3GPP 24.501 v20.0.0 — the document's own text

5.6.1.5 Service request procedure not accepted by the network

Taught in 4. Inside TS 24.501, the document at the centre (CT1 — the group that writes what your phone says, overview).

If the service request cannot be accepted, the network shall return a SERVICE REJECT message to the UE including an appropriate 5GMM cause value.

If the SERVICE REJECT message with 5GMM cause #76 or #78 was received without integrity protection, then the UE shall discard the message.

If the AMF needs to initiate PDU session status synchronisation or a PDU session status IE was included in the SERVICE REQUEST message, the AMF shall include a PDU session status IE in the SERVICE REJECT message to indicate which PDU sessions associated with the access type the SERVICE REJECT message is sent over are active in the AMF. If the PDU session status IE is included in the SERVICE REJECT message and if the message is integrity protected, then:

for single access PDU sessions, the UE shall perform a local release of all those PDU sessions which are not in 5GSM state PDU SESSION INACTIVE or PDU SESSION ACTIVE PENDING on the UE side associated with the access type the SERVICE REJECT message is sent over, but are indicated by the AMF as being in 5GSM state PDU SESSION INACTIVE. If a locally released PDU session is associated with one or more MBS sessions, the UE shall locally leave the associated MBS multicast sessions; and
for MA PDU sessions, for all those PDU sessions which are not in 5GSM state PDU SESSION INACTIVE or PDU SESSION ACTIVE PENDING and have user plane resources established on the UE side associated with the access the SERVICE REJECT message is sent over, but are indicated by the AMF as no user plane resources established:

for MA PDU sessions having user plane resources established only on the access type the SERVICE REJECT message is sent over, the UE shall perform a local release of those MA PDU sessions. If a locally released PDU session is associated with one or more MBS sessions, the UE shall locally leave the associated MBS multicast sessions; and
for MA PDU sessions having user plane resources established on both accesses, the UE shall perform a local release on the user plane resources on the access type the SERVICE REJECT message is sent over. If a locally released PDU session is associated with one or more MBS sessions, the UE shall locally leave the associated MBS multicast sessions.

If the service request for mobile originated services is rejected due to general NAS level mobility management congestion control, the network shall set the 5GMM cause value to #22 "congestion" and assign a value for back-off timer T3346.

If the service request for mobile originated services is rejected due to general NAS level mobility management congestion control for the SNPN selected for localized services in SNPN (see 3GPP TS 23.122 [5]), the network may set an appropriate cause value other than 5GMM cause value to #22 "congestion" and does not assign a value for back-off timer T3346.

In NB-N1 mode, if the service request for mobile originated services is rejected due to operator determined barring (see 3GPP TS 29.503 [20AB]), the network shall set the 5GMM cause value to #22 "congestion" and assign a value for back-off timer T3346.

If the service request from a UE supporting CAG is rejected due to CAG restrictions, the network shall set the 5GMM cause value to #76 "Not authorized for this CAG or authorized for CAG cells only" and should include the "CAG information list" in the CAG information list IE or the Extended CAG information list IE in the SERVICE REJECT message.

NOTE 1: The network cannot be certain that "CAG information list" stored in the UE is updated as result of sending of the SERVICE REJECT message with the CAG information list IE or the Extended CAG information list IE, as the SERVICE REJECT message is not necessarily delivered to the UE (e.g. due to abnormal radio conditions).

NOTE 2: The "CAG information list" can be provided by the AMF and include no entry if no "CAG information list" exists in the subscription.

NOTE 2A: If the UE supports extended CAG information list, the CAG information list can be included either in the CAG information list IE or Extended CAG information list IE.

NOTE 2B: It is unexpected for network to send REGISTRATION REJECT message to the UE with 5GMM cause value #76 in non-CAG cell and not indicate "Indication that the UE is only allowed to access 5GS via CAG cells" for the serving PLMN in the Extended CAG information list or the CAG information list.

If the UE does not support extended CAG information list, the CAG information list shall not be included in the Extended CAG information list IE.

If the service request from a UE not supporting CAG is rejected due to CAG restrictions, the network shall operate as described in bullet h) of clause 5.6.1.8.

Upon receipt of the CONTROL PLANE SERVICE REQUEST message with uplink data:

if the AMF decides to not forward the uplink data piggybacked in the CONTROL PLANE SERVICE REQUEST message; and
if the AMF decides to activate the congestion control for transport of user data via the control plane,

then the AMF shall send a SERVICE REJECT message and set the 5GMM cause value to #22 "congestion" and assign a value for control plane data back-off timer T3448.

If the AMF determines that the UE is in a non-allowed area or is not in an allowed area as specified in clause 5.3.5, then:

if the service type IE in the SERVICE REQUEST message is set to "high priority access" and service area restrictions are applicable for high priority access based on operator policy, or set to "signalling" or "data", the AMF shall send a SERVICE REJECT message with the 5GMM cause value set to #28 "Restricted service area";
otherwise, if the service type IE in the SERVICE REQUEST message is set to "high priority access" and service area restrictions are not applicable for high priority access based on operator policy, or set to "mobile terminated services", "emergency services", "emergency services fallback" or "elevated signalling", the AMF shall continue the process as specified in clause 5.6.1.4 unless for other reasons the service request cannot be accepted.

If the service request for mobile originated services is rejected due to service gap control as specified in clause 5.3.17, i.e. the T3447 timer is running in AMF, the network shall set the 5GMM cause value to #22 "Congestion" and may include T3346 value IE in the SERVICE REJECT message set to the remaining time of the running T3447 timer.

