Content for  TS 24.501  Word version:  19.0.0

When the UE or the network initiates a transaction related procedure (i.e. a procedure consisting of more than one message and the messages are related), it shall include a valid PTI value in the message header of the request message or of the command message. If a response message is sent as result of a received request message or a received command message, the sending entity shall include in the response message the PTI value received within the request message or within the command message (see examples in Figure 6.2.1.1, Figure 6.2.1.2, and Figure 6.2.1.3). If a command message is sent as result of a received request message, the sending entity shall include in the command message the PTI value received with the request message (see examples in Figure 6.2.1.3). If a command message is not sent as result of a received request message, the sending entity shall include in the command message the PTI value set to "no procedure transaction identity assigned" (see examples in Figure 6.2.1.4).

The following PDU Session types are supported:

1. IPv4;
2. IPv6;
3. IPv4v6;
4. Ethernet (EtherType as defined in IEEE Std 802.3 [31A]); and
5. Unstructured.

IP address allocation for IPv4, IPv6 and IPv4v6 PDU session types is described in subclause 6.2.4. Neither a MAC nor an IP address is allocated by the 5GCN to the UE for Ethernet PDU session type.

The SMF is responsible for the session management functions to provide the PDU connectivity service to the UE via the 5GSM signalling between UE and SMF. The session management procedures includes:

1. the UE-requested PDU session establishment procedure;
2. the PDU session authentication and authorization procedure;
3. the UE-requested PDU session modification procedure;
4. the network-requested PDU session modification procedure;
5. the UE-requested PDU session release procedure; and
6. the network-requested PDU session release procedure.

A UE may establish multiple PDU sessions, to the same data network or to different data networks, via 3GPP access and via non-3GPP access at the same time. It is not required for a UE to initiate the PDU session release procedure to release a PDU session associated with another access, if any, due to the reason that the UE initiates the registration procedure or PDU session establishment procedure over the current access. The session management messages between UE and SMF are transferred via AMF as specified in subclause 8.3.

The UE can receive the local area data network (LADN) information consisting of LADN DNNs and LADN service area information (a set of tracking areas that belong to the current registration area) during the registration procedure or the generic UE configuration update procedure (see subclause 5.5.1 and subclause 5.4.4). If the UE supports LADN per DNN and S-NSSAI, the UE can additionally receive the extended local area data network (LADN) information consisting of LADN DNNs, S-NSSAIs and LADN service area information (a set of tracking areas configured per DNN and S-NSSAI that belong to the current registration area) during the registration procedure or the generic UE configuration update procedure (see subclause 5.5.1 and subclause 5.4.4). If the UE is not operating in SNPN access operation mode, the UE considers the received LADN information or the extended LADN information to be valid only in the TAIs of the registered PLMN that are in the LADN service area information, and in the TAIs of the equivalent PLMNs if the LADN service area information includes TAIs for the equivalent PLMNs. When the AMF provides the UE with LADN service area information containing TAIs for the equivalent PLMNs, the AMF shall include these TAIs of the equivalent PLMNs in the UE's registration area. If the UE is operating in SNPN access operation mode, the UE considers the received LADN information or the extended LADN information to be valid only in the TAIs of the registered SNPN that are in the LADN service area information. The LADN DNN(s) received by the UE is also considered as LADN DNN(s) in the equivalent PLMNs. The UE shall consider itself to be located inside the LADN service area based on the LADN service area information. If the UE does not have an LADN service area information for the LADN DNN, the UE shall consider itself to be located outside the LADN service area. When the UE is located in the LADN service area and the UE is in substate 5GMM-REGISTERED.NORMAL-SERVICE, the UE may initiate:

• the UE-requested PDU session establishment procedure with an LADN DNN to establish a PDU session for LADN;
• the UE-requested PDU session establishment procedure with an LADN DNN and an S-NSSAI associated with the LADN to establish a PDU session for LADN if the extended LADN information is available at the UE;
• the UE-requested PDU session modification procedure to modify the PDU session for LADN;
• the service request procedure to re-establish the user-plane resources for the PDU session for LADN; or
• the service request procedure or the UE-initiated NAS transport procedure to send CIoT user data via the control plane for a PDU session for LADN.

When the UE is located outside the LADN service area, the UE is allowed:

• to initiate the UE-requested PDU session release procedure to release a PDU session for LADN; or
• to initiate the UE-requested PDU session modification procedure to indicate a change of 3GPP PS data off UE status.

The AMF shall determine the UE presence in LADN service area as out of the LADN service area in the following cases:

• if the DNN used for the LADN is included in the LADN information and the UE is located outside the LADN service area indicated in the LADN information;
• if the DNN and the S-NSSAI used for the LADN are included in the extended LADN information and the UE is located outside the LADN service area indicated in the extended LADN information;
• if the DNN used for the LADN is included in the extended LADN information and there is no S-NSSAI provided by the UE to establish a PDU session for LADN; or
• if the DNN used for the LADN is included in the extended LADN information and the S-NSSAI provided by the UE to establish a PDU session for LADN is not associated with that LADN.

If the UE has moved out of the LADN service area:

1. the SMF shall:
   1. release the PDU session for LADN; or
   2. release the user-plane resources for the PDU session for LADN and maintain the PDU session for LADN;
   according to operator's policy; and
2. the SMF shall not initiate the transfer of CIoT user data via the control plane to the UE for the PDU session for LADN.

In case a2) and b):

• if the UE has returned to the LADN service area within a specific period of time according to operator's policy, and the network has downlink user data pending, the network re-establishes the user-plane resources for the PDU session for LADN;
• if the UE has returned to the LADN service area within a specific period of time according to operator's policy, and the network has downlink CIoT user data pending, the SMF shall initiate the CIoT user data via the control plane transfer to the UE; and
• if the UE has not returned to the LADN service area after a specific period of time according to operator's policy, the SMF may release the PDU session for LADN.

