Content for  TS 23.501  Word version:  19.1.0

SNPN 5GS deployments are based on:

• the architecture depicted in clause 4.2.3;
• the architecture for 5GC with Untrusted non-3GPP access (Figure 4.2.8.2.1-1) for either access to SNPN services via a PLMN (and vice versa) or for direct access to SNPN via non-3GPP access;
• the architecture for 5GC with Trusted non-3GPP access (Figure 4.2.8.2.1-2); and
• the additional functionality covered in clause 5.30.2.

Alternatively, a Credentials Holder (CH) may authenticate and authorize access to an SNPN separate from the Credentials Holder based on the architecture specified in clause 5.30.2.9. Idle and connected mode mobility is supported as defined in clause 5.30.2.11. Clauses 5.30.2.1 to 5.30.2.11 specify the common SNPN aspects applicable to both 3GPP and non-3GPP access, except where stated differently. Aspects specific to Untrusted non-3GPP access for SNPN are specified in clause 5.30.2.12. Aspects specific to Trusted non-3GPP access for SNPN are specified in clause 5.30.2.13. Aspects specific to N5CW devices accessing SNPN services are specified in clause 5.30.2.15. Aspects specific to Proximity based Services (ProSe) for SNPN are defined in TS 23.304. The following 5GS features and functionalities are not supported for SNPNs:

• Interworking with EPS;
• Emergency services when the UE accesses the SNPN over NWu via a PLMN;
• Roaming, e.g. roaming between SNPNs. However, it is possible for a UE to access an SNPN with credentials from a CH as described in clause 5.30.2.9 and to move between equivalent SNPNs;
• Handover between SNPN and PLMN or PNI-NPN;
• CIoT 5GS Optimizations;
• CAG.

A UE with two or more network subscriptions, where one or more network subscriptions may be for a subscribed SNPN, can apply procedures specified for Multi-USIM UEs as described in clause 5.38. The UE shall use a separate PEI for each network subscription when it registers to the network.

The combination of a PLMN ID and a Network identifier (NID) identifies an SNPN. The NID shall support two assignment models:

• Self-assignment: NIDs are chosen individually by SNPNs at deployment time (and may therefore not be unique) but use a different numbering space than the coordinated assignment NIDs as defined in TS 23.003.
• Coordinated assignment: NIDs are assigned using one of the following two options:
  1. The NID is assigned such that it is globally unique independent of the PLMN ID used; or
  2. The NID is assigned such that the combination of the NID and the PLMN ID is globally unique.

The GIN shall support two assignment models:

• Self-assignment: GINs are chosen individually and may therefore not be unique. It is defined as in TS 23.003; or
• Coordinated assignment: GIN uses a combination of PLMN ID and NID and is assigned using one of the following two options as defined in TS 23.003:
  1. The GIN is assigned such that the NID is globally unique (e.g. using IANA Private Enterprise Numbers) independent of the PLMN ID used; or
  2. The GIN is assigned such that the combination of the NID and the PLMN ID is globally unique.

An optional human-readable network name helps to identify an SNPN during manual SNPN selection. The human-readable network name and how it is used for SNPN manual selection is specified in TS 22.261 and TS 23.122.

NG-RAN nodes or Trusted non-3GPP access networks which provide access to SNPNs broadcast the following information:

• One or multiple PLMN IDs;
• List of NIDs per PLMN ID identifying the non-public networks NG-RAN provides access to; and
• Optionally:
  • A human-readable network name per SNPN;
  • Information, as described in TS 38.300, TS 38.331 and in TS 38.304, to prevent UEs not supporting SNPNs from accessing the cell, e.g. if the cell only provides access to non-public networks;
  • An indication per SNPN of whether access using credentials from a Credentials Holder is supported;
  • List of supported Group IDs for Network Selection (GINs) per SNPN; and
  • An indication per SNPN of whether the SNPN allows registration attempts from UEs that are not explicitly configured to select the SNPN, i.e. UEs that do not have any PLMN ID and NID nor GIN broadcast by the SNPN in the Credentials Holder controlled prioritized lists of preferred SNPNs/GINs.