Based on operator policy, if the service request procedure is rejected due to core network redirection for CIoT optimizations, the network shall set the 5GMM cause value to #31 "Redirection to EPC required".

NOTE 3: The network can take into account the UE's S1 mode capability, the EPS CIoT network behaviour supported by the UE or the EPS CIoT network behaviour supported by the EPC to determine the rejection with the 5GMM cause value #31 "Redirection to EPC required".

If the service request is via:

a satellite NG-RAN cell; or
a non-satellite NG-RAN cell where the PLMN supports selected features that are normally applied in the satellite access and the UE has indicated NonSATLSP supported,

and the network determines that the UE is in a location where the network is not allowed to operate, see 3GPP TS 23.502 [9], the network shall set the 5GMM cause value in the SERVICE REJECT message to #78 "PLMN not allowed to operate at the present UE location".

NOTE 3A: While location determination is ongoing to ensure that operator and regulatory policies are met, the AMF can perform DNN-based or S-NSSAI based congestion control as specified in clauses 5.3.10 and 5.3.11 to prevent the UE from accessing network.

If the service request from a UE supporting MINT is rejected due to a disaster condition no longer being applicable in the current location of the UE, the network shall set the 5GMM cause value to #11 "PLMN not allowed", if the PLMN is a forbidden PLMN of the UE, or #13 "Roaming not allowed in this tracking area" and may include a disaster return wait range in the Disaster return wait range IE in the SERVICE REJECT message.

On receipt of the SERVICE REJECT message, if the UE is in state 5GMM-SERVICE-REQUEST-INITIATED, the UE shall reset the service request attempt counter and stop timer T3517 if running.

the UE indicated support of the access technology utilization control;

1a) the UE is not registered for disaster roaming services;

the network determines to apply the access technology utilization control control based on the operator policy; and
the secure exchange of NAS messages via an N1 NAS signalling connection is established between the UE and the AMF;

the AMF shall send the integrity protected SERVICE REJECT message with the 5GMM cause value set to #15 "No suitable cells in tracking area" and include the Access technology utilization control IE. In the Access technology utilization control IE, the AMF shall indicate that the access technology of the NG-RAN cell on which the SERVICE REQUEST message was received is restricted.

NOTE 3B: Other restricted access technologies can be indicated in the Access technology utilization control IE, if any.

If the AMF received multiple TAIs from the satellite NG-RAN as described in 3GPP TS 23.501 [8], and determines that, by UE subscription and operator's preferences, all of the received TAIs are forbidden, for roaming or for regional provision of service, the AMF shall include the TAI(s) in:

the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for roaming" IE; or
the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for regional provision of service" IE; or
both;

in the SERVICE REJECT message.

Regardless of the 5GMM cause value received in the SERVICE REJECT message via satellite NG-RAN,

if the UE receives the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for roaming" IE and the Access technology utilization control IE is not included in the SERVICE REJECT message, the UE shall store the TAI(s) belonging to the serving PLMN or equivalent PLMN(s) and ignore the TAI(s) which do not belong to the serving PLMN or equivalent PLMN(s) included in the IE, if not already stored, into the list of "5GS forbidden tracking areas for roaming"; and
if the UE receives the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for regional provision of service" IE in the SERVICE REJECT message, the UE shall store the TAI(s) belonging to the serving PLMN or equivalent PLMN(s) and ignore the TAI(s) which do not belong to the serving PLMN or equivalent PLMN(s) included in the IE, if not already stored, into the list of "5GS forbidden tracking areas for regional provision of service".

Furthermore, the UE shall take the following actions depending on the 5GMM cause value received in the SERVICE REJECT message.

#3 (Illegal UE);

#6 (Illegal ME);

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI.

In case of PLMN, the UE shall consider the USIM as invalid for 5GS services until switching off, the UICC containing the USIM is removed or the timer T3245 expires as described in clause 5.3.19A.1;

In case of SNPN, if the UE is not registered for onboarding services in SNPN and the UE does not support access to an SNPN using credentials from a credentials holder and does not support equivalent SNPNs, the UE shall consider the selected entry of the "list of subscriber data" with the SNPN identity of the current SNPN as invalid until the UE is switched off, the entry is updated or the timer T3245 expires as described in clause 5.3.19A.2. In case of SNPN, if the UE is not registered for onboarding services in SNPN and the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs, or both, the UE shall consider the selected entry of the "list of subscriber data" as invalid for 3GPP access until the UE is switched off, the entry is updated or the timer T3245 expires as described in clause 5.3.19A.2. Additionally, if EAP based primary authentication and key agreement procedure using EAP-AKA' or 5G AKA based primary authentication and key agreement procedure was performed in the current SNPN, the UE shall consider the USIM as invalid for the current SNPN until switching off, the UICC containing the USIM is removed or the timer T3245 expires as described in clause 5.3.19A.2.

If the UE is not registered for onboarding services in SNPN, the UE shall delete the list of equivalent PLMNs (if any) or the list of equivalent SNPNs (if any), and shall enter the state 5GMM-DEREGISTERED.NO-SUPI. If the message has been successfully integrity checked by the NAS, then the UE shall:

set the counter for "SIM/USIM considered invalid for GPRS services" events and the counter for "USIM considered invalid for 5GS services over non-3GPP access" events to UE implementation-specific maximum value in case of PLMN if the UE maintains these counters; or
set the counter for "the entry for the current SNPN considered invalid for 3GPP access" events and the counter for "the entry for the current SNPN considered invalid for non-3GPP access" events to UE implementation-specific maximum value in case of SNPN if the UE maintains these counters.

