLMN subscription. If the UE supports access to an SNPN providing access for localized services in SNPN and the access for localized services in SNPN has been enabled, the UE shall store the SNPN identity in the list of "temporarily forbidden SNPNs for access for localized services in SNPN" (if the SNPN is an SNPN selected for localized services in SNPN (see 3GPP TS 23.122 [5]) along with the GIN(s) broadcasted by the SNPN if any, for the selected entry of the "list of subscriber data" or the selected PLMN subscription. The UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform an SNPN selection according to 3GPP TS 23.122 [5]. If the message has been successfully integrity checked by the NAS, the UE shall set the SNPN attempt counter for 3GPP access for the current SNPN to the UE implementation-specific maximum value.

#62 (No network slices available).

The UE receiving the rejected NSSAI in the REGISTRATION REJECT message takes the following actions based on the rejection cause in the rejected S-NSSAI(s):

"S-NSSAI not available in the current PLMN or SNPN"

The UE shall store the rejected S-NSSAI(s) in the rejected NSSAI for the current PLMN or SNPN as specified in clause 4.6.2.2 and shall not attempt to use this S-NSSAI(s) in the current PLMN or SNPN over any access until switching off the UE, the UICC containing the USIM is removed, an entry of the "list of subscriber data" with the SNPN identity of the current SNPN is updated, or the rejected S-NSSAI(s) are removed as described in clause 4.6.2.2.

"S-NSSAI not available in the current registration area"

The UE shall store the rejected S-NSSAI(s) in the rejected NSSAI for the current registration area as described in clause 4.6.2.2 and shall not attempt to use this S-NSSAI(s) in the current registration area over the current access until switching off the UE, the UE moving out of the current registration area, the UICC containing the USIM is removed, the entry of the "list of subscriber data" with the SNPN identity of the current SNPN is updated, or the rejected S-NSSAI(s) are removed as described in clause 4.6.2.2.

"S-NSSAI not available due to the failed or revoked network slice-specific authentication and authorization"

The UE shall store the rejected S-NSSAI(s) in the rejected NSSAI for the failed or revoked NSSAA as specified in clause 4.6.2.2 and shall not attempt to use this S-NSSAI in the current PLMN or SNPN over any access until switching off the UE, the UICC containing the USIM is removed, the entry of the "list of subscriber data" with the SNPN identity of the current SNPN is updated, or the rejected S-NSSAI(s) are removed as described in clause 4.6.1 and 4.6.2.2.

"S-NSSAI not available due to maximum number of UEs reached"

Unless the back-off timer value received along with the S-NSSAI is zero, the UE shall add the rejected S-NSSAI(s) in the rejected NSSAI for the maximum number of UEs reached as specified in clause 4.6.2.2 and shall not attempt to use this S-NSSAI in the current PLMN or SNPN over the current access until switching off the UE, the UICC containing the USIM is removed, the entry of the "list of subscriber data" with the SNPN identity of the current SNPN is updated, or the rejected S-NSSAI(s) are removed as described in clauses 4.6.1 and 4.6.2.2.

NOTE 6: If the back-off timer value received along with the S-NSSAI in the rejected NSSAI for the maximum number of UEs reached is zero as specified in clause 10.5.7.4a of 3GPP TS 24.008 [12], the UE does not consider the S-NSSAI as the rejected S-NSSAI.

If there is one or more S-NSSAIs in the rejected NSSAI with the rejection cause "S-NSSAI not available due to maximum number of UEs reached", then for each S-NSSAI, the UE shall behave as follows:

stop the timer T3526 associated with the S-NSSAI, if running;
start the timer T3526 with:

the back-off timer value received along with the S-NSSAI, if a back-off timer value is received along with the S-NSSAI that is neither zero nor deactivated; or
an implementation specific back-off timer value, if no back-off timer value is received along with the S-NSSAI; and

remove the S-NSSAI from the rejected NSSAI for the maximum number of UEs reached when the timer T3526 associated with the S-NSSAI expires.

