This Annex provides guidance on how 5GS features and capabilities can be used to support various Non-Public Network deployment options. Overlay network: Underlay network:

The PLMN operator can provide access to an NPN by using network slicing mechanisms. The following are some considerations in such a PNI-NPN case:

1. The UE has subscription and credentials for the PLMN;
2. The PLMN and NPN service provider have an agreement of where the NPN Network Slice is to be deployed (i.e. in which TAs of the PLMN and optionally including support for roaming PLMNs);
3. The PLMN subscription includes support for Subscribed S-NSSAI to be used for the NPN (see clause 5.15.3);
4. The PLMN operator can offer possibilities for the NPN service provider to manage the NPN Network Slice according to TS 28.533.
5. When the UE registers the first time to the PLMN, the PLMN can configure the UE with URSP including NSSP associating Applications to the NPN S-NSSAI (if the UE also is able to access other PLMN services);
6. The PLMN can configure the UE with Configured NSSAI for the Serving PLMN (see clause 5.15.4);
7. The PLMN and NPN can perform a Network Slice specific authentication and authorization using additional NPN credentials;
8. The UE follows the logic as defined for Network Slicing, see clause 5.15;
9. The network selection logic, access control etc are following the principles for PLMN selection; and
10. The PLMN may indicate to the UE that the NPN S-NSSAI is rejected for the RA when the UE moves out of the coverage of the NPN Network Slice. However, limiting the availability of the NPN S-NSSAI would imply that the NPN is not available outside of the area agreed for the NPN S-NSSAI, e.g. resulting in the NPN PDU Sessions being terminated when the UE moves out of the coverage of the NPN Network Slice. Similarly access to NPN DNNs would not be available via non-NPN cells.
11. In order to prevent access to NPNs for authorized UE(s) in the case of network congestion/overload and if a dedicated S-NSSAI has been allocated for an NPN, the Unified Access Control can be used using the operator-defined access categories with access category criteria type (as defined in TS 24.501) set to the S-NSSAI used for an NPN.
12. If NPN isolation is desired, it is assumed that a dedicated S-NSSAI is configured for the NPN and that the UE is configured to operate in Access Stratum Connection Establishment NSSAI Inclusion Mode a, b or c, see clause 5.15.9, such that NG-RAN receives Requested NSSAI from the UE and it can use the S-NSSAI for AMF selection.

In order to obtain access to PLMN services when the UE is camping in NG-RAN of Stand-alone Non-Public Network, the UE obtains IP connectivity, discovers and establishes connectivity to an N3IWF in the PLMN. In the Figure D.3-1, the N1 (for NPN) represents the reference point between UE and the AMF in Stand-alone Non-Public Network. The NWu (for PLMN) represents the reference point between the UE and the N3IWF in the PLMN for establishing secure tunnel between UE and the N3IWF over the Stand-alone Non-Public Network. N1 (for PLMN) represents the reference point between UE and the AMF in PLMN.

In order to obtain access to Non-Public Network services when the UE is camping in NG-RAN of a PLMN, the UE obtains IP connectivity, discovers and establishes connectivity to an N3IWF in the Stand-alone Non-Public Network. In Figure D.3-2, the N1 (for PLMN) represents the reference point between UE and the AMF in the PLMN. The NWu (for NPN) represents the reference point between the UE and the N3IWF in the stand-alone Non-Public Network for establishing a secure tunnel between UE and the N3IWF over the PLMN. The N1 (for NPN) represents the reference point between UE and the AMF in NPN. When using the mechanism described above to access overlay network via underlay network, the overlay network can act as authorized 3rd party with AF to interact with NEF in the underlay network, to use the existing network exposure capabilities provided by the underlay network defined in clause 4.15 of TS 23.502. This interaction is subject of agreements between the overlay and the underlay network.