If the message was received via 3GPP access and the UE is operating in the single-registration mode, the UE shall handle the EMM parameters EMM state, EPS update status, 4G-GUTI, last visited registered TAI, TAI list and eKSI as specified in 3GPP TS 24.301 [15] for the case when the service request procedure is rejected with the EMM cause with the same value. The USIM shall be considered as invalid also for non-EPS services until switching off, the UICC containing the USIM is removed or the timer T3245 expires as described in clause 5.3.7a in 3GPP TS 24.301 [15]. If the message has been successfully integrity checked by the NAS and the UE maintains a counter for "SIM/USIM considered invalid for non-GPRS services", then the UE shall set this counter to UE implementation-specific maximum value.

If the UE is registered for onboarding services in SNPN, the UE shall store the SNPN identity in the "permanently forbidden SNPNs for onboarding services in SNPN" list, enter state 5GMM-DEREGISTERED.PLMN-SEARCH, and perform an SNPN selection or an SNPN selection for onboarding services according to 3GPP TS 23.122 [5]. If the message has been successfully integrity checked by the NAS, the UE shall set the SNPN-specific attempt counter to the UE implementation-specific maximum value.

If the message has been successfully integrity checked by the NAS and the UE also supports the registration procedure over the other access, the UE shall in addition handle 5GMM parameters and 5GMM state for this access, as described for this 5GMM cause value.

#7 (5GS services not allowed).

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI.

In case of PLMN, the UE shall consider the USIM as invalid for 5GS services until switching off, the UICC containing the USIM is removed or the timer T3245 expires as described in clause 5.3.19A.1;

In case of SNPN, if the UE is not registered for onboarding services in SNPN and the UE does not support access to an SNPN using credentials from a credentials holder and does not support equivalent SNPNs, the UE shall consider the selected entry of the "list of subscriber data" with the SNPN identity of the current SNPN as invalid for 5GS services until the UE is switched off, the entry is updated or the timer T3245 expires as described in clause 5.3.19A.2. In case of SNPN, if the UE is not registered for onboarding services in SNPN and the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs, or both, the UE shall consider the selected entry of the "list of subscriber data" as invalid for 3GPP access until the UE is switched off, the entry is updated or the timer T3245 expires as described in clause 5.3.19A.2. Additionally, if EAP based primary authentication and key agreement procedure using EAP-AKA' or 5G AKA based primary authentication and key agreement procedure was performed in the current SNPN, the UE shall consider the USIM as invalid for the current SNPN until switching off, the UICC containing the USIM is removed or the timer T3245 expires as described in clause 5.3.19A.2.

If the UE is not registered for onboarding services in SNPN, the UE shall enter the state 5GMM-DEREGISTERED.NO-SUPI. If the message has been successfully integrity checked by the NAS, then the UE shall:

set the counter for "SIM/USIM considered invalid for GPRS services" events and the counter for "USIM considered invalid for 5GS services over non-3GPP access" events to UE implementation-specific maximum value in case of PLMN if the UE maintains these counters; or
set the counter for "the entry for the current SNPN considered invalid for 3GPP access" events and the counter for "the entry for the current SNPN considered invalid for non-3GPP access" events to UE implementation-specific maximum value in case of SNPN if the UE maintains these counters.

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall handle the EMM parameters EMM state, EPS update status, 4G-GUTI, last visited registered TAI, TAI list and eKSI as specified in 3GPP TS 24.301 [15] for the case when the service request procedure is rejected with the EMM cause with the same value.

NOTE 4: The possibility to configure a UE so that the radio transceiver for a specific radio access technology is not active, although it is implemented in the UE, is outside the scope of the present document.

#9 (UE identity cannot be derived by the network).

The UE shall set the 5GS update status to 5U2 NOT UPDATED (and shall store it according to clause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. The UE shall enter the state 5GMM-DEREGISTERED.

If the service request was initiated for emergency services fallback, the UE shall attempt to select an E-UTRA cell connected to EPC or 5GCN according to the domain priority and selection rules specified in 3GPP TS 23.167 [6]. If the UE finds a suitable E-UTRA cell, it then proceeds with the appropriate EMM or 5GMM procedures. If the UE operating in single-registration mode has changed to S1 mode, it shall disable the N1 mode capability for 3GPP access.

If the service request was initiated for any reason other than emergency services fallback or initiating an emergency PDU session, the UE shall perform a new initial registration procedure.

NOTE 5: User interaction is necessary in some cases when the UE cannot re-establish the PDU session(s) automatically.

#10 (Implicitly de-registered).

The UE shall enter the state 5GMM-DEREGISTERED.NORMAL-SERVICE. The UE shall delete any mapped 5G NAS security context or partial native 5G NAS security context.

If the rejected request was neither for initiating an emergency PDU session nor for emergency services fallback, the UE shall perform a new initial registration procedure.

NOTE 6: User interaction is necessary in some cases when the UE cannot re-establish the PDU session(s) automatically.

If the message was received via 3GPP access and the UE is operating in the single-registration mode, the UE shall handle the EMM state as specified in 3GPP TS 24.301 [15] for the case when the service request procedure is rejected with the EMM cause with the same value.

#11 (PLMN not allowed).

This cause value received from a cell belonging to an SNPN and the UE is operating in SNPN access operation mode is considered as an abnormal case and the behaviour of the UE is specified in clause 5.6.1.7.