When the UE moves to 5GMM-DEREGISTERED state, the UE shall delete the stored LADN information, if any, and the stored extended LADN information, if any. Upon inter-system change from N1 mode to S1 mode in EMM-IDLE mode, the UE shall not transfer a PDU session for LADN to EPS. If:

1. the UE supports LADN per DNN and S-NSSAI;
2. the UE has a PDU session established using the DNN and S-NSSAI which are not associated with any LADN service area indicated in the extended LADN information;
3. an LADN service area is configured in the extended LADN information which is associated with the DNN and S-NSSAI of the PDU session; and
4. the AMF determines the UE presence in LADN service area as out of the LADN service area configured in the extended LADN information;

the AMF requests the SMF to release this PDU session as specified in TS 23.502. If:

1. the UE supports LADN per DNN and S-NSSAI;
2. the UE has a PDU session for LADN established; and
3. the AMF determines that the LADN service area associated with the DNN and S-NSSAI of the PDU session for LADN is removed from the extended LADN information;

the AMF requests the SMF to release this PDU session as specified in TS 23.502.

The network may detect and start performing DNN based congestion control when one or more DNN congestion criteria as specified in TS 23.501 are met. If the UE does not provide a DNN for a non-emergency PDU session, then the network uses the selected DNN. In the UE, 5GS session management timers T3396 for DNN based congestion control are started and stopped on a per DNN basis except for an LADN DNN in case of PLMN. For an LADN DNN, 5GS session management timers T3396 for DNN based congestion control is applied to the registered PLMN and its equivalent PLMNs. In case of SNPN, if the UE does not support access to an SNPN using credentials from a credentials holder and equivalent SNPNs, in the UE, 5GS session management timers T3396 for DNN based congestion control are started and stopped on a per DNN and SNPN basis. If the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, in the UE 5GS session management timers T3396 for DNN based congestion control are started and stopped on a per DNN, SNPN and selected entry of the "list of subscriber data" or selected PLMN subscription basis. Upon receipt of a 5GMM message or 5GSM message from the network for which the UE needs to stop the running timers T3396 associated with an LADN DNN as specified in subclause 6.3.2.3, 6.3.3.3, 6.4.1.4.2 and 6.4.2.4.2, only the running timer T3396 which is associated with the PLMN and equivalent PLMNs where the timer was started is stopped. In an SNPN, if the UE supports equivalent SNPNs, the UE applies the timer T3396 for all the equivalent SNPNs, otherwise the UE applies the timer T3396 for the registered SNPN. The DNN associated with T3396 is the DNN provided by the UE during the PDU session establishment. If no DNN is provided by the UE along the PDU SESSION ESTABLISHMENT REQUEST, then T3396 is associated with no DNN. For this purpose, the UE shall memorize the DNN provided to the network during the PDU session establishment. The timer T3396 associated with no DNN will never be started due to any 5GSM procedure related to an emergency PDU session. If the timer T3396 associated with no DNN is running, it does not affect the ability of the UE to request an emergency PDU session. In a PLMN, if T3396 is running or is deactivated, then the UE is not allowed to initiate the:

1. PDU session establishment procedure;
2. PDU session modification procedure; or
3. NAS transport procedure for sending CIoT user data;

for the respective DNN or without a DNN unless the UE is a UE configured for high priority access in selected PLMN or to report a change of 3GPP PS data off UE status. In an SNPN, if T3396 is running or is deactivated for the registered SNPN, is associated with a DNN or with no DNN, with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, with the selected entry of the "list of subscriber data" or the selected PLMN subscription, then the UE is not allowed to initiate the

1. PDU session establishment procedure; or
2. PDU session modification procedure;

for the respective DNN or without a DNN unless the UE is a UE configured for high priority access in the RSNPN or to report a change of 3GPP PS data off UE status. In an SNPN, if the UE supports equivalent SNPNs, the timer T3396 is running or is deactivated for all the equivalent SNPNs, is associated with a DNN or no DNN, with the RSNPN or an equivalent SNPN, and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, then the UE is not allowed to initiate the:

1. PDU session establishment procedure; or
2. PDU session modification procedure;

for the respective DNN or without a DNN unless the UE is a UE configured for high priority access in selected SNPN or to report a change of 3GPP PS data off UE status. If the network does not include timer T3396 with 5GSM cause #26 "insufficient resources", the UE may use a local back-off timer that has exponential value or a default value, which is provisioned using implementation specific means, to:

1. prevent sending any 5GSM procedure for the respective DNN till its expiry; and
2. allow sending any 5GSM procedure for the respective DNN after its expiry.