If the UE has an allowed NSSAI or configured NSSAI and:

at least one S-NSSAI of the allowed NSSAI or configured NSSAI is not included in the rejected NSSAI the UE may stay in the current serving cell, apply the normal cell reselection process and start an initial registration with a requested NSSAI that includes any S-NSSAI from the allowed NSSAI or the configured NSSAI that is not in the rejected NSSAI.
all the S-NSSAI(s) in the allowed NSSAI and configured NSSAI are rejected and at least one S-NSSAI is rejected due to "S-NSSAI not available in the current registration area" and:

the REGISTRATION REJECT message is integrity protected, the UE is not operating in SNPN access operation mode and the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for roaming" IE is not included in the REGISTRATION REJECT message, then the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming", memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for S-NSSAI is rejected due to "S-NSSAI not available in the current registration area" and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE. The UE shall search for a suitable cell in another tracking area according to 3GPP TS 38.304 [28] or 3GPP TS 36.304 [25C]; or
the REGISTRATION REJECT message is integrity protected and the UE is operating in SNPN access operation mode, then the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming", memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for S-NSSAI is rejected due to "S-NSSAI not available in the current registration area" for the current SNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, the selected entry of the "list of subscriber data" or the selected PLMN subscription, and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE. The UE shall search for a suitable cell in another tracking area according to 3GPP TS 38.304 [28] or 3GPP TS 36.304 [25C].

otherwise, the UE may perform a PLMN selection or SNPN selection according to 3GPP TS 23.122 [5] and additionally, the UE may disable the N1 mode capability for the current PLMN or SNPN if the UE does not have an allowed NSSAI and each S-NSSAI in the configured NSSAI, if available, was rejected with cause "S-NSSAI not available in the current PLMN or SNPN" or "S-NSSAI not available due to the failed or revoked network slice-specific authentication and authorization" as described in clause 4.9.

If the UE has neither allowed NSSAI for the current PLMN or SNPN nor configured NSSAI for the current PLMN or SNPN and,

if at least one S-NSSAI in the default configured NSSAI is not rejected, the UE may stay in the current serving cell, apply the normal cell reselection process, and start an initial registration with a requested NSSAI with that default configured NSSAI; or
if all the S-NSSAI(s) in the default configured NSSAI are rejected and at least one S-NSSAI is rejected due to "S-NSSAI not available in the current registration area",

if the REGISTRATION REJECT message is integrity protected and the UE is not operating in SNPN access operation mode, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE. The UE shall search for a suitable cell in another tracking area according to 3GPP TS 38.304 [28] or 3GPP TS 36.304 [25C]; or
if the REGISTRATION REJECT message is integrity protected and the UE is operating in SNPN access operation mode, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, the selected entry of the "list of subscriber data" or the selected PLMN subscription, and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE. The UE shall search for a suitable cell in another tracking area according to 3GPP TS 38.304 [28] or 3GPP TS 36.304 [25C].

otherwise, the UE may perform a PLMN selection or SNPN selection according to 3GPP TS 23.122 [5] and additionally, the UE may disable the N1 mode capability for the current PLMN or SNPN if each S-NSSAI in the default configured NSSAI was rejected with cause "S-NSSAI not available in the current PLMN or SNPN" or "S-NSSAI not available due to the failed or revoked network slice-specific authentication and authorization" as described in clause 4.9.

the UE has allowed NSSAI for the current PLMN or SNPN or configured NSSAI for the current PLMN or SNPN or both and all the S-NSSAIs included in the allowed NSSAI or the configured NSSAI or both are rejected; or
the UE has neither allowed NSSAI for the current PLMN or SNPN nor configured NSSAI for the current PLMN or SNPN and all the S-NSSAIs included in the default configured NSSAI are rejected,

and the UE has rejected NSSAI for the maximum number of UEs reached, and the UE wants to obtain services in the current serving cell without performing a PLMN selection or SNPN selection, the UE may stay in the current serving cell and attempt to use the rejected S-NSSAI(s) for the maximum number of UEs reached in the current serving cell after the rejected S-NSSAI(s) are removed as described in clause 4.6.2.2.