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. The UE shall delete the list of equivalent PLMNs and store the PLMN identity in the forbidden PLMN list as specified in clause 5.3.13A and if the UE is configured to use timer T3245 then the UE shall start timer T3245 and proceed as described in clause 5.3.19A.1. For 3GPP access, the UE shall enter the state 5GMM-DEREGISTERED.PLMN-SEARCH and perform a PLMN selection according to 3GPP TS 23.122 [5], and for non-3GPP access the UE shall enter state 5GMM-DEREGISTERED.LIMITED-SERVICE and perform network selection as defined in 3GPP TS 24.502 [18]. If the message has been successfully integrity checked by the NAS and the UE mantains the PLMN-specific attempt counter and the PLMN-specific attempt counter for non-3GPP access for that PLMN, the UE shall set the PLMN-specific attempt counter and the PLMN-specific attempt counter for non-3GPP access for that PLMN to the UE implementation-specific maximum value.

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall in addition handle the EMM parameters EMM state, EPS update status, 4G-GUTI, last visited registered TAI, TAI list and eKSI as specified in 3GPP TS 24.301 [15] for the case when the service request procedure is rejected with the EMM cause with the same value.

If the message has been successfully integrity checked by the NAS and the UE also supports the registration procedure over the other access to the same PLMN, the UE shall in addition handle 5GMM parameters and 5GMM state for this access, as described for this 5GMM cause value.

If the UE receives the Disaster return wait range IE in the SERVICE REJECT message and the UE supports MINT, the UE shall delete the disaster return wait range stored in the ME, if any, and store the disaster return wait range included in the Disaster return wait range IE in the ME.

#12 (Tracking area not allowed).

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall delete last visited registered TAI and TAI list. If the UE is not registering or has not registered to the same PLMN over both 3GPP access and non-3GPP access, the UE shall additionally delete 5G-GUTI and ngKSI.

If:

the UE is not operating in SNPN access operation mode, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for regional provision of service" and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE. If the SERVICE REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for regional provision of service" for non-integrity protected NAS reject message; or
the UE is operating in SNPN access operation mode, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for regional provision of service" for the current SNPN and the selected entry of the "list of subscriber data" or the selected PLMN subscription, and enter the state 5GMM-DEREGISTERED.LIMITED-SERVICE. If the SERVICE REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for regional provision of service" for the current SNPN and the selected entry of the "list of subscriber data" or the selected PLMN subscription, for non-integrity protected NAS reject message.

#13 (Roaming not allowed in this tracking area).

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2). For 3GPP access the UE shall enter the state 5GMM-REGISTERED.PLMN-SEARCH, and for non-3GPP access the UE shall enter the state 5GMM-REGISTERED.LIMITED-SERVICE.

If:

the UE is not operating in SNPN access operation mode, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" and remove the current TAI from the stored TAI list if present. If the SERVICE REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for non-integrity protected NAS reject message; or
the UE is operating in SNPN access operation mode, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and the selected entry of the "list of subscriber data" or the selected PLMN subscription, and remove the current TAI from the stored TAI list if present. If the SERVICE REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and the selected entry of the "list of subscriber data" or the selected PLMN subscription, for non-integrity protected NAS reject message.

For 3GPP access the UE shall perform a PLMN selection or SNPN selection according to 3GPP TS 23.122 [5], and for non-3GPP access the UE shall perform network selection as defined in 3GPP TS 24.502 [18].

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall handle the EMM parameters EMM state and EPS update status as specified in 3GPP TS 24.301 [15] for the case when the service request procedure is rejected with the EMM cause with the same value.

#15 (No suitable cells in tracking area).

The UE shall enter the state 5GMM-REGISTERED.LIMITED-SERVICE.

If:

the UE is not operating in SNPN access operation mode;
the Forbidden TAI(s) for the list of "5GS forbidden tracking areas for roaming" IE is not included in the SERVICE REJECT message; and

iii) the Access technology utilization control IE is not included in the SERVICE REJECT message or the SERVICE REJECT message is not integrity protected,

then the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" and remove the current TAI from the stored TAI list if present.

If the UE stores the current TAI in the list of "5GS forbidden tracking areas for roaming" and the SERVICE REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for non-integrity protected NAS reject message; or

the UE is operating in SNPN access operation mode, the UE shall store the current TAI in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and the selected entry of the "list of subscriber data" or the selected PLMN subscription, and remove the current TAI from the stored TAI list if present. If the SERVICE REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "5GS forbidden tracking areas for roaming" for the current SNPN and the selected entry of the "list of subscriber data" or the selected PLMN subscription, for non-integrity protected NAS reject message.

If the UE initiated service request for emergency services fallback, the UE shall attempt to select an E-UTRA cell connected to the EPC or the 5GCN according to the emergency services support indicator (see 3GPP TS 36.331 [25A]). If the UE finds a suitable E-UTRA cell, it then proceeds with the appropriate EMM or 5GMM procedures. If the UE operating in single-registration mode has changed to S1 mode, it shall disable the N1 mode capability for 3GPP access.

If the Access technology utilization control IE is present in the SERVICE REJECT message and the message is successfully integrity checked by the NAS; the UE shall store the received access technology utilization control information together with the PLMN identity of the current PLMN in the list of "PLMNs with associated access technology restrictions" and replace the previously stored one associated with the current PLMN, if any, with the newly received access technology utilization control information; otherwise, the UE shall ignore the Access technology utilization control IE.

If the service request was not initiated for emergency services fallback, the UE shall search for a suitable cell in another tracking area according to 3GPP TS 38.304 [28] or 3GPP TS 36.304 [25C].