The network may detect and start performing S-NSSAI based congestion control when one or more S-NSSAI congestion criteria as specified in TS 23.501 are met. If the UE does not provide a DNN for a non-emergency PDU session, then the network uses the selected DNN. If the UE does not provide an S-NSSAI for a non-emergency PDU session, then the network uses the selected S-NSSAI. In case of PLMN or SNPN, in the UE, 5GS session management timers T3584 for the S-NSSAI based congestion control are started and stopped on a per S-NSSAI, DNN and PLMN or SNPN basis. If the 5GSM congestion re-attempt indicator IE with the ABO bit set to "The back-off timer is applied in all PLMNs or equivalent SNPNs" is included in the 5GSM message with the 5GSM cause value #67 "insufficient resources for specific slice and DNN", then the UE applies the timer T3584 for all the PLMNs or all the equivalent SNPNs. Otherwise, the UE applies the timer T3584 for the registered PLMN or the registered SNPN. If the timer T3584 applies for all the PLMNs or all the equivalent SNPNs, the timer T3584 starts when the UE is registered in a VPLMN or an unsubscribed SNPN and the S-NSSAI is provided by the UE during the PDU session establishment, the timer T3584 is associated with the [mapped S-NSSAI, DNN] combination of the PDU session. In case of PLMN or SNPN, in the UE, 5GS session management timers T3585 for the S-NSSAI based congestion control are started and stopped on a per S-NSSAI and PLMN or SNPN basis. If the 5GSM congestion re-attempt indicator IE with the ABO bit set to "The back-off timer is applied in all PLMNs or all equivalent SNPNs" is included in the 5GSM message with the 5GSM cause value #69 "insufficient resources for specific slice", then the UE applies the timer T3585 for all the PLMNs or all the equivalent SNPNs. Otherwise, the UE applies the timer T3585 for the registered PLMN or registered SNPN. If the timer T3585 applies for all the PLMNs or all the equivalent SNPNs, the timer T3585 starts when the UE is registered in a VPLMN or an unsubscribed SNPN and the S-NSSAI is provided by the UE during the PDU session establishment, the timer T3585 is associated with the mapped S-NSSAI of the PDU session. Additionally, if the 5GSM congestion re-attempt indicator IE with the CATBO bit set to "The back-off timer is applied in the current access type" is included in the 5GSM message with the 5GSM cause value #69 "insufficient resources for specific slice", then the UE applies the timer T3585 for the current access type. Otherwise, the UE applies the timer T3585 for both 3GPP access type and non-3GPP access type and the UE shall stop any running timer T3585 for the applied PLMN or SNPN and for the access different from the access from which the message is received. In case of SNPN, if the UE does not support access to an SNPN using credentials from a credentials holder and equivalent SNPNs, in the UE 5GS session management timers T3584 for the S-NSSAI based congestion control are started and stopped on a per S-NSSAI, DNN and SNPN basis. If the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, in the UE 5GS session management timers T3584 for the S-NSSAI based congestion control are started and stopped on a per S-NSSAI, DNN, SNPN and selected entry of the "list of subscriber data" or selected PLMN subscription basis. In case of SNPN, if the UE does not support access to an SNPN using credentials from a credentials holder and equivalent SNPNs, in the UE 5GS session management timers T3585 for the S-NSSAI based congestion control are started and stopped on a per S-NSSAI and SNPN basis. If the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, in the UE 5GS session management timers T3585 for the S-NSSAI based congestion control are started and stopped on a per S-NSSAI, SNPN and selected entry of the "list of subscriber data" or selected PLMN subscription basis. If the timer T3584 or timer T3585 was provided during the PDU session establishment procedure, the S-NSSAI associated with T3584 or T3585, respectively is the S-NSSAI, including no S-NSSAI, provided by the UE during the PDU session establishment. If the timer T3584 is provided during the PDU session modification or PDU session release procedure, the UE behaves as follows: The DNN associated with T3584 is the DNN provided by the UE during the PDU session establishment. If no S-NSSAI but DNN is provided by the UE along the PDU SESSION ESTABLISHMENT REQUEST message, then T3584 is associated with no S-NSSAI and the DNN provided to the network during the PDU session establishment. If the PDN connection was established when in the S1 mode, then T3584 is associated with no S-NSSAI. If no DNN but S-NSSAI is provided by the UE along the PDU SESSION ESTABLISHMENT REQUEST message, then T3584 is associated with no DNN and the S-NSSAI of the PDU session. If no DNN and no S-NSSAI is provided by the UE along the PDU SESSION ESTABLISHMENT REQUEST message, then T3584 is associated with no DNN and no S-NSSAI. For this purpose, the UE shall memorize the DNN and the S-NSSAI provided to the network during the PDU session establishment. The timer T3584 associated with no DNN and an S-NSSAI will never be started due to any 5GSM procedure related to an emergency PDU session. If the timer T3584 associated with no DNN and an S-NSSAI is running, it does not affect the ability of the UE to request an emergency PDU session. If the timer T3585 was provided during the PDU session modification or PDU session release procedure, the UE behaves as follows: if an S-NSSAI was provided by the UE during the PDU session establishment, then T3585 is associated with the S-NSSAI of the PDU session. If no S-NSSAI is provided by the UE along the PDU SESSION ESTABLISHMENT REQUEST message, then T3585 is associated with no S-NSSAI. If the PDN connection was established when in the S1 mode, then T3585 is associated with no S-NSSAI. If T3584 is running or is deactivated, then the UE is not allowed to initiate the:

1. PDU session establishment procedure;
2. PDU session modification procedure; or
3. NAS transport procedure for sending CIoT user data;

for the respective [S-NSSAI, no DNN] or [S-NSSAI, DNN] combination unless the UE is a UE configured for high priority access in selected PLMN or SNPN or to report a change of 3GPP PS data off UE status. In a PLMN, if the timer T3584 is running or is deactivated for all the PLMNs and is associated with an S-NSSAI other than no S-NSSAI, then

1. the UE registered in the HPLMN is not allowed to initiate the:
   1. PDU session establishment procedure;
   2. PDU session modification procedure; or
   3. NAS transport procedure for sending CIoT user data;
   when the [S-NSSAI, no DNN] or [S-NSSAI, DNN] combination provided by the UE during the PDU session establishment is the same as the [S-NSSAI, no DNN] or [S-NSSAI, DNN] combination associated with the timer T3584 unless the UE is a UE configured for high priority access in selected PLMN or to report a change of 3GPP PS data off UE status; and
2. the UE registered in a VPLMN is not allowed to initiate the:
   1. PDU session establishment procedure;
   2. PDU session modification procedure; or
   3. NAS transport procedure for sending CIoT user data;
   when the [mapped S-NSSAI, no DNN] or [mapped S-NSSAI, DNN] combination provided by the UE during the PDU session establishment is the same as the [S-NSSAI, no DNN] or [S-NSSAI, DNN] combination associated with the timer T3584 unless the UE is a UE configured for high priority access in selected PLMN or to report a change of 3GPP PS data off UE status.