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall in addition set the EPS update status to EU2 NOT UPDATED, reset the attach attempt counter and enter the state EMM-DEREGISTERED.

#72 (Non-3GPP access to 5GCN not allowed).

When received over non-3GPP access the UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall delete last visited registered TAI and TAI list. If the UE is not registering or has not registered to the same PLMN over 3GPP access, the UE shall additionally delete 5G-GUTI and ngKSI. Additionally, the UE shall reset the registration attempt counter and enter the state 5GMM-DEREGISTERED. If the message has been successfully integrity checked by the NAS, the UE shall set:

the PLMN-specific N1 mode attempt counter for non-3GPP access for that PLMN in case of PLMN: or
the SNPN-specific attempt counter for non-3GPP access for that SNPN in case of SNPN;

to the UE implementation-specific maximum value.

NOTE 7: The 5GMM sublayer states, the 5GMM parameters and the registration status are managed per access type independently, i.e. 3GPP access or non-3GPP access (see clauses 4.7.2 and 5.1.3).

The UE shall disable the N1 mode capability for non-3GPP access (see clause 4.9.3).

As an implementation option, the UE may enter the state 5GMM-DEREGISTERED.PLMN-SEARCH in order to perform a PLMN selection according to 3GPP TS 23.122 [5].

If received over 3GPP access the cause shall be considered as an abnormal case and the behaviour of the UE for this case is specified in clause 5.5.1.2.7.

#73 (Serving network not authorized).

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. The UE shall delete the list of equivalent PLMNs, reset the registration attempt counter, store the PLMN identity in the forbidden PLMN list as specified in clause 5.3.13A. For 3GPP access the UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH in order to perform a PLMN selection according to 3GPP TS 23.122 [5], and for non-3GPP access the UE shall enter state 5GMM-DEREGISTERED.LIMITED-SERVICE and perform network selection as defined in 3GPP TS 24.502 [18]. If the message has been successfully integrity checked by the NAS, the UE shall set the PLMN-specific attempt counter and the PLMN-specific attempt counter for non-3GPP access for that PLMN to the UE implementation-specific maximum value.

#74 (Temporarily not authorized for this SNPN).

5GMM cause #74 is only applicable when received from a cell belonging to an SNPN and the UE is operating in SNPN access operation mode. 5GMM cause #74 received from a cell not belonging to an SNPN is considered as an abnormal case and the behaviour of the UE is specified in clause 5.5.1.2.7.

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list, ngKSI and the list of equivalent SNPNs (if available). The UE shall reset the registration attempt counter and store the SNPN identity in the "temporarily forbidden SNPNs" list or "temporarily forbidden SNPNs for access for localized services in SNPN" list if the SNPN is an SNPN selected for localized services in SNPN (see 3GPP TS 23.122 [5]) for the specific access type for which the message was received and the selected entry of the "list of subscriber data" or the selected PLMN subscription or in the "temporarily forbidden SNPNs for onboarding services in SNPN" list, if the UE is performing initial registration for onboarding services in SNPN, for the specific access type for which the message was received. If the UE supports access to an SNPN using credentials from a credentials holder, the UE shall store the SNPN identity in the "temporarily forbidden SNPNs" list along with the GIN(s) broadcasted by the SNPN if any, for the selected entry of the "list of subscriber data" or the selected PLMN subscription. If the UE supports access to an SNPN providing access for localized services in SNPN and the access for localized services in SNPN has been enabled, the UE shall store the SNPN identity in the list of "temporarily forbidden SNPNs for access for localized services in SNPN" (if the SNPN is an SNPN selected for localized services in SNPN (see 3GPP TS 23.122 [5]) along with the GIN(s) broadcasted by the SNPN if any, for the selected entry of the "list of subscriber data" or the selected PLMN subscription. If the registration request is not for onboarding services in SNPN, for 3GPP access the UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform an SNPN selection according to 3GPP TS 23.122 [5] and for non-3GPP access the UE shall enter state 5GMM-DEREGISTERED.LIMITED-SERVICE and perform network selection as defined in 3GPP TS 24.502 [18]. If the registration request is for onboarding services in SNPN, the UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform an SNPN selection or an SNPN selection for onboarding services according to 3GPP TS 23.122 [5]. If the message has been successfully integrity checked by the NAS, the UE shall set the SNPN-specific attempt counter for 3GPP access and the SNPN-specific attempt counter for non-3GPP access for the current SNPN to the UE implementation-specific maximum value.