If the message was received via 3GPP access and the UE is operating in the single-registration mode, the UE shall handle the EMM parameters EMM state and EPS update status as specified in 3GPP TS 24.301 [15] for the case when the service request procedure is rejected with the EMM cause with the same value.

If received over non-3GPP access the cause shall be considered as an abnormal case and the behaviour of the UE for this case is specified in clause 5.6.1.7.

#22 (Congestion).

If the T3346 value IE is present in the SERVICE REJECT message and the value indicates that this timer is neither zero nor deactivated, the UE shall proceed as described below, otherwise it shall be considered as an abnormal case and the behaviour of the UE for this case is specified in clause 5.6.1.7.

If the rejected request was not for initiating an emergency PDU session, the UE shall abort the service request procedure and enter state 5GMM-REGISTERED and stop timer T3517 if still running.

The UE shall stop timer T3346 if it is running.

If the SERVICE REJECT message is integrity protected, the UE shall start timer T3346 with the value provided in the T3346 value IE.

If the SERVICE REJECT message is not integrity protected, the UE shall start timer T3346 with a random value from the default range specified in 3GPP TS 24.008 [12].

For all other cases the UE stays in the current serving cell and applies normal cell reselection process. The service request procedure is started, if still necessary, when timer T3346 expires or is stopped.

If the service request procedure was initiated for an MO MMTEL voice call (i.e. access category 4), or for an MO MMTEL video call (i.e. access category 5) or for an MO IMS registration related signalling (i.e. access category 9), a notification that the service request was not accepted due to congestion shall be provided to the upper layers.

If the UE is using 5GS services with control plane CIoT 5GS optimization and if the T3448 value IE is present in the SERVICE REJECT message and the value indicates that this timer is neither zero nor deactivated, the UE shall:

stop timer T3448 if it is running;
consider the transport of user data via the control plane as unsuccessful; and
start timer T3448:

with the value provided in the T3448 value IE if the SERVICE REJECT message is integrity protected; or
with a random value from the default range specified in 3GPP TS 24.301 [15] table 10.2.1 if the SERVICE REJECT message is not integrity protected.

If the UE is using 5GS services with control plane CIoT 5GS optimization, the T3448 value IE is present in the SERVICE REJECT message and the value indicates that this timer is either zero or deactivated, the UE shall ignore the T3448 value IE and:

stop timer T3448 if it is running; and
consider the transport of user data via the control plane as unsuccessful.

If the UE is using 5GS services with control plane CIoT 5GS optimization and if the T3448 value IE is not present in the SERVICE REJECT message, it shall be considered as an abnormal case and the behaviour of UE for this case is specified in clause 5.6.1.7.

#27 (N1 mode not allowed).

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall enter the state 5GMM-REGISTERED.LIMITED-SERVICE. If the message has been successfully integrity checked by the NAS, the UE shall set:

the PLMN-specific N1 mode attempt counter for 3GPP access and the PLMN-specific N1 mode attempt counter for non-3GPP access for that PLMN in case of PLMN; or
the SNPN-specific attempt counter for 3GPP access for the current SNPN and the SNPN-specific attempt counter for non-3GPP access for the current SNPN in case of SNPN

to the UE implementation-specific maximum value.

The UE shall disable the N1 mode capability for the specific access type for which the message was received (see clause 4.9).

If the message has been successfully integrity checked by the NAS, the UE shall disable the N1 mode capability also for the other access type (see clause 4.9).

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall in addition set the EPS update status to EU3 ROAMING NOT ALLOWED and enter the state EMM-REGISTERED.

#28 (Restricted service area).

This cause value received from non-3GPP access other than wireline access is considered as an abnormal case, and the behaviour of the UE is specified in clause 5.6.1.7.

The UE shall enter the state 5GMM-REGISTERED.NON-ALLOWED-SERVICE, wait for the release of the N1 NAS signalling connection and perform the registration procedure for mobility and periodic registration update if the service type IE in the SERVICE REQUEST message was not set to "elevated signalling" and the SERVICE REJECT message is received over 3GPP access (see clause 5.3.5 and 5.5.1.3).

If the service type IE in the SERVICE REQUEST message was set to "elevated signalling", the UE shall not re-initiate service request procedure until the UE enters an allowed area or leaves a non-allowed area, except for emergency services, high priority access or responding to paging or notification.

If the service type IE in the SERVICE REQUEST message was set to "high priority access" and the network indicates "High priority access UEs are not exempt from service area restrictions", the UE shall not perform the procedure for mobility and periodic registration update or the service request procedure until the UE enters an allowed area or leaves a non-allowed area.

If the service type IE in the SERVICE REQUEST message was set to "high priority access" and the network does not indicate "High priority access UEs are not exempt from service area restrictions", the UE may perform the procedure for mobility and periodic registration update or the service request procedure.

#31 (Redirection to EPC required).

5GMM cause #31 received by a UE that has not indicated support for CIoT optimizations or received by a UE over non-3GPP access is considered an abnormal case and the behaviour of the UE is specified in clause 5.6.1.7.

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2). The UE shall reset the service request attempt counter and enter the state 5GMM-REGISTERED.LIMITED-SERVICE.

The UE shall enable the E-UTRA capability if it was disabled and disable the N1 mode capability for 3GPP access (see clause 4.9.2).

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall handle the EMM parameters, EMM state, and EPS update status as specified in 3GPP TS 24.301 [15] for the case when the service request procedure is rejected with the EMM cause with the same value.

#36 (IAB-node operation not authorized).