In a PLMN, if the timer T3584 is running or is deactivated for all the PLMNs and is associated with [no S-NSSAI, no DNN] or [no S-NSSAI, DNN] combination, then the UE is not allowed to initiate the:

1. PDU session establishment procedure;
2. PDU session modification procedure; or
3. NAS transport procedure for sending CIoT user data;

for [no S-NSSAI, no DNN] or [no S-NSSAI, DNN] combination in any PLMN unless the UE is a UE configured for high priority access in selected PLMN or to report a change of 3GPP PS data off UE status. In an SNPN, if the UE supports equivalent SNPNs, the timer T3584 is running or is deactivated for all the equivalent SNPNs, is associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, with an S-NSSAI other than no S-NSSAI, and with the RSNPN or an equivalent SNPN:

1. the UE registered in the subscribed SNPN is not allowed to initiate the:
   1. PDU session establishment procedure; or
   2. PDU session modification procedure;
   when the [S-NSSAI, no DNN] or [S-NSSAI, DNN] combination provided by the UE during the PDU session establishment is the same as the [S-NSSAI, no DNN] or [S-NSSAI, DNN] combination associated with the timer T3584 unless the UE is a UE configured for high priority access in the RSNPN or to report a change of 3GPP PS data off UE status; and
2. the UE registered in a non-subscribed is not allowed to initiate the:
   1. PDU session establishment procedure; or
   2. PDU session modification procedure;
   when the [mapped S-NSSAI, no DNN] or [mapped S-NSSAI, DNN] combination provided by the UE during the PDU session establishment is the same as the [S-NSSAI, no DNN] or [S-NSSAI, DNN] combination associated with the timer T3584 unless the UE is a UE configured for high priority access in RSNPN or to report a change of 3GPP PS data off UE status.

In an SNPN, if the UE supports equivalent SNPNs, the timer T3584 is running or is deactivated for all the equivalent SNPNs, is associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, with [no S-NSSAI, no DNN] or [no S-NSSAI, DNN] combination, and with the RSNPN or an equivalent SNPN, then the UE is not allowed to initiate the:

1. PDU session establishment procedure; or
2. PDU session modification procedure;

for [no S-NSSAI, no DNN] or [no S-NSSAI, DNN] combination unless the UE is a UE configured for high priority access in the RSPN or to report a change of 3GPP PS data off UE status. If T3585 is running or is deactivated, then the UE is neither allowed to initiate the PDU session establishment procedure nor the PDU session modification procedure for the respective S-NSSAI unless the UE is a UE configured for high priority access in selected PLMN or SNPN or to report a change of 3GPP PS data off UE status. In a PLMN, if the timer T3585 is running or is deactivated for all the PLMNs and is associated with an S-NSSAI other than no S-NSSAI, then

1. the UE registered in the HPLMN is not allowed to initiate the:
   1. PDU session establishment procedure;
   2. PDU session modification procedure; or
   3. NAS transport procedure for sending CIoT user data;
   when the S-NSSAI provided by the UE during the PDU session establishment is the same as the S-NSSAI associated with timer T3585 unless the UE is a UE configured for high priority access in selected PLMNs or to report a change of 3GPP PS data off UE status; and
2. the UE registered in a VPLMN is not allowed to initiate the:
   1. PDU session establishment procedure;
   2. PDU session modification procedure; or
   3. NAS transport procedure for sending CIoT user data;
   when the mapped S-NSSAI provided by the UE during the PDU session establishment is the same as the S-NSSAI associated the timer T3585 unless the UE is a UE configured for high priority access in selected PLMN or to report a change of 3GPP PS data off UE status.

In a PLMN, if the timer T3585 is running or is deactivated for all the PLMNs and is associated with no S-NSSAI, then the UE is not allowed to initiate the:

1. PDU session establishment procedure;
2. PDU session modification procedure;
3. NAS transport procedure for sending CIoT user data;

for no S-NSSAI in any PLMN unless the UE is a UE configured for high priority access in selected PLMN or to report a change of 3GPP PS data off UE status.In an SNPN, if the UE supports equivalent SNPNs, the timer T3585 is running or is deactivated for all the equivalent SNPNs, is associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, with an S-NSSAI other than no S-NSSAI, and with the RSNPN or an equivalent SNPN:

1. the UE registered in the subscribed SNPN is not allowed to initiate the:
   1. PDU session establishment procedure; or
   2. PDU session modification procedure;
   when the S-NSSAI provided by the UE during the PDU session establishment is the same as the S-NSSAI associated with timer T3585 unless the UE is a UE configured for high priority access in the RSNPN or to report a change of 3GPP PS data off UE status; and
2. the UE registered in a non-subscribed SNPN is not allowed to initiate the:
   1. PDU session establishment procedure; or
   2. PDU session modification procedure;
   when the mapped S-NSSAI provided by the UE during the PDU session establishment is the same as the S-NSSAI associated the timer T3585 unless the UE is a UE configured for high priority access in the RSNPN or to report a change of 3GPP PS data off UE status.

In an SNPN, if the UE supports equivalent SNPNs, the timer T3585 is running or is deactivated for all the equivalent SNPNs, is associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, with no S-NSSAI, and with the RSNPN or an equivalent SNPN, then the UE is not allowed to initiate the:

1. PDU session establishment procedure; or
2. PDU session modification procedure;

for no S-NSSAI unless the UE is a UE configured for high priority access in RSNPN or to report a change of 3GPP PS data off UE status. If the network does not include timer T3584 with 5GSM cause #67 "insufficient resources for specific slice and DNN", the UE may use a local back-off timer that has exponential value or a default value, which is provisioned using implementation specific means, to:

1. prevent sending any 5GSM procedure for the respective DNN and S-NSSAI till its expiry; and
2. allow sending any 5GSM procedure for the respective DNN and S-NSSAI after its expiry.