If the message has been successfully integrity checked by the NAS and the UE also supports the registration procedure over the other access to the same SNPN, the UE shall in addition handle 5GMM parameters and 5GMM state for this access, as described for this 5GMM cause value.

#75 (Permanently not authorized for this SNPN).

5GMM cause #75 is only applicable when received from a cell belonging to an SNPN with a globally-unique SNPN identity and the UE is operating in SNPN access operation mode. 5GMM cause #75 received from a cell not belonging to an SNPN or a cell belonging to an SNPN with a non-globally-unique SNPN identity is considered as an abnormal case and the behaviour of the UE is specified in clause 5.5.1.2.7.

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list ngKSI and the list of equivalent SNPNs (if available). The UE shall reset the registration attempt counter and store the SNPN identity in the "permanently forbidden SNPNs" list or "permanently forbidden SNPNs for access for localized services in SNPN" list if the SNPN is an SNPN selected for localized services in SNPN (see 3GPP TS 23.122 [5]) for the specific access type for which the message was received and the selected entry of the "list of subscriber data" or the selected PLMN subscription, or in the "permanently forbidden SNPNs for onboarding services in SNPN" list, if the UE is performing initial registration for onboarding services in SNPN, for the specific access type for which the message was received. If the UE supports access to an SNPN using credentials from a credentials holder, the UE shall store the SNPN identity in the "permanently forbidden SNPNs" list along with the GIN(s) broadcasted by the SNPN if any, for the selected entry of the "list of subscriber data" or the selected PLMN subscription. If the UE supports access to an SNPN providing access for localized services in SNPN and the access for localized services in SNPN has been enabled, the UE shall store the SNPN identity in the list of "permanently forbidden SNPNs for access for localized services in SNPN" (if the SNPN is an SNPN selected for localized services in SNPN (see 3GPP TS 23.122 [5]) along with the GIN(s) broadcasted by the SNPN if any, for the selected entry of the "list of subscriber data" or the selected PLMN subscription. If the registration request is not for onboarding services in SNPN, for 3GPP access the UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform an SNPN selection according to 3GPP TS 23.122 [5] and for non-3GPP access the UE shall enter state 5GMM-DEREGISTERED.LIMITED-SERVICE and perform network selection as defined in 3GPP TS 24.502 [18]. If the registration request is for onboarding services in SNPN, the UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform an SNPN selection or an SNPN selection for onboarding services according to 3GPP TS 23.122 [5]. If the message has been successfully integrity checked by the NAS, the UE shall set the SNPN-specific attempt counter for 3GPP access and the SNPN-specific attempt counter for non-3GPP access for the current SNPN to the UE implementation-specific maximum val If the message has been successfully integrity checked by the NAS and the UE also supports the registration procedure over the other access to the same SNPN, the UE shall in addition handle 5GMM parameters and 5GMM state for this access, as described for this 5GMM cause value.

#76 (Not authorized for this CAG or authorized for CAG cells only).

This cause value received via non-3GPP access or from a cell belonging to an SNPN and the UE is operating in SNPN access operation mode is considered as an abnormal case and the behaviour of the UE is specified in clause 5.5.1.2.7.