This cause value is only applicable when received over 3GPP access by a UE operating as an IAB-node. This cause value received from a 5G access network other than 3GPP access or received by a UE not operating as an IAB-node is considered as an abnormal case and the behaviour of the UE is specified in clause 5.6.1.7.

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI.

If:

the UE is not operating in SNPN access operation mode,

the UE shall delete the list of equivalent PLMNs and store the PLMN identity in the forbidden PLMN list as specified in clause 5.3.13A and if the UE is configured to use timer T3245 then the UE shall start timer T3245 and proceed as described in clause 5.3.19a.1. The UE shall enter the state 5GMM-DEREGISTERED.PLMN-SEARCH and perform a PLMN selection according to 3GPP TS 23.122 [5]. If the message has been successfully integrity checked by the NAS and the UE maintains the PLMN-specific attempt counter for 3GPP access for that PLMN, the UE shall set the PLMN-specific attempt counter for 3GPP access for that PLMN to the UE implementation-specific maximum value; and
If the UE is operating in single-registration mode, the UE shall in addition handle the EMM parameters EMM state, EPS update status, 4G-GUTI, last visited registered TAI, TAI list and eKSI as specified in 3GPP TS 24.301 [15] for the case when the service request procedure is rejected with the EMM cause with the same value; or

the UE is operating in SNPN access operation mode,

the UE shall delete the list of equivalent SNPNs (if available). The UE shall store the SNPN identity in the "temporarily forbidden SNPNs" list for 3GPP access and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, the selected entry of the "list of subscriber data" or the selected PLMN subscription or "temporarily forbidden SNPNs for access for localized services in SNPN" list if the SNPN is an SNPN selected for localized services in SNPN (see 3GPP TS 23.122 [5]) for 3GPP access and the selected entry of the "list of subscriber data" or the selected PLMN subscription or the selected PLMN subscription or in the "temporarily forbidden SNPNs for onboarding services in SNPN" list, if the UE is performing initial registration for onboarding services in SNPN, for 3GPP access. If the UE supports access to an SNPN using credentials from a credentials holder, the UE shall store the SNPN identity in the "temporarily forbidden SNPNs" list along with the GIN(s) broadcasted by the SNPN if any, for the selected entry of the "list of subscriber data" or the selected PLMN subscription. If the UE supports access to an SNPN providing access for localized services in SNPN and the access for localized services in SNPN has been enabled, the UE shall store the SNPN identity in the list of "temporarily forbidden SNPNs for access for localized services in SNPN" (if the SNPN is an SNPN selected for localized services in SNPN (see 3GPP TS 23.122 [5]) along with the GIN(s) broadcasted by the SNPN if any, for the selected entry of the "list of subscriber data" or the selected PLMN subscription. The UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform an SNPN selection according to 3GPP TS 23.122 [5]. If the message has been successfully integrity checked by the NAS, the UE shall set the SNPN-specific attempt counter for 3GPP access for the current SNPN to the UE implementation-specific maximum value.

#72 (Non-3GPP access to 5GCN not allowed).

If the UE initiated the service request procedure over non-3GPP access, the UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall delete last visited registered TAI and TAI list. If the UE is not registering or has not registered to the same PLMN over both 3GPP access and non-3GPP access, the UE shall additionally delete 5G-GUTI and ngKSI. Additionally, the UE shall enter the state 5GMM-DEREGISTERED for non-3GPP access. If the message has been successfully integrity checked by the NAS, the UE shall set:

the PLMN-specific N1 mode attempt counter for non-3GPP access for that PLMN in case of PLMN; or
the SNPN-specific attempt counter for non-3GPP access for that SNPN in case of SNPN;

to the UE implementation-specific maximum value.

NOTE 7: The 5GMM sublayer states, the 5GMM parameters and the registration status are managed per access type independently, i.e. 3GPP access or non-3GPP access (see clauses 4.7.2 and 5.1.3).

The UE shall disable the N1 mode capability for non-3GPP access (see clause 4.9.3).

As an implementation option, if the UE is not currently registered over 3GPP access, the UE may enter the state 5GMM-DEREGISTERED.PLMN-SEARCH in order to perform a PLMN selection according to 3GPP TS 23.122 [5].

If received over 3GPP access the cause shall be considered as an abnormal case and the behaviour of the UE for this case is specified in clause 5.6.1.7.

#73 (Serving network not authorized).

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. The UE shall delete the list of equivalent PLMNs, store the PLMN identity in the forbidden PLMN list as specified in clause 5.3.13A. For 3GPP access the UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH in order to perform a PLMN selection according to 3GPP TS 23.122 [5], and for non-3GPP access the UE shall enter state 5GMM-DEREGISTERED.LIMITED-SERVICE in order to perform network selection as defined in 3GPP TS 24.502 [18]. If the message has been successfully integrity checked by the NAS, the UE shall set the PLMN-specific attempt counter and the PLMN-specific attempt counter for non-3GPP access for that PLMN to the UE implementation-specific maximum value.

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall in addition set the EPS update status to EU3 ROAMING NOT ALLOWED, enter the state EMM-DEREGISTERED and shall delete any 4G-GUTI, last visited registered TAI, TAI list and eKSI.

#74 (Temporarily not authorized for this SNPN).

5GMM cause #74 is only applicable when received from a cell belonging to an SNPN and the UE is operating in SNPN access operation mode. 5GMM cause #74 received from a cell not belonging to an SNPN is considered as an abnormal case and the behaviour of the UE is specified in clause 5.6.1.7.