When a UE capable of simultaneously connecting to an SNPN and a PLMN and the UE is not set to operate in SNPN access mode for any of the Uu/Yt/NWu interfaces, the UE only performs PLMN selection procedures using the corresponding interface for connection to the PLMN. A UE supporting simultaneous connectivity to an SNPN and a PLMN applies the network selection as applicable for the access and network for SNPN and PLMN respectively. Whether the UE uses SNPN or PLMN for its services is implementation dependent. A UE supporting simultaneous connectivity to an SNPN and a PLMN applies the cell (re-)selection as applicable for the access and network for SNPN and PLMN respectively. Whether the UE uses SNPN or PLMN for its services is implementation dependent.

When UE is accessing the overlay network via the underlay network as described in clause D.3, it is possible to keep the UE in CM-CONNECTED state in the overlay network:

• UE maintains at least one PDU Session in underlay network, from where the N3IWF of the overlay network is reachable via the DN of the PDU Session in underlay network. In this case, the UE is considered as successfully connected to the non-3GPP access of the overlay network, thus UE always attempts to transit to CM-CONNECTED state from CM-IDLE, as described in NOTE 3 in clause 5.5.2.
• IKEv2 liveness check procedure initiated either by UE or N3IWF as defined in clause 7.8 of TS 24.502 and clause 7.9 of TS 24.502 can be utilized to ensure the signalling connection between UE and N3IWF is still valid when UE stays in CM-CONNECTED state. Adjusting the time interval of the liveness check to avoid the deletion of the IKEv2 SA due to inactivity, on both endpoints of the SA.
• If NAT is used, so as to avoid a timeout of the NAT entries between the UPF in the underlay network and the N3IWF in the overlay network, NAT-Traversal mechanisms described in RFC 7296 and NAT-Keepalive described in RFC 3948 are recommended.
• AMF in overlay network keeps the UE in CM-CONNECTED state unless UE or N3IWF triggers the release.
• The NG-RAN node in the underlay network can use the existing information to decide an appropriate RRC state for the UE (e.g. whether release a UE to RRC_INACTIVE).

Depending on the UE's radio capability and implementation, the following existing mechanisms can be used to allow session/service continuity between SNPN and PLMN:

• For Single Radio UE which includes single Rx/Tx and dual Rx/single Tx UE, seamless service continuity is not supported in this release when the UE is moving between the 3GPP access networks of SNPN and PLMN because of the single radio limitation. But the PDU session continuity between SNPN and PLMN can be realized by utilizing the existing handover procedure between non-3GPP access and 3GPP access as defined in clause 4.9.2 of TS 23.502, where one network is acting as non-3GPP access of the other network.
• For Dual Radio (Dual Rx/Dual Tx) UE, the service continuity can be achieved by utilizing the existing handover procedure between non-3GPP access and 3GPP access for PDU session on a single access and the existing user plane resource addition procedure for MA PDU session, where one network is acting as non-3GPP access of the other network
• For PDU session on a single access, UE can register to the same 5GC via both Uu and NWu interfaces from two networks when it is possible, by following the procedure defined in clause 4.2.2 of TS 23.502 if the registration is via Uu, or in clause 4.12.2 of TS 23.502 if the registration is via NWu. The registration via NWu utilizes the user plane which is established in another 5GC using another network's Uu interface. For example, if UE is moving out of its SNPN 3GPP access coverage and would like to continue its SNPN service in PLMN, UE can register to its SNPN 5GC via PLMN's 3GPP access network using NWu interface with SNPN's 5GC before moving out SNPN NG-RAN coverage. Upon mobility, the existing handover procedure between non-3GPP access and 3GPP access defined in clause 4.9.2 of TS 23.502 can be utilized.
• For MA PDU session, if supported by UE and network, UE can register to the same 5GC via Uu and NWu interfaces and establish MA PDU session with ATSSS support to be anchored in the 5GC as defined in clause 4.22.2.2 of TS 23.502, where one network is acting as non-3GPP access of the other network (Figure D.6-1 shows the example of UE with MA PDU session anchored in SNPN UPF when connected to SNPN via Uu and NWu interfaces). Upon mobility, UE can add/activate the user plane resource to the corresponding access type basing on the procedures defined in clause 4.22.7 in TS 23.502.