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED, store the 5GS update status according to clause 5.1.3.2.2, and reset the registration attempt counter.

If 5GMM cause #76 is received from:

a CAG cell, and if the UE receives a "CAG information list" in the CAG information list IE or the Extended CAG information list IE included in the REGISTRATION REJECT message, the UE shall:

replace the "CAG information list" stored in the UE with the received CAG information list IE or the Extended CAG information list IE when received in the HPLMN or EHPLMN;
replace the serving VPLMN's entry of the "CAG information list" stored in the UE with the serving VPLMN's entry of the received CAG information list IE or the Extended CAG information list IE when the UE receives the CAG information list IE or the Extended CAG information list IE in a serving PLMN other than the HPLMN or EHPLMN; or

NOTE 8: When the UE receives the CAG information list IE or the Extended CAG information list IE in a serving PLMN other than the HPLMN or EHPLMN, entries of a PLMN other than the serving VPLMN, if any, in the received CAG information list IE or the Extended CAG information list IE are ignored.

iii) remove the serving VPLMN's entry of the "CAG information list" stored in the UE when the UE receives the CAG information list IE or the Extended CAG information list IE in a serving PLMN other than the HPLMN or EHPLMN and the CAG information list IE or the Extended CAG information list IE does not contain the serving VPLMN's entry.

Otherwise, then the UE shall delete the CAG-ID(s) of the cell from the "allowed CAG list" for the current PLMN, if the CAG-ID(s) are authorized based on the "allowed CAG list". In the case the "allowed CAG list" for the current PLMN only contains a range of CAG-IDs, how the UE deletes the CAG-ID(s) of the cell from the "allowed CAG list" for the current PLMN is up to UE implementation. In addition:

if the entry in the "CAG information list" for the current PLMN does not include an "indication that the UE is only allowed to access 5GS via CAG cells" or if the entry in the "CAG information list" for the current PLMN includes an "indication that the UE is only allowed to access 5GS via CAG cells" and one or more CAG-ID(s) are authorized based on the updated "allowed CAG list" for the current PLMN, then the UE shall enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE and shall search for a suitable cell according to 3GPP TS 38.304 [28] or 3GPP TS 36.304 [25C] with the updated "CAG information list";
if the entry in the "CAG information list" for the current PLMN includes an "indication that the UE is only allowed to access 5GS via CAG cells" and no CAG-ID is authorized based on the updated "allowed CAG list" for the current PLMN, then the UE shall enter the state 5GMM-DEREGISTERED.PLMN-SEARCH and shall apply the PLMN selection process defined in 3GPP TS 23.122 [5] with the updated "CAG information list"; or

iii) if the "CAG information list" does not include an entry for the current PLMN, then the UE shall enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE and shall search for a suitable cell according to 3GPP TS 38.304 [28] or 3GPP TS 36.304 [25C] with the updated "CAG information list".

a non-CAG cell, and if the UE receives a "CAG information list" in the CAG information list IE or the Extended CAG information list IE included in the REGISTRATION REJECT message, the UE shall:

replace the "CAG information list" stored in the UE with the received CAG information list IE or the Extended CAG information list IE when received in the HPLMN or EHPLMN;
replace the serving VPLMN's entry of the "CAG information list" stored in the UE with the serving VPLMN's entry of the received CAG information list IE or the Extended CAG information list IE when the UE receives the CAG information list IE or the Extended CAG information list IE in a serving PLMN other than the HPLMN or EHPLMN; or

NOTE 9: When the UE receives the CAG information list IE or the Extended CAG information list IE in a serving PLMN other than the HPLMN or EHPLMN, entries of a PLMN other than the serving VPLMN, if any, in the received CAG information list IE or the Extended CAG information list IE are ignored.