An SNPN-enabled UE is configured with the following information for each subscribed SNPN:

• PLMN ID and NID of the subscribed SNPN;
• Subscription identifier (SUPI) and credentials for the subscribed SNPN;
• Optionally, an N3IWF FQDN and the MCC of the country where the configured N3IWF is located;
• Optionally, if the UE supports access to an SNPN using credentials from a Credentials Holder:
  • User controlled prioritized list of preferred SNPNs;
  • Credentials Holder controlled prioritized list of preferred SNPNs;
  • Credentials Holder controlled prioritized list of GINs;
• Optionally, if the UE supports access to an SNPN using credentials from a Credentials Holder and access to an SNPN providing access for Localized Services:
  • User controlled prioritized list of preferred SNPNs;
  • Credentials Holder controlled prioritized list of preferred SNPNs for accessing Localized Services, each entry of the list includes:
    • an SNPN identifier;
    • validity information; and
    • optionally, location assistance information;
  • Credentials Holder controlled prioritized list of GINs for accessing Localized Services, each entry of the list includes:
    • a GIN;
    • validity information; and
    • optionally, location assistance information;
• Protection scheme for concealing the SUPI as defined in TS 33.501.

Validity information consists of:

• Time validity information, i.e. time periods (defined by start and end times) when access to the SNPN for accessing Localized Services is allowed; and
• optionally, location validity information containing one or more location information as defined in TS 24.501.

Location assistance information consisting of:

• Geolocation information, and/or,
• Tracking Area information of serving networks, i.e. lists of TACs per PLMN ID or per PLMN ID and NID.

The UE may use the location assistance information to determine where to search for the SNPNs in the Credentials Holder controlled prioritized list of SNPNs and GINs for accessing Localized Services, i.e. the location assistance information is not used for any area restriction enforcement. For an SNPN-enabled UE with SNPN subscription, the Credentials Holder controlled prioritized lists of preferred SNPNs and GINs, or Credentials Holder controlled prioritized lists of preferred SNPNs and GINs for accessing Localized Services may be updated by the Credentials Holder using the Steering of Roaming (SoR) procedure as defined in Annex C of TS 23.122. Updating Credentials Holder controlled prioritized lists of preferred SNPNs and GINs, or Credentials Holder controlled prioritized lists of preferred SNPNs and GINs for accessing Localized Services via the Steering of Roaming (SoR) procedure is not applicable for Credentials Holder with AAA Server. A subscription of an SNPN is either:

• identified by a SUPI containing a network-specific identifier that takes the form of a Network Access Identifier (NAI) using the NAI RFC 7542 based user identification as defined in clause 28.7.2 of TS 23.003. The realm part of the NAI may include the NID of the SNPN; or
• identified by a SUPI containing an IMSI.

In the case of access to an SNPN using credentials owned by a Credentials Holder as specified in clause 5.30.2.9.2 and clause 5.30.2.9.3, the SUPI shall also contain identification for the Credentials Holder (i.e. the realm in the case of Network Specific Identifier based SUPI or the MCC and MNC in the case of an IMSI based SUPI). In the case of access to an SNPN using credentials owned by a Credentials Holder using AAA-S as specified in clause 5.30.2.9.2, only Network Specific Identifier based SUPI is supported. An SNPN-enabled UE that supports access to an SNPN using credentials from a Credentials Holder and that is equipped with a PLMN subscription may additionally be configured with the following information for SNPN selection and registration using the PLMN subscription in SNPN access mode:

• User controlled prioritized list of preferred SNPNs;
• Credentials Holder controlled prioritized list of preferred SNPNs;
• Credentials Holder controlled prioritized list of preferred GINs.
• Optionally if the UE supports access to an SNPN providing access for Localized Services:
  • Credentials Holder controlled prioritized list of preferred SNPNs for accessing Localized Services, each entry of the list includes:
    • an SNPN identifier;
    • validity information; and
    • optionally, location assistance information;
  • Credentials Holder controlled prioritized list of preferred GINs for accessing Localized Services, each entry of the list includes:
    • a GIN;
    • validity information; and
    • optionally, location assistance information.