If the network does not include timer T3585 with 5GSM cause #69 "insufficient resources for specific slice", the UE may use a local back-off timer that has exponential value or a default value, which is provisioned using implementation specific means, to:

1. prevent sending any 5GSM procedure for the respective S-NSSAI till its expiry; and
2. allow sending any 5GSM procedure for the respective S-NSSAI after its expiry.

In case of PLMN, a UE, which supports 3GPP PS data off (see TS 23.501), can be configured with up to two lists of 3GPP PS data off exempt services as specified in TS 24.368 or in the EF3GPPPSDATAOFF EF3GPPPSDataOff USIM file as specified in TS 31.102:

1. a list of 3GPP PS data off exempt services to be used in the HPLMN or EHPLMN; and
2. a list of 3GPP PS data off exempt services to be used in the VPLMN.

If only the list of 3GPP PS data off exempt services to be used in the HPLMN or EHPLMN is configured at the UE, this list shall be also used in the VPLMN. In case of SNPN, a UE, which supports 3GPP PS data off (see TS 23.501), can be configured with:

1. up to two lists of 3GPP PS data off exempt services as specified in TS 24.368 for each subscribed SNPN whose entry exists in the "list of subscriber data":
   1. a list of 3GPP PS data off exempt services to be used in the subscribed SNPN; and
   2. a list of 3GPP PS data off exempt services to be used in the non-subscribed SNPN; and
2. one list of 3GPP PS data off exempt services as specified in TS 24.368 for PLMN subscription:
   1. a list of 3GPP PS data off exempt services to be used in the non-subscribed SNPN.

If only the list of 3GPP PS data off exempt services to be used in the subscribed SNPN is configured for the selected entry of "list of subscriber data", this list shall be also used in the non-subscribed SNPN. If the UE supports 3GPP PS data off, the UE shall provide the 3GPP PS data off UE status in the Extended protocol configuration options IE during UE-requested PDU session establishment procedure except for the transfer of a PDU session from non-3GPP access to 3GPP access and except for the establishment of user plane resources on the other access for the MA PDU session(see subclause 6.4.1), and during UE-requested PDU session modification procedure (see subclause 6.4.2), regardless of associated access type of the PDU session. If the UE requests a PDU session establishment procedure in order to transfer a PDU session from non-3GPP access to 3GPP access, or in order to establish user plane resources on the other access for the MA PDU session over 3GPP access or non-3GPP access, and:

1. if the 3GPP PS data off UE status has changed since the last providing to the network, the UE shall provide the 3GPP PS data off UE status in the Extended protocol configuration options IE; or
2. if the 3GPP PS data off UE status has not changed since the last providing to the network, the UE need not provide the 3GPP PS data off UE status.

The network shall support of 3GPP PS data off. The UE shall indicate change of the 3GPP PS data off UE status for the PDU session by using the UE-requested PDU session modification procedure as specified in subclause 6.4.2. When the 3GPP PS data off UE status is "activated":

1. the UE does not send uplink IP packets via 3GPP access except:
   1. for those services indicated in the list of 3GPP PS data off exempt services to be used in the HPLMN or EHPLMN as specified in TS 24.368 when the UE is in its HPLMN or EHPLMN;
   2. for those services indicated in the list of 3GPP PS data off exempt services to be used in the subscribed SNPN, configured for the selected entry of "list of subscriber data", as specified in TS 24.368 when the UE is in the subscribed SNPN;
   3. for those services indicated in the list of 3GPP PS data off exempt services to be used in the HPLMN or EHPLMN when the UE is in the VPLMN, if only the list of 3GPP PS data off exempt services to be used in the HPLMN or EHPLMN is configured to the UE as specified in TS 24.368;
   4. for those services indicated in the list of 3GPP PS data off exempt services to be used in the subscribed SNPN, configured for the selected entry of "list of subscriber data", when the UE is in a non-subscribed SNPN and only the list of 3GPP PS data off exempt services to be used in the subscribed SNPN is configured for the selected entry of "list of subscriber data" as specified in TS 24.368;
   5. for those services indicated in the list of 3GPP PS data off exempt services to be used in the VPLMN when the UE is in the VPLMN, if the list of 3GPP PS data off exempt services to be used in the VPLMN is configured to the UE as specified in TS 24.368;
   6. for those services indicated in the list of 3GPP PS data off exempt services to be used in the non-subscribed SNPN, configured for the selected entry of "list of subscriber data", when the UE is in a non-subscribed SNPN and the list of 3GPP PS data off exempt services to be used in the non-subscribed SNPN is configured for the selected entry of "list of subscriber data" as specified in TS 24.368;
   7. for those services indicated in the list of 3GPP PS data off exempt services to be used in the non-subscribed SNPN, configured for the selected PLMN subscription, when the UE is in the non-subscribed SNPN and the list of 3GPP PS data off exempt services to be used in the non-subscribed SNPN is configured for the selected PLMN subscription as specified in TS 24.368;
   8. for those services indicated in the EF3GPPPSDATAOFF EF3GPPPSDataOff USIM file as specified in TS 31.102;
   9. any uplink traffic due to procedures specified in TS 24.229; and
   10. any uplink traffic due to procedures specified in TS 24.623;
2. the UE does not send uplink Ethernet user data packets via 3GPP access; and
3. the UE does not send uplink Unstructured user data packets via 3GPP access.

Otherwise the UE sends uplink user data packets without restriction. 3GPP PS data off does not restrict sending of uplink user data packets via non-3GPP access of a single access PDU session or an MA PDU session.