Otherwise, the UE shall store an "indication that the UE is only allowed to access 5GS via CAG cells" in the entry of the "CAG information list" for the current PLMN, if any. If the "CAG information list" stored in the UE does not include the current PLMN's entry, the UE shall add an entry for the current PLMN to the "CAG information list" and store an "indication that the UE is only allowed to access 5GS via CAG cells" in the entry of the "CAG information list" for the current PLMN. If the UE does not have a stored "CAG information list", the UE shall create a new "CAG information list" and add an entry with an "indication that the UE is only allowed to access 5GS via CAG cells" for the current PLMN.

In addition:

if one or more CAG-ID(s) are authorized based on the "allowed CAG list" for the current PLMN, then the UE shall enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE and shall search for a suitable cell according to 3GPP TS 38.304 [28] with the updated CAG information; or
if no CAG-ID is authorized based on the "allowed CAG list" for the current PLMN, then the UE shall enter the state 5GMM-DEREGISTERED.PLMN-SEARCH and shall apply the PLMN selection process defined in 3GPP TS 23.122 [5] with the updated "CAG information list".

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall in addition set the EPS update status to EU3 ROAMING NOT ALLOWED, reset the attach attempt counter and enter the state EMM-DEREGISTERED.

#77 (Wireline access area not allowed).

5GMM cause #77 is only applicable when received from a wireline access network by the 5G-RG or the W-AGF acting on behalf of the FN-CRG. 5GMM cause #77 received from a 5G access network other than a wireline access network and 5GMM cause #77 received by the W-AGF acting on behalf of the FN-BRG are considered as abnormal cases and the behaviour of the UE is specified in clause 5.5.1.2.7.

When received over wireline access network, the 5G-RG and the W-AGF acting on behalf of the FN-CRG shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2), shall delete 5G-GUTI, last visited registered TAI, TAI list and ngKSI, shall reset the registration attempt counter, shall enter the state 5GMM-DEREGISTERED and shall act as specified in clause 5.3.23.

NOTE 10: The 5GMM sublayer states, the 5GMM parameters and the registration status are managed per access type independently, i.e. 3GPP access or non-3GPP access (see clauses 4.7.2 and 5.1.3).

#78 (PLMN not allowed to operate at the present UE location).

If this cause value is received from a cell which is not deployed in a 5G PLMN/access technology combination with specific satellite features, it shall be considered as an abnormal case and the behaviour of the UE is specified in clause 5.5.1.2.7.

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall delete last visited registered TAI and TAI list. If the UE is not registering or has not registered to the same PLMN over non-3GPP access, the UE shall additionally delete the list of equivalent PLMNs, 5G-GUTI and ngKSI. Additionally, the UE shall reset the registration attempt counter. The UE shall store:

for satellite NG-RAN access, the PLMN identity and, if it is known, the current geographical location in the list of "PLMNs not allowed to operate at the present UE location"; or
for NG-RAN access, the PLMN/access technology combination and, if it is known, the current geographical location in the list of "LSP PLMNs not allowed to operate at the present UE location",

and shall start a corresponding timer instance (see clause 4.23.2). The UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform a PLMN selection according to 3GPP TS 23.122 [5].

#79 (UAS services not allowed).

This cause value received when the UE did not include the service-level device ID set to the CAA-level UAV ID in the Service-level-AA container IE of REGISTRATION REQUEST message is considered as an abnormal case and the behaviour of the UE is specified in clause 5.5.1.2.7.

The UE shall abort the initial registration procedure, set the 5GS update status to 5U2 NOT UPDATED and enter state 5GMM-DEREGISTERED. ATTEMPTING-REGISTRATION or 5GMM-DEREGISTERED.PLMN-SEARCH. Additionally, the UE shall reset the registration attempt counter. If the UE re-attempt the registration procedure to the current PLMN, the UE shall not include the service-level device ID set to the CAA-level UAV ID in the Service-level-AA container IE of REGISTRATION REQUEST message unless the UE receives a CONFIGURATION UPDATE COMMAND message including the service-level-AA service status indication in the Service-level-AA container IE with the UAS field set to "UAS services enabled".