Validity information consists of:

• Time validity information, i.e. time periods (defined by start and end times) when access to the SNPN for accessing Localized Services is allowed; and
• optionally, location validity information containing one or more location information as defined in TS 24.501.

Location assistance information consisting of:

• Geolocation information, and/or,
• Tracking Area information of serving networks, i.e. lists of TACs per PLMN ID or per PLMN ID and NID.

The UE may use the location assistance information to determine where to search for the SNPNs in the Credentials Holder controlled prioritized list of SNPNs and GINs for accessing Localized Services, i.e. the location assistance information is not used for any area restriction enforcement. For an SNPN-enabled UE with PLMN subscription, the Credentials Holder controlled prioritized lists of preferred SNPNs and GINs, or the Credentials Holder controlled prioritized lists of preferred SNPNs and GINs for accessing Localized Services may be updated by the Credentials Holder using the Steering of Roaming (SoR) procedure as defined in Annex C of TS 23.122. When the Credentials Holder updates a UE with the Credentials Holder controlled prioritized lists of preferred SNPNs and GINs, and/or the Credentials Holder controlled prioritized lists of preferred SNPNs and GINs for accessing Localized Services, the UE may perform SNPN selection again, e.g. to potentially select a higher prioritized SNPN or to potentially select an SNPN that provides access for Localized Services.

If a UE performs the registration or service request procedure in an SNPN identified by a PLMN ID and a self-assigned NID and there is no subscription for the UE, then the AMF shall reject the UE with an appropriate cause code to temporarily prevent the UE from automatically selecting and registering with the same SNPN. If a UE performs the registration or service request procedure in an SNPN identified by a PLMN ID and a coordinated assigned NID and there is no subscription for the UE, then the AMF shall reject the UE with an appropriate cause code to permanently prevent the UE from automatically selecting and registering with the same SNPN. If a UE performs the registration in an SNPN using credentials from a Credentials Holder (i.e. the CH is the PLMN/SNPN that owns the UE subscription and controls the access) and the Credentials Holder does not authorize the UE to access that specific SNPN due to access authorization based on subscription data or invalid time for accessing an SNPN that provides access to Localized Services, then the UDM, in the Credentials Holder, can reject the UE which results in AMF rejecting the registration request from the UE with an appropriate cause code to prevent the UE from automatically selecting and registering with the same SNPN using credentials from the Credentials Holder as described in TS 24.501. In order to prevent access to SNPNs for authorized UE(s) in the case of network congestion/overload, Unified Access Control information is configured per SNPN (i.e. as part of the subscription information that the UE has for a given SNPN) and provided to the UE as described in TS 24.501.

UEs operating in SNPN access mode only select cells and networks broadcasting both PLMN ID and NID of the selected SNPN or its equivalent SNPN.

To access PLMN services, a UE in SNPN access mode that has successfully registered with an SNPN may perform another registration via the SNPN User Plane with a PLMN (using the credentials of that PLMN) following the same architectural principles as specified in clause 4.2.8 (including the optional support for PDU Session continuity between PLMN and SNPN using the Handover of a PDU Session procedures in clauses 4.9.2.1 and 4.9.2.2 of TS 23.502) and the SNPN taking the role of "Untrusted non-3GPP access". Annex D, clause D.3 provides additional details. When the UE accesses the PLMN over NWu via a SNPN, the AMF in the serving PLMN shall send an indication toward the UE during the Registration procedure to indicate whether an IMS voice over PS session is supported or not.