The UE supporting IPv6 may support multi-homed IPv6 PDU session. If the UE supports the multi-homed IPv6 PDU session:

1. the UE shall support acting as a type C host as specified in RFC 4191; and
2. the UE indicates support of the multi-homed IPv6 PDU session:
   1. during the UE-requested PDU session establishment of a PDU session of "IPv6" or "IPv4v6" PDU session type; and
   2. during the UE-requested PDU session modification performed after an inter-system change from S1 mode to N1 mode, for a PDU session associated with a PDN connection established when in S1 mode, if the UE is a UE operating in single-registration mode in a network supporting N26 interface, the PDU session is of "IPv6" or "IPv4v6" PDU session type, and the UE has not previously successfully performed the UE-requested PDU session modification to provide this indication.

The network may include a back-off timer value in a 5GS session management reject message to regulate the time interval at which the UE may retry the same procedure for 5GSM cause values other than #26 "insufficient resources", #28 "unknown PDU session type", #39 "reactivation requested", #46 "out of LADN service area", #50 "PDU session type IPv4 only allowed", #51 "PDU session type IPv6 only allowed", #54 "PDU session does not exist", #57 "PDU session type IPv4v6 only allowed", #58 "PDU session type Unstructured only allowed", #61 "PDU session type Ethernet only allowed", #67 "insufficient resources for specific slice and DNN", #68 "not supported SSC mode" and #69 "insufficient resources for specific slice". For 5GSM cause values other than #26 "insufficient resources", #28 "unknown PDU session type", #39 "reactivation requested", #46 "out of LADN service area", #54 "PDU session does not exist", #67 "insufficient resources for specific slice and DNN", #68 "not supported SSC mode", and #69 "insufficient resources for specific slice", and #86 "UAS services not allowed", the network may also include the re-attempt indicator to indicate whether the UE is allowed to re-attempt the corresponding session management procedure for the same DNN in S1 mode after inter-system change. If re-attempt in S1 mode is allowed for 5GSM cause values other than #27 "missing or unknown DNN", the UE shall consider the back-off timer to be applicable only to the 5GS session management in N1 mode for the rejected 5GS session management procedure and the given [PLMN, DNN, S-NSSAI], [PLMN, DNN, no S-NSSAI], [PLMN, no DNN, S-NSSAI], or [PLMN, no DNN, no S-NSSAI] combination. If re-attempt in S1 mode is allowed for 5GSM cause value #27 "missing or unknown DNN", the UE shall consider the back-off timer to be applicable only to the 5GS session management in N1 mode for the rejected 5GS session management procedure and the given [PLMN, DNN], or [PLMN, no DNN] combination.If re-attempt in S1 mode is not allowed, the UE shall consider the back-off timer to be applicable to both NAS protocols, i.e. applicable to the 5GS session management in N1 mode for the rejected 5GS session management procedure and to the EPS session management in S1 mode for the corresponding session management procedure and the given [PLMN, DNN] or [PLMN, no DNN] combination. In a PLMN, if the back-off timer was provided during the PDU session establishment procedure, the UE behaves as follows: for 5GSM cause values other than #27 "missing or unknown DNN", when the UE is registered in a HPLMN, the DNN and the S-NSSAI of the [PLMN, DNN, S-NSSAI] combination associated with the back-off timer is the DNN and the S-NSSAI provided by the UE when the PDU session is established. When the UE is registered in a VPLMN, the DNN and the S-NSSAI of the [PLMN, DNN, S-NSSAI] combination associated with the back-off timer is the DNN and the mapped S-NSSAI provided by the UE when the PDU session is established. For 5GSM cause value #27 "missing or unknown DNN", the DNN of the [PLMN, DNN] combination associated with the back-off timer is the DNN provided by the UE when the PDU session is established. If no DNN or no S-NSSAI was provided to the network during the PDU session establishment, then the back-off timer is associated with the [PLMN, DNN, no S-NSSAI], [PLMN, no DNN, S-NSSAI], or [PLMN, no DNN, no S-NSSAI] combination, dependent on which parameters were provided for 5GSM cause values other than #27 "missing or unknown DNN". If no DNN was provided to the network during the PDU session establishment, then the back-off timer is associated with the [PLMN, no DNN] combination for 5GSM cause value #27 "missing or unknown DNN". For this purpose, the UE shall memorize the DNN and the S-NSSAI provided to the network during the PDU session establishment. In a PLMN, if the back-off timer was provided during the PDU session modification procedure, the UE behaves as follows: the DNN associated with the back-off timer is the DNN, including no DNN, provided by the UE when the PDU session is established. If an S-NSSAI was provided by the UE during the PDU session establishment, when the UE is registered in a HPLMN, then the S-NSSAI associated with the back-off timer is the S-NSSAI of the PDU session. If an S-NSSAI was provided by the UE during the PDU session establishment, when the UE is registered in a VPLMN, then the S-NSSAI associated with the back-off timer is the mapped S-NSSAI of the PDU session. If no S-NSSAI was provided by the UE during the PDU session establishment, then the back-off timer is associated with no S-NSSAI. For this purpose, the UE shall memorize the DNN and the S-NSSAI provided to the network during the PDU session establishment. In a PLMN, the back-off timer associated with the [PLMN, no DNN, no S-NSSAI], or [PLMN, no DNN] combination will never be started due to any 5GSM procedure related to an emergency PDU session. If the back-off timer associated with the [PLMN, no DNN, no S-NSSAI], or [PLMN, no DNN] combination is running, it does not affect the ability of the UE to request an emergency PDU session. In an SNPN, the back-off timer associated with the [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN, no S-NSSAI], or [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN] combination will never be started due to any 5GSM procedure related to an emergency PDU session. If the back-off timer associated with the back-off timer associated with the [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN, no S-NSSAI], or [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN] combination, it does not affect the ability of the UE to request an emergency PDU session. In a PLMN, the network may additionally indicate in the re-attempt indicator that a command to back-off is applicable not only for the PLMN in which the UE received the 5GS session management reject message, but for each PLMN included in the equivalent PLMN list at the time when the 5GS session management reject message was received. In an SNPN, the network may additionally indicate in the re-attempt indicator that a command to back-off is applicable not only for the SNPN in which the UE received the 5GS session management reject message, but for each SNPN included in the equivalent SNPN list at the time when the 5GS session management reject message was received. In a PLMN, if the back-off timer is running or is deactivated for a given [PLMN, DNN, S-NSSAI], [PLMN, DNN, no S-NSSAI], [PLMN, no DNN, S-NSSAI], [PLMN, no DNN, no S-NSSAI], [PLMN, DNN], or [PLMN, no DNN] combination, and the UE is a UE configured for high priority access in selected PLMN, then the UE is allowed to initiate 5GSM procedures for the [PLMN, DNN, S-NSSAI], [PLMN, DNN, no S-NSSAI], [PLMN, no DNN, S-NSSAI], [PLMN, no DNN, no S-NSSAI], [PLMN, DNN], or [PLMN, no DNN] combination. In an SNPN, if the back-off timer is running or is deactivated for a given [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, DNN, S-NSSAI], [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, DNN, no S-NSSAI], [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN, S-NSSAI], [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN, no S-NSSAI], [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, DNN], or [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN] combination if the UE is a UE configured for high priority access in selected SNPN, then the UE is allowed to initiate 5GSM procedures for the [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, DNN, S-NSSAI], [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, DNN, no S-NSSAI], [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN, S-NSSAI], [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN, no S-NSSAI], [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, DNN], or [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN] combination. The RATC bit in the re-attempt indicator IE and its derivation shall not be applicable in an SNPN. If the network does not include a back-off timer with 5GSM cause #29 "user authentication or authorization failed", #31 "request rejected, unspecified", and #38 "network failure", the UE may use a local back-off timer that has exponential value or a default value, which is provisioned using implementation specific means, to:

1. prevent sending the rejected 5GSM procedure for the respective DNN till its expiry; and
2. allow sending the rejected 5GSM procedure for the respective DNN after its expiry.

Small data rate control is applicable only to NB-N1 mode and WB-N1 mode. Small data rate control controls the maximum number of uplink user data messages including uplink exception data reporting sent by the UE in a time interval for the PDU session in accordance with TS 23.501. The UE shall limit the rate at which it generates uplink user data messages to comply with the small data rate control policy. The NAS shall provide the indicated rates to upper layers for enforcement. The indicated rates in a NAS procedure applies to the PDU session the NAS procedure corresponds to, and the indicated rates are valid until a new value is indicated or the PDU session is released. If the UE indicates support for CIoT 5GS optimizations, the network may provide the small data rate control parameters to the UE and may provide the small data rate control parameters for exception data to the UE if and only if the small data rate control parameters is provided to the UE. Small data rate control parameters and small data rate control parameters for exception data can also be provided to the UE in S1 mode as specified in TS 24.301. If an allowed indication of additional exception reports is provided with the small data rate control parameters and:

• the additional small data rate control parameters for exception data is provided and the limit for additional rate for exception data reporting is not reached; or
• the additional small data rate control parameters for exception data is not provided,

the UE is allowed to send uplink exception reports even if the limit for the small data rate control has been reached. During a PDU session release procedure, if the small data rate control was applied to the PDU session that is being released, the network may store the small data rate control status for the released PDU session as specified in TS 23.501. If:

1. the UE indicates support for CIoT 5GS optimizations; and
2. the small data rate control status was stored for the PDU session and is still valid,

the network may provide the remaining small data rate control status as initial small data rate control parameters to the UE and initial small data rate control parameters for exception data to the UE during a subsequent PDU session establishment procedure. If received during the establishment of a PDU session, the UE shall apply the initial small data rate control parameters and the initial small data rate control parameters for exception data for the duration of the validity period. When the validity period expires the small data rate control parameters and the small data rate control parameters for exception data shall be applied (see TS 23.501). Upon inter-system change from N1 mode to S1 mode, the UE shall store the current small data rate control status for PDU sessions to be transferred from N1 mode to S1 mode as specified in TS 23.501. Upon inter-system change from S1 mode to N1 mode, the UE shall use the stored small data rate control status, if any, to comply with the small data rate control policy for PDU sessions transferred from S1 mode to N1 mode as specified in TS 23.501, if the validity period of the stored small data rate control status has not expired.

Serving PLMN rate control is applicable only for PDU sessions established for control plane CIoT 5GS optimization. Serving PLMN rate control protect its AMF from the load generated by user data over control plane. The SMF can inform the UE of any local serving PLMN rate control during the PDU session establishment procedure (see subclause 6.4.1) or the PDU session modification procedure (see subclause 6.4.2). If serving PLMN rate control is enabled, the SMF shall start the serving PLMN rate control for the PDU session when the first control plane user data is received over the PDU session.The UE shall limit the rate at which it generates uplink control plane user data to comply with the serving PLMN policy provided by the network. The indicated rate in a NAS procedure applies to the PDU session the NAS procedure corresponds to, and the indicated rate is valid until the PDU session is released. Any Serving PLMN rate control information provided by the network to the UE is only applicable for the PLMN which provided this information. This serving PLMN rate control information shall be discarded when the UE successfully registers to another PLMN.

If the UE supports Reliable Data Service (see TS 23.501 and TS 24.250), the UE may request data transfer using Reliable Data Service for a PDU session in the Extended protocol configuration options IE during UE-requested PDU session establishment procedure (see subclause 6.4.1). The Reliable Data Service may only be used with PDU sessions for which the "Control Plane CIoT 5GS Optimisation" indicator is set or with PDU sessions using the control plane CIoT 5GS optimization when the AMF does not move such PDU sessions to the user plane. The network shall inform the UE about the acceptance of UE's request for Reliable Data Service usage during the PDU session establishment procedure (see subclause 6.4.1) in the Extended protocol configuration options IE. If the network accepts the use of Reliable Data Service to transfer data for the specified PDU session, the UE shall use this PDU session exclusively for data transfer using Reliable Data Service; otherwise the UE shall not use this PDU session for data transfer using Reliable Data Service.