#80 (Disaster roaming for the determined PLMN with disaster condition not allowed).

This cause value received via non-3GPP access or from a cell belonging to an SNPN and the UE is operating in SNPN access operation mode or when the UE did not indicate "disaster roaming initial registration" in the 5GS registration type IE in the REGISTRATION REQUEST message is considered as an abnormal case and the behaviour of the UE is specified in clause 5.5.1.2.7.

The UE shall abort the initial registration procedure, set the 5GS update status to 5U2 NOT UPDATED, enter state 5GMM-DEREGISTERED. PLMN-SEARCH and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. Additionally, the UE shall reset the registration attempt counter. The UE shall not attempt to register for disaster roaming services on this PLMN for the UE determined PLMN with disaster condition for a period in the range of 12 to 24 hours. The UE shall not attempt to register for disaster roaming services on this PLMN for a period in the range of 3 to 10 minutes. The UE shall perform PLMN selection as described in 3GPP TS 23.122 [5]. If the message has been successfully integrity checked by the NAS and the UE maintains the PLMN-specific attempt counter of the PLMN which sent the reject message for the UE determined PLMN with disaster condition, the UE shall set the PLMN-specific attempt counter of the PLMN which sent the reject message for the UE determined PLMN with disaster condition to the UE implementation-specific maximum value.

If the UE had attempted for disaster roaming service on the current TAI by deleting it from the list of "5GS forbidden tracking areas for roaming", or the list of "5GS forbidden tracking areas for regional provision of service" of allowable PLMN as specified in 3GPP TS 23.122 [5], the UE shall add the current TAI to corresponding list.

#81 (Selected N3IWF is not compatible with the allowed NSSAI).

This cause value received when the UE does not access 5GCN over non-3GPP access using the N3IWF or has not indicated support for slice-based N3IWF selection in the REGISTRATION REQUEST message is considered as an abnormal case and the behaviour of the UE is specified in clause 5.5.1.2.7.

The UE shall abort the initial registration procedure, set the 5GS update status to 5U2 NOT UPDATED and enter state 5GMM-DEREGISTERED. ATTEMPTING-REGISTRATION or 5GMM-DEREGISTERED.PLMN-SEARCH. Additionally, the UE shall reset the registration attempt counter. If the N3IWF identifier IE is included in the REGISTRATION REJECT message and the UE supports slice-based N3IWF selection, the UE may use the provided N3IWF identifier IE in N3IWF selection as specified in 3GPP TS 24.502 [18] prior to an immediate consecutive initial registration attempt to the network, otherwise the UE shall ignore the N3IWF identifier IE. Additionally, if the UE selects a new N3IWF and a new initial registration attempt is performed, the UE shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI.

#82 (Selected TNGF is not compatible with the allowed NSSAI).

This cause value received when the UE does not access 5GCN over non-3GPP access using the TNGF or has not indicated support for slice-based TNGF selection in the REGISTRATION REQUEST message is considered as an abnormal case and the behaviour of the UE is specified in clause 5.5.1.2.7.

The UE shall abort the initial registration procedure, set the 5GS update status to 5U2 NOT UPDATED and enter state 5GMM-DEREGISTERED. ATTEMPTING-REGISTRATION or 5GMM-DEREGISTERED.PLMN-SEARCH. Additionally, the UE shall reset the registration attempt counter. If the TNAN information IE is included in the REGISTRATION REJECT message and the UE supports slice-based TNGF selection, the UE may use the provided TNAN information IE in TNAN selection as specified in 3GPP TS 24.502 [18] prior to an immediate consecutive registration attempt to the network, otherwise the UE shall ignore the TNAN information IE. Additionally, if the UE selects a new TNAN and a new initial registration attempt is performed, the UE shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI.

Other values are considered as abnormal cases. The behaviour of the UE in those cases is specified in clause 5.5.1.2.7.