To access SNPN services, a UE that has successfully registered with a PLMN over 3GPP access may perform another registration via the PLMN User Plane with an SNPN (using the credentials of that SNPN) following the same architectural principles as specified in clause 4.2.8 (including the optional support for PDU Session continuity between PLMN and SNPN using the Handover of a PDU Session procedures in clauses 4.9.2.1 and 4.9.2.2 of TS 23.502) and the PLMN taking the role of "Untrusted non-3GPP access" of the SNPN, i.e. using the procedures for Untrusted non-3GPP access in clause 4.12.2 of TS 23.502. Annex D, clause D.3 provides additional details. The case where UE that has successfully registered with a PLMN over non-3GPP access to access SNPN services is not specified in this Release. When the UE accesses the SNPN over NWu via a PLMN, the AMF in the SNPN shall send an indication toward the UE during the Registration procedure to indicate whether an IMS voice over PS session is supported or not.

If the UE moves its 3GPP access between SNPN and PLMN, the network selection is performed as specified in TS 23.122 and UE performs initial registration as specified in clause 4.2.2.2.2 of TS 23.502. If the UE moves its 3GPP access between SNPNs, the network selection is performed as specified in TS 23.122, then the UE performs initial or mobility registration as specified in clause 4.2.2.2.2 of TS 23.502. If the UE and network supports equivalent SNPNs, the AMF may provide list of equivalent SNPNs to the UE and NG-RAN. The UE may move its 3GPP access to the SNPN in the list of equivalent SNPNs without performing network selection. A UE supporting equivalent SNPNs gets a new registered SNPN ID during the Registration procedure if serving SNPN is changed.

Access to SNPN services via Untrusted non-3GPP access network follows the specification in the previous 5.30.2 clauses with the differences as specified in this clause. N3IWF selection is supported as follows:

• When UE registers to SNPN with credentials owned by the SNPN, UE uses the same N3IWF selection procedure as specified for access to stand-alone non-public network services via PLMN in clause 6.3.6.2a.

Emergency services are supported as follows:

• UE initiates N3IWF selection for emergency services when the UE detects a user request for emergency session and determines that Untrusted non-3GPP access is to be used for the emergency access. The UE in SNPN access mode the following:
  • If the UE determines that it is located in the same country as the configured N3IWF of the subscribed SNPN, the UE uses the configured N3IWF FQDN for N3IWF selection.
  • Otherwise, the UE performs a DNS query using the Visited Country Emergency SNPN FQDN, as specified in clause 28.3.2.2.6.3 of TS 23.003 to determine which SNPNs in the visited country support emergency services in untrusted non-3GPP access via N3IWF; and:
  • If the DNS response contains one or more records, the UE selects an SNPN that supports emergency services in untrusted non-3GPP access via N3IWF based on UE implementation specific methods. Each record in the DNS response shall contain the identity of an SNPN (i.e. SNPN ID) in the visited country supporting emergency services in untrusted non-3GPP access via N3IWF.
  • Once the UE has selected an SNPN, the UE selects an N3IWF for Emergency for the selected SNPN, as specified in TS 23.003.
  When an N3IWF has been selected, the UE initiates an Emergency Registration. If the Emergency Registration fails, the UE shall select another SNPN supporting emergency services in untrusted non-3GPP access.
  If the DNS response of the Visited Country Emergency SNPN FQDN does not contain any record, or if the DNS response contains one or more records but the UE fails to select an SNPN that supports emergency services in untrusted non-3GPP access, or if the Emergency Registration procedure has failed for all SNPNs supporting emergency services in untrusted non-3GPP access, the UE deactivates the SNPN access mode over NWu and attempts emergency services via PLMN untrusted non-3GPP access, by following the N3IWF selection procedure as defined in clause 6.3.6.4.2.