The UE and the SMF may use:

• IP header compression for PDU sessions of "IPv4", "IPv6" or "IPv4v6" PDU session type; and
• Ethernet header compression for PDU sessions of "Ethernet" PDU session type.

Both the UE and the AMF indicate whether header compression for control plane CIoT 5GS optimization is supported during registration procedures (see subclause 5.5.1). If both the UE and the network support header compression, the header compression configuration for each PDU session is negotiated during the PDU session establishment procedure and PDU session modification procedure as specified in subclauses 6.3.2, 6.4.1 and 6.4.2. For IP header compression, ROHC protocol specified in RFC 5795 is used. The IP header compression configuration used for IP header compression is (re-)negotiated between the UE and the SMF using the IP header compression configuration IE as specified in subclauses 6.3.2.2, 6.4.1.2, 6.4.1.3 and 6.4.2.2, respectively. For Ethernet header compression, Ethernet Header Compression (EHC) protocol specified in TS 38.323 is used. The Ethernet header compression configuration used for Ethernet header compression is (re-)negotiated between the UE and the SMF using the Ethernet header compression configuration IE as specified in subclauses 6.3.2.2, 6.4.1.2, 6.4.1.3 and 6.4.2.2, respectively.

EAS discovery, EAS rediscovery and ECS address provisioning provide enhanced edge computing support in 5GS (see TS 23.548). If the network supports the session breakout connectivity model or distributed anchor connectivity model to enable edge computing enhancements and the UE generated DNS message is to be handled by an edge application server discovery function (EASDF) for EAS discovery as specified in TS 23.548, the SMF selects the EASDF and it provides its IP address to the UE as the DNS server to be used for the PDU session in the Extended protocol configuration options IE during the UE-requested PDU session establishment procedure as described in subclause 6.4.1.3. If the network supports the session breakout connectivity model to enable edge computing enhancements and the UE generated DNS message is to be handled by a local DNS server for EAS discovery as specified in TS 23.548, the SMF selects the local DNS server, obtains its IP address and can provide the IP address of the local DNS server to the UE as the DNS server to be used for the PDU session in the Extended protocol configuration options IE during the UE-requested PDU session establishment procedure or the network-requested PDU session modification procedure as described in subclauses 6.4.1.3 and 6.3.2.2, respectively. If the UE supports EAS rediscovery and the SMF decides to trigger the EAS rediscovery as specified in TS 23.548, the SMF initiates a network-requested PDU session modification procedure to provide the EAS rediscovery information to the UE as described in subclauses 6.3.2.2. Upon receipt of the EAS rediscovery information, the UE provides the received information to the upper layers. If the UE supports ECS address provisioning over NAS as specified in TS 23.548, the UE indicates its support of ECS configuration information provisioning over NAS in the Extended protocol configuration options IE either during the UE-requested PDU session establishment procedure as described in subclause 6.4.1.2 or while in S1 mode as described in TS 24.301, respectively. If the UE indicated support of ECS configuration information address provisioning over NAS, the SMF can provide the ECS configuration information in the Extended protocol configuration options IE during the network-requested PDU session modification procedure, UE-requested PDU session establishment procedure or the UE-requested PDU session modification procedure as described in subclauses 6.3.2.2, 6.4.1.3 and 6.4.2.3, respectively. If the UE supports the edge DNS client (EDC) as specified in TS 23.548, the UE indicates its support of EDC in the Extended protocol configuration options IE during the UE-requested PDU session establishment procedure as described in subclause 6.4.1.2 or the UE-requested PDU session modification procedure as described in subclause 6.4.2.2. If the UE indicates support of EDC, the SMF can indicate in the Extended protocol configuration options IE during the UE-requested PDU session establishment procedure as described in subclause 6.4.1.3 or the network-requested PDU session modification procedure as described in subclause 6.3.2.2, that the network allows the use of EDC for the applications which are mapped onto the PDU session and explicitly requested the use of EDC, or that the network requires the use of EDC for all applications mapped onto the PDU session.

The 5GSM sublayer may support establishment of redundant PDU sessions (see subclause 5.33.2 of TS 23.501). In order to establish a set of two redundant PDU sessions, a UE can include a PDU session pair ID, an RSN, or both in a PDU SESSION ESTABLISHMENT REQUEST message for each of the two redundant PDU sessions (see subclause 6.4.1.2). The UE can set the PDU session pair ID, the RSN, or both according to URSP or UE local configuration (see TS 24.526). An SMF receiving a PDU session pair ID, an RSN, or both via a PDU SESSION ESTABLISHMENT REQUEST message operates as specified in subclause 5.33.2 of TS 23.501. In addition, an SMF can handle two PDU sessions as redundant even if the UE provides neither a PDU session pair ID nor an RSN in a PDU SESSION ESTABLISHMENT REQUEST message for each of the PDU sessions (see subclause 5.33.2 of TS 23.501).

The network can perform maximum group data rate limitation control to 5G VN groups as specified in TS 23.503. If the maximum data rate of PDU sessions associated within a 5G VN group has been exceeded the maximum group data rate of the 5G VN group, the SMF may reject the PDU SESSION ESTABLISHMENT REQUEST message against the 5G VN group using S-NSSAI based congestion control as specified in subclause 6.2.8 and 6.4.1.4.2.

If the network supports PDU set handling (see subclause 5.37.5 of TS 23.501), based on operator policy, the SMF may provide the protocol description for UL PDU set handling in the PDU SESSION ESTABLISHMENT ACCEPT message or the PDU SESSION MODIFICATION COMMAND message to the UE. The UE can store the protocol description and may use it to identify PDUs belong to PDU sets for the uplink direction.