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list, ngKSI and the list of equivalent SNPNs (if available). The UE shall store the SNPN identity in the "temporarily forbidden SNPNs" list for the specific access type for which the message was received and the selected entry of the "list of subscriber data" or the selected PLMN subscription, or in the "temporarily forbidden SNPNs for onboarding services in SNPN" list, if the UE is registered for onboarding services in SNPN, for the specific access type for which the message was received. If the UE supports access to an SNPN using credentials from a credentials holder, the UE shall store the SNPN identity in the "temporarily forbidden SNPNs" list along with the GIN(s) broadcasted by the SNPN if any, for the selected entry of the "list of subscriber data" or the selected PLMN subscription. If the UE supports access to an SNPN providing access for localized services in SNPN and the access for localized services in SNPN has been enabled, the UE shall store the SNPN identity in the list of "temporarily forbidden SNPNs for access for localized services in SNPN" (if the SNPN is an SNPN selected for localized services in SNPN (see 3GPP TS 23.122 [5]) along with the GIN(s) broadcasted by the SNPN if any, for the selected entry of the "list of subscriber data" or the selected PLMN subscription. If the UE is not registered for onboarding services in SNPN, the UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform an SNPN selection according to 3GPP TS 23.122 [5]. If the UE is registered for onboarding services in SNPN, the UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform an SNPN selection or an SNPN selection for onboarding services according to 3GPP TS 23.122 [5]. If the message has been successfully integrity checked by the NAS, the UE shall set the SNPN-specific attempt counter for 3GPP access and the SNPN-specific attempt counter for non-3GPP access for the current SNPN to the UE implementation-specific maximum value.

If the message has been successfully integrity checked by the NAS and the UE also supports the registration procedure over the other access to the same SNPN, the UE shall in addition handle 5GMM parameters and 5GMM state for this access, as described for this 5GMM cause value.

#75 (Permanently not authorized for this SNPN).

5GMM cause #75 is only applicable when received from a cell belonging to an SNPN with a globally-unique SNPN identity and the UE is operating in SNPN access operation mode. 5GMM cause #75 received from a cell not belonging to an SNPN or a cell belonging to an SNPN with a non-globally-unique SNPN identity is considered as an abnormal case and the behaviour of the UE is specified in clause 5.6.1.7.

The UE shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2) and shall delete any 5G-GUTI, last visited registered TAI, TAI list, ngKSI and the list of equivalent SNPNs (if available). The UE shall store the SNPN identity in the "permanently forbidden SNPNs" list for the specific access type for which the message was received and the selected entry of the "list of subscriber data" or the selected PLMN subscription, or in the "permanently forbidden SNPNs for onboarding services in SNPN" list, if the UE is registered for onboarding services in SNPN, for the specific access type for which the message was received. If the UE is not registered for onboarding services in SNPN, the UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform an SNPN selection according to 3GPP TS 23.122 [5]. If the UE supports access to an SNPN using credentials from a credentials holder, the UE shall store the SNPN identity in the "permanently forbidden SNPNs" list along with the GIN(s) broadcasted by the SNPN if any, for the selected entry of the "list of subscriber data" or the selected PLMN subscription. If the UE supports access to an SNPN providing access for localized services in SNPN and the access for localized services in SNPN has been enabled, the UE shall store the SNPN identity in the list of "permanently forbidden SNPNs for access for localized services in SNPN" (if the SNPN is an SNPN selected for localized services in SNPN (see 3GPP TS 23.122 [5]) along with the GIN(s) broadcasted by the SNPN if any, for the selected entry of the "list of subscriber data" or the selected PLMN subscription. If the UE is registered for onboarding services in SNPN, the UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform an SNPN selection or an SNPN selection for onboarding services according to 3GPP TS 23.122 [5]. If the message has been successfully integrity checked by the NAS, the UE shall set the SNPN-specific attempt counter for 3GPP access and the SNPN-specific attempt counter for non-3GPP access for the current SNPN to the UE implementation-specific maximum value.

#76 (Not authorized for this CAG or authorized for CAG cells only).

This cause value received via non-3GPP access or from a cell belonging to an SNPN and the UE is operating in SNPN access operation mode is considered as an abnormal case and the behaviour of the UE is specified in clause 5.6.1.7.

The UE shall set the 5GS update status to 5U3.ROAMING NOT ALLOWED, store the 5GS update status according to clause 5.1.3.2.2.

If 5GMM cause #76 is received from:

a CAG cell, and if the UE receives a "CAG information list" in the CAG information list IE or the Extended CAG information list IE included in the SERVICE REJECT message, the UE shall:

replace the "CAG information list" stored in the UE with the received "CAG information list" when received in the HPLMN or EHPLMN;
replace the serving VPLMN's entry of the "CAG information list" stored in the UE with the serving VPLMN's entry of the received CAG information list IE or the Extended CAG information list IE when the UE receives the CAG information list IE or the Extended CAG information list IE in a serving PLMN other than the HPLMN or EHPLMN; or

NOTE 8: When the UE receives the CAG information list IE or the Extended CAG information list IE in a serving PLMN other than the HPLMN or EHPLMN, entries of a PLMN other than the serving VPLMN, if any, in the received CAG information list IE or the Extended CAG information list IE are ignored.

iii) remove the serving VPLMN's entry of the "CAG information list" stored in the UE when the UE receives the CAG information list IE or the Extended CAG information list IE in a serving PLMN other than the HPLMN or EHPLMN and the CAG information list IE or the Extended CAG information list IE does not contain the serving VPLMN's entry.