UE onboarding is supported as follows:

• When UE registers to SNPN over Untrusted non-3GPP access for UE Onboarding, if the UE determines that it is located in the country where the configured N3IWF for onboarding is located, the UE may select the N3IWF in the SNPN which supports UE Onboarding by using the configured N3IWF FQDN used for Onboarding.
• If the UE determines that it is located in a country different from the country where the configured N3IWF for onboarding is located (called the visited country), then in order to determine which SNPNs in the visited country support Untrusted non-3GPP access for UE Onboarding via N3IWF performs a DNS query using the Visited Country FQDN for SNPN N3IWF supporting Onboarding, as specified in clause 28.3.2.2.6.2 of TS 23.003; and:
  • If no DNS response is received, the UE shall stop the N3IWF selection.
  • If the DNS response contains one or more records, the UE selects an SNPN that supports Untrusted non-3GPP access for UE Onboarding via N3IWF. Each record in the DNS response shall contain the identity of an SNPN in the visited country supporting Untrusted non-3GPP access for UE Onboarding via N3IWF. In this case:
    • The UE shall select an SNPN based on its own implementation means.
      If the UE cannot select any N3IWF included in the DNS response, then the UE shall stop the N3IWF selection.
  • If the DNS response contains no records, then the UE determines that the visited country does not mandate the selection of an N3IWF that supports Untrusted non-3GPP access for UE Onboarding via N3IWF in this country. In this case the UE uses the configured N3IWF for onboarding.
  • If the UE has selected an SNPN for onboarding, the UE constructs the Operator Identifier based Onboarding FQDN for SNPN N3IWF as specified in clause 28.3.2.2.7.2 of TS 23.003, based on the SNPN ID of the selected SNPN and performs a DNS query:
    • The DNS response contains the identifier of the N3IWF supporting the onboarding in the SNPN identified by the SNPN ID.
• If the PVS is reachable from the local Untrusted non-3GPP access network (e.g. via the Internet) using the local IP connectivity, UE may connect directly (i.e. without being connected to an N3WIF) with a PVS to obtain the SNPN credentials.
• As part of UE registration via Untrusted non-3GPP access, in Figure 4.12.2.2-1, step 5 of TS 23.502, the UE provides an onboarding indication inside the AN-Parameters.

Access to SNPN services via Trusted non-3GPP access network follows the specification in the previous (sub)clauses of clause 5.30.2 with the differences as specified in this clause. To access SNPN services via a Trusted non-3GPP access network, the UE follows the procedure for accessing a PLMN via a Trusted non-3GPP access network defined in clause 6.3.12.2 with the following clarifications and additions:

• A non-3GPP access network may advertise (e.g. with ANQP), not only the PLMNs with which 5G connectivity is supported (as specified in clause 6.3.12.2), but also the SNPNs with which 5G connectivity is supported and the related parameters and indications defined in clause 5.30.2.2 (i.e. human-readable network name(s), GIN(s), indication whether access using credentials from a Credentials Holder is supported, indication whether SNPN allows registration attempts from UEs that are not explicitly configured to select the SNPN, etc.).
• The UE initiates the access network selection procedure specified in clause 6.3.12.2 and constructs a list of available SNPNs. This list contains the SNPNs advertised by all discovered non-3GPP access networks.
• The UE selects an SNPN that is included in the list of available SNPNs following the procedure in clause 5.30.2.4.
• The UE selects a non-3GPP access network that supports 5G connectivity to the selected SNPN and initiates the registration procedure via Trusted non-3GPP access specified in clause 4.12a.2.2 of TS 23.502 in order to register with the selected SNPN via the selected non-3GPP access network. During the EAP authentication procedure the NAI provided by the UE indicates that 5G connectivity to a specific SNPN is required (e.g. NAI = "<username>@nai.5gc.nid<NID>.mnc<MNC>.mcc<MCC>.3gppnetwork.org").
• If there are multiple non-3GPP access networks that support 5G connectivity to the selected SNPN, then the UE places these non-3GPP access networks in a prioritized list and selects the highest priority non-3GPP access network from this list. To determine the priority of a non-3GPP access network, the UE shall apply the WLANSP rules (if provided), and the procedure specified in clause 6.6.1.3 of TS 23.503, "UE procedure for selecting a WLAN access based on WLANSP rules". If the UE is not provided with WLANSP rules, the UE determines the priority of a non-3GPP access network by using implementation means.

UE onboarding via Trusted non-3GPP access is supported as follows:

• The non-3GPP access network advertises (e.g. via ANQP) an Onboarding enabled indication, as specified in clause 5.30.2.10.2.3.
• The UE selects an SNPN advertising the Onboarding enabled indication following the network selection procedure specified in clause 5.30.2.10.2.5.
• As part of UE registration via Trusted non-3GPP access, in Figure 4.12a.2.2-1, step 5 of TS 23.502 the UE provides an onboarding indication inside the AN-Parameters.

Access to SNPN services via a wireline access network is specified in TS 23.316.

Devices that do not support 5GC NAS signalling over WLAN access (referred to as "Non-5G-Capable over WLAN" devices, or N5CW devices for short), may access 5GC in an SNPN via a trusted WLAN access network that supports a TWIF function. To access SNPN services the N5CW device performs the following procedure:

• A WLAN access network may advertise (e.g. with ANQP), not only the PLMNs with which "5G connectivity-without-NAS" is supported (as specified in clause 6.3.12a.1), but also the SNPNs with which "5G connectivity-without-NAS" is supported, as well as the related parameters and indications defined in clause 5.30.2.2 (i.e. human-readable network name(s), GIN(s), indication whether access using credentials from a Credentials Holder is supported, indication whether SNPN allows registration attempts from UEs that are not explicitly configured to select the SNPN).
• The N5CW device initiates the access network selection procedure by sending an ANQP query to each discovered WLAN access network and constructs a list of available SNPNs with which "5G connectivity-without-NAS" is supported. This list contains the SNPNs with which "5G connectivity-without-NAS" is supported as advertised by all the discovered WLAN access networks.
• The N5CW device selects an SNPN that is included in the list of available SNPNs with which "5G connectivity-without-NAS" is supported following the procedure in clause 5.30.2.4.
• The N5CW device selects a WLAN access network (e.g. an SSID) that supports "5G connectivity-without-NAS" to the selected SNPN and initiates the "Initial Registration and PDU Session Establishment" procedure specified in clause 4.12b.2 of TS 23.502. If there are multiple WLAN access networks that support "5G connectivity-without-NAS" to the selected SNPN, then the N5CW device selects the highest priority WLAN access network from this list. To determine the priority of a WLAN access network, the N5CW device shall apply the WLANSP rules (if provided), and the procedure specified in clause 6.6.1.3 of TS 23.503, "UE procedure for selecting a WLAN access based on WLANSP rules". If the N5CW device is not provided with WLANSP rules, the N5CW device determines the priority of a WLAN access network by using implementation means.

Public Network Integrated NPNs are NPNs made available via PLMNs e.g. by means of dedicated DNNs, or by one (or more) Network Slice instances allocated for the NPN. The existing network slicing functionalities apply as described in clause 5.15. When a PNI-NPN is made available via a PLMN, then the UE shall have a subscription for the PLMN in order to access PNI-NPN. As network slicing does not enable the possibility to prevent UEs from trying to access the network in areas where the UE is not allowed to use the Network Slice allocated for the NPN, Closed Access Groups may optionally be used to apply access control. A Closed Access Group identifies a group of subscribers who are permitted to access one or more CAG cells associated to the CAG. CAG is used for the PNI-NPNs to prevent UE(s), which are not allowed to access the NPN via the associated cell(s), from automatically selecting and accessing the associated CAG cell(s). The UE and PNI-NPN may support remote provisioning of credentials for NSSAA or credentials for secondary authentication/authorization to the UE, as specified in clause 5.39. Support for Proximity based Services (ProSe) in conjunction with CAG is specified in TS 23.304.