Otherwise, the UE shall delete the CAG-ID(s) of the cell from the "allowed CAG list" for the current PLMN, if the CAG-ID(s) are authorized based on the "Allowed CAG list". In the case the "allowed CAG list" for the current PLMN only contains a range of CAG-IDs, how the UE deletes the CAG-ID(s) of the cell from the "allowed CAG list" for the current PLMN is up to UE implementation. In addition:

if the entry in the "CAG information list" for the current PLMN does not include an "indication that the UE is only allowed to access 5GS via CAG cells" or if the entry in the "CAG information list" for the current PLMN includes an "indication that the UE is only allowed to access 5GS via CAG cells" and one or more CAG-ID(s) are authorized based on the updated "allowed CAG list" for the current PLMN, then the UE shall enter the state 5GMM-REGISTERED.LIMITED-SERVICE and shall search for a suitable cell according to 3GPP TS 38.304 [28] or 3GPP TS 36.304 [25C] with the updated "CAG information list";
if the entry in the "CAG information list" for the current PLMN includes an "indication that the UE is only allowed to access 5GS via CAG cells" and no CAG-ID is authorized based on the updated "allowed CAG list" for the current PLMN, then the UE shall enter the state 5GMM-REGISTERED.PLMN-SEARCH and shall apply the PLMN selection process defined in 3GPP TS 23.122 [5] with the updated "CAG information list"; or

iii) if the "CAG information list" does not include an entry for the current PLMN, then the UE shall enter the state 5GMM-REGISTERED.LIMITED-SERVICE and shall search for a suitable cell according to 3GPP TS 38.304 [28] or 3GPP TS 36.304 [25C] with the updated "CAG information list".

a non-CAG cell, and if the UE receives a "CAG information list" in the CAG information list IE or the Extended CAG information list IE included in the SERVICE REJECT message, the UE shall:

replace the "CAG information list" stored in the UE with the received "CAG information list" when received in the HPLMN or EHPLMN;
replace the serving VPLMN's entry of the "CAG information list" stored in the UE with the serving VPLMN's entry of the received CAG information list IE or the Extended CAG information list IE when the UE receives the CAG information list IE or the Extended CAG information list IE in a serving PLMN other than the HPLMN or EHPLMN; or

NOTE 9: When the UE receives the CAG information list IE or the Extended CAG information list IE in a serving PLMN other than the HPLMN or EHPLMN, entries of a PLMN other than the serving VPLMN, if any, in the received CAG information list IE or the Extended CAG information list IE are ignored.

Otherwise, the UE shall store an "indication that the UE is only allowed to access 5GS via CAG cells" in the entry of the "CAG information list" for the current PLMN, if any. If the "CAG information list" stored in the UE does not include the current PLMN's entry, the UE shall add an entry for the current PLMN to the "CAG information list" and store an "indication that the UE is only allowed to access 5GS via CAG cells" in the entry of the "CAG information list" for the current PLMN. If the UE does not have a stored "CAG information list", the UE shall create a new "CAG information list" and add an entry with an "indication that the UE is only allowed to access 5GS via CAG cells" for the current PLMN.

In addition:

if one or more CAG-ID(s) are authorized based on the "allowed CAG list" for the current PLMN, then the UE shall enter the state 5GMM-REGISTERED.LIMITED-SERVICE and shall search for a suitable cell according to 3GPP TS 38.304 [28] with the updated CAG information; or
if no CAG-ID is authorized based on the "allowed CAG list" for the current PLMN, then the UE shall enter the state 5GMM-REGISTERED.PLMN-SEARCH and shall apply the PLMN selection process defined in 3GPP TS 23.122 [5] with the updated "CAG information list".

If the message was received via 3GPP access and the UE is operating in single-registration mode, the UE shall in addition set the EPS update status to EU3 ROAMING NOT ALLOWED, reset the service request attempt counter and enter the state EMM-REGISTERED.

#77 (Wireline access area not allowed).

5GMM cause #77 is only applicable when received from a wireline access network by the 5G-RG or the W-AGF acting on behalf of the FN-CRG (or on behalf of the N5GC device). 5GMM cause #77 received from a 5G access network other than a wireline access network and 5GMM cause #77 received by the W-AGF acting on behalf of the FN-BRG are considered as abnormal cases and the behaviour of the UE is specified in clause 5.6.1.7.

When received over wireline access network, the 5G-RG and the W-AGF acting on behalf of the FN-CRG (or on behalf of the N5GC device) shall set the 5GS update status to 5U3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.2.2), shall delete 5G-GUTI, last visited registered TAI, TAI list and ngKSI, shall enter the state 5GMM-DEREGISTERED and shall act as specified in clause 5.3.23.

NOTE 10: The 5GMM sublayer states, the 5GMM parameters and the registration status are managed per access type independently, i.e. 3GPP access or non-3GPP access (see clauses 4.7.2 and 5.1.3).

#78 (PLMN not allowed to operate at the present UE location).

If this cause value is received from a cell which is not deployed in a 5G PLMN/access technology combination with specific satellite features, it shall be considered as an abnormal case and the behaviour of the UE is specified in clause 5.6.1.7.

for satellite NG-RAN access, the PLMN identity and, if it is known, the current geographical location in the list of "PLMNs not allowed to operate at the present UE location"; or
for NG-RAN access, the PLMN/access technology combination and, if it is known, the current geographical location in the list of "LSP PLMNs not allowed to operate at the present UE location",

and shall start a corresponding timer instance (see clause 4.23.2). The UE shall enter state 5GMM-DEREGISTERED.PLMN-SEARCH and perform a PLMN selection according to 3GPP TS 23.122 [5].