The following is required for identification:

• A CAG is identified by a CAG Identifier which is unique within the scope of a PLMN ID;
• A CAG cell broadcasts one or multiple CAG Identifiers per PLMN;
• A CAG cell may in addition broadcast a human-readable network name per CAG Identifier:

To use CAG, the UE, that supports CAG as indicated as part of the UE 5GMM Core Network Capability, may be pre-configured or (re)configured with the following CAG information, included in the subscription as part of the Mobility Restrictions:

• an Allowed CAG list i.e. a list of CAG Identifiers the UE is allowed to access; and
• each entry of the Allowed CAG list may be associated with time validity information containing one or more time periods; and
• optionally, a CAG-only indication whether the UE is only allowed to access 5GS via CAG cells (see TS 38.304 for how the UE identifies whether a cell is a CAG cell);

The HPLMN may configure or re-configure a UE with the above CAG information using the UE Configuration Update procedure for access and mobility management related parameters described in clause 4.2.4.2 of TS 23.502. The above CAG information is provided by the HPLMN on a per PLMN basis. In a PLMN the UE shall only consider the CAG information provided for this PLMN. The entries of the Allowed CAG list with time validity information are provided to the UE only if the UE indicates support of CAG with validity information. When the subscribed CAG information changes, UDM sets a CAG information Subscription Change Indication and sends it to the AMF. The AMF shall provide the UE with the CAG information when the UDM indicates that the CAG information within the Access and Mobility Subscription data has been changed. When AMF receives the indication from the UDM that the CAG information within the Access and Mobility Subscription has changed, the AMF uses the CAG information received from the UDM to update the UE. Once the AMF updates the UE and obtains an acknowledgment from the UE, the AMF informs the UDM that the update was successful and the UDM clears the CAG information Subscription Change Indication flag. The AMF may update the UE using either the UE Configuration Update procedure after registration procedure is completed, or by including the new CAG information in the Registration Accept or in the Registration Reject or in the Deregistration Request or in the Service Reject. When the UE is roaming and the Serving PLMN provides CAG information, the UE shall update only the CAG information provided for the Serving PLMN while the stored CAG information for other PLMNs are not updated. When the UE is not roaming and the HPLMN provides CAG information, the UE shall update the CAG information stored in the UE with the received CAG information for all the PLMNs. The UE shall store the latest available CAG information for every PLMN for which it is provided and keep it stored when the UE is de-registered or switched off, as described in TS 24.501. The CAG information is only applicable with 5GS.

The following is assumed for network and cell selection, and access control:

• The CAG cell shall broadcast information such that only UEs supporting CAG are accessing the cell (see TS 38.300, TS 38.304);
• In order to prevent access to NPNs for authorized UE(s) in the case of network congestion/overload, existing mechanisms defined for Control Plane load control, congestion and overload control in clause 5.19 can be used, as well as the access control and barring functionality described in clause 5.2.5, or Unified Access Control using the access categories as defined in TS 24.501 can be used.
• For aspects of automatic and manual network selection in relation to CAG, see TS 23.122;
• For aspects related to cell (re-)selection, see TS 38.304;
• If the UE is accessing a CAG cell and the corresponding entry of the Allowed CAG list configured on the UE is associated with time validity information, the UE may trigger cell reselection and/or network selection procedure if the evaluation of the time validity information changes.
• The Mobility Restrictions shall be able to restrict the UE's mobility according to the Allowed CAG list (if configured in the subscription) and include an indication whether the UE is only allowed to access 5GS via CAG cells (if configured in the subscription) as described in clause 5.30.3.3;
• The AMF shall update the Allowed CAG list in the Mobility Restrictions towards NG-RAN if the evaluation of the time validity information of an entry in the Allowed CAG list changes between true and false, unless the AMF releases the NAS signalling connection to the UE based on operator's policy if the evaluation of the validity condition changes from true to false.
• During transition from CM-IDLE to CM-CONNECTED and during Registration after connected mode mobility from E-UTRAN to NG-RAN as described in clause 4.11.1.2.2 of TS 23.502:
  • The AMF shall verify whether UE access is allowed by Mobility Restrictions:
    • If the UE is accessing the 5GS via a CAG cell and if at least one of the CAG Identifier(s) received from the NG-RAN is part of the UE's Allowed CAG list (for entries with time validity information if any, the evaluation of the condition is true), then the AMF accepts the NAS request;
    • If the UE is accessing the 5GS via a CAG cell and if none of the CAG Identifier(s) received from the NG-RAN are part of the UE's Allowed CAG list (for entries with time validity information if any, the evaluation of the condition is true), then the AMF rejects the NAS request and the AMF should include CAG information in the NAS reject message. The AMF shall then release the NAS signalling connection for the UE by triggering the AN release procedure; and
    • If the UE is accessing the 5GS via a non-CAG cell and the UE's subscription contains an indication that the UE is only allowed to access CAG cells, then the AMF rejects the NAS request and the AMF should include CAG information in the NAS reject message. The AMF shall then release the NAS signalling connection for the UE by triggering the AN release procedure.
• During transition from RRC_INACTIVE to RRC_CONNECTED state:
  • When the UE initiates the RRC Resume procedure for RRC_INACTIVE to RRC_CONNECTED state transition in a CAG cell, NG-RAN shall reject the RRC Resume request from the UE if none of the CAG Identifiers supported by the CAG cell are part of the UE's Allowed CAG list according to the Mobility Restrictions received from the AMF or if no Allowed CAG list has been received from the AMF.
  • When the UE initiates the RRC Resume procedure for RRC_INACTIVE to RRC_CONNECTED state transition in a non-CAG cell, NG-RAN shall reject the UE's Resume request if the UE is only allowed to access CAG cells according to the Mobility Restrictions received from the AMF.
• During connected mode mobility procedures within NG-RAN, i.e. handover procedures as described in clause 4.9.1 of TS 23.502:
  • Source NG-RAN shall not handover the UE to a target NG-RAN node if the target is a CAG cell and none of the CAG Identifiers supported by the CAG cell are part of the UE's Allowed CAG list in the Mobility Restriction List or if no Allowed CAG list has been received from the AMF;
  • Source NG-RAN shall not handover the UE to a non-CAG cell if the UE is only allowed to access CAG cells based on the Mobility Restriction List;
  • If the target cell is a CAG cell, target NG-RAN shall reject the N2 based handover procedure if none of the CAG Identifiers supported by the CAG cell are part of the UE's Allowed CAG list in the Mobility Restriction List or if no Allowed CAG list has been received from the AMF;
  • If the target cell is a non-CAG cell, target NG-RAN shall reject the N2 based handover procedure if the UE is only allowed to access CAG cells based on the Mobility Restriction List.
• Update of Mobility Restrictions:
  • When the AMF receives the Nudm_SDM_Notification from the UDM and the AMF determines that the Allowed CAG list or the indication whether the UE is only allowed to access CAG cells have changed;
    • The AMF shall update the Mobility Restrictions in the UE and NG-RAN accordingly under the conditions as described in clause 4.2.4.2 of TS 23.502.

Emergency Services are supported in CAG cells, for UEs supporting CAG, whether normally registered or emergency registered as described in clause 5.16.4 and in clause 4.13.4 of TS 23.502. A UE may camp on an acceptable CAG cell in limited service state as specified in TS 23.122 and TS 38.304, based on operator policy defined in TS 38.300. The UE shall select a PLMN (of a CAG cell or non-CAG cell), as described in TS 23.122 and TS 23.167, when initiating emergency services from limited service state. During handover to a CAG cell, if the UE is not authorized to access the target CAG cell as described in clause 5.30.3.4 and has emergency services, the target NG-RAN node only accepts the emergency PDU Session and the target AMF releases the non-emergency PDU Sessions that were not accepted by the NG-RAN node. Upon completion of handover the UE behave as emergency registered.