Content for  TS 24.501  Word version:  19.0.0

If the connectivity with the requested DN is rejected by the network, the SMF shall create a PDU SESSION ESTABLISHMENT REJECT message. The SMF shall set the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message to indicate the reason for rejecting the PDU session establishment. The 5GSM cause IE typically indicates one of the following SM cause values: If the PDU SESSION ESTABLISHMENT REQUEST message includes a PDU session type IE set to "IPv6", and the subscription, the SMF configuration, or both, are limited to IPv4 only for the requested DNN, the SMF shall include the 5GSM cause value #50 "PDU session type IPv4 only allowed" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message. If the PDU SESSION ESTABLISHMENT REQUEST message includes a PDU session type IE set to "IPv6", and the subscription, the SMF configuration, or both, support none of "IPv4" and "IPv6" PDU session types for the requested DNN, the SMF shall include the 5GSM cause value #28 "unknown PDU session type" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message. If the PDU SESSION ESTABLISHMENT REQUEST message includes a PDU session type IE set to "IPv4", and the subscription, the SMF configuration, or both, are limited to IPv6 only for the requested DNN, the SMF shall include the 5GSM cause value #51 "PDU session type IPv6 only allowed" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message. If the PDU SESSION ESTABLISHMENT REQUEST message includes a PDU session type IE set to "IPv4", and the subscription, the SMF configuration, or both, support none of "IPv4" and "IPv6" PDU session types for the requested DNN, the SMF shall include the 5GSM cause value #28 "unknown PDU session type" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message. If the PDU SESSION ESTABLISHMENT REQUEST message includes a PDU session type IE set to "IPv4v6", and the subscription, the SMF configuration, or both, support none of "IPv4v6", "IPv4" and "IPv6" PDU session types for the requested DNN, the SMF shall include the 5GSM cause value #28 "unknown PDU session type" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message. If the PDU SESSION ESTABLISHMENT REQUEST message includes a PDU session type IE set to "Unstructured" or "Ethernet", and the subscription, the SMF configuration, or both, do not support the PDU session type for the requested DNN, the SMF shall include the 5GSM cause value #28 "unknown PDU session type" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message. If the PDU SESSION ESTABLISHMENT REQUEST message is to establish an MA PDU session and includes a PDU session type IE set to "Unstructured", and the SMF configuration does not support the PDU session type, the SMF shall include the 5GSM cause value #28 "unknown PDU session type" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message. If the PDU SESSION ESTABLISHMENT REQUEST message contains the SSC mode IE indicating an SSC mode not supported by the subscription, the SMF configuration, or both of them, and the SMF decides to rejects the PDU session establishment, the SMF shall include the 5GSM cause value #68 "not supported SSC mode" in the 5GSM cause IE and the SSC modes allowed by SMF in the Allowed SSC mode IE of the PDU SESSION ESTABLISHMENT REJECT message. If the PDU SESSION ESTABLISHMENT REQUEST message is to establish an MA PDU session and MA PDU session is not allowed due to operator policy and subscription, and the SMF decides to reject the PDU session establishment, the SMF shall include the 5GSM cause value #33 "requested service option not subscribed" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message. If the PDU SESSION ESTABLISHMENT REQUEST message is identified to be for C2 communication and:

1. does not include the Service-level-AA container IE with the service-level device ID set to the CAA-level UAV ID;
2. does not include the Service-level-AA container IE with the service-level-AA payload and the Service-level-AA payload type; or
3. the SMF is informed by the UAS-NF that the UAS service is not allowed,

the SMF shall reject the PDU SESSION ESTABLISHMENT REQUEST message by transmitting a PDU SESSION ESTABLISHMENT REJECT message with 5GSM cause IE set to 5GSM cause value #86 "UAS services not allowed". In 3GPP access, if the operator's configuration requires user-plane integrity protection for the PDU session and, the maximum data rate per UE for user-plane integrity protection supported by the UE for uplink or the maximum data rate per UE for user-plane integrity protection supported by the UE for downlink, or both, are lower than required by the operator's configuration, the SMF shall include the 5GSM cause value #82 "maximum data rate per UE for user-plane integrity protection is too low" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message. If the UE requests a PDU session establishment for an LADN when the UE is located outside of the LADN service area, the SMF shall include the 5GSM cause value #46 "out of LADN service area" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message. If the DN authentication of the UE was performed with the PDU session authentication and authorization procedure and completed unsuccessfully, the SMF shall include the 5GSM cause value #29 "user authentication or authorization failed" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message and shall set the EAP message IE of the PDU SESSION ESTABLISHMENT REJECT message to an EAP-failure message as specified in RFC 3748, provided by the DN. If the DN authentication of the UE was performed with the service-level authentication and authorization procedure and completed unsuccessfully, the SMF shall include the 5GSM cause value #29 "user authentication or authorization failed" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message and shall include the service-level-AA response provided by DN in the Service-level-AA container IE of the PDU SESSION ESTABLISHMENT REJECT message. Based on the local policy and user's subscription data, if a PDU session is being established with the request type set to "existing PDU session" and the SMF determines the UE has:

1. moved between a tracking area in NB-N1 mode and a tracking area in WB-N1 mode;
2. moved between a tracking area in NB-S1 mode and a tracking area in WB-N1 mode; or
3. moved between a tracking area in WB-S1 mode and a tracking area in NB-N1 mode,

the SMF may reject the PDU SESSION ESTABLISHMENT REQUEST message and:

1. include the 5GSM cause value #39 "reactivation requested" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message; or
2. include a 5GSM cause value other than #39 "reactivation requested" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message.

If the PDU session cannot be established due to resource unavailability in the UPF, the SMF shall include the 5GSM cause value #26 "insufficient resources" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message. Based on the user's subscription data and the operator policy, if the SMF determines that the UUAA-SM procedure needs to be performed for a UE but the SMF does not receives the service-level device ID set to the CAA-level UAV ID in the Service-level-AA container IE of the PDU SESSION ESTABLISHMENT REQUEST message from the UE, the SMF shall include the 5GSM cause value #86 "UAS services not allowed" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message. The network may include a Back-off timer value IE in the PDU SESSION ESTABLISHMENT REJECT message. If the 5GSM cause value is #26 "insufficient resources", #67 "insufficient resources for specific slice and DNN", or #69 "insufficient resources for specific slice" and the PDU SESSION ESTABLISHMENT REQUEST message was received from a UE configured for high priority access in selected PLMN or SNPN or the request type provided during the PDU session establishment is set to "initial emergency request" or "existing emergency PDU session", the network shall not include a Back-off timer value IE. If the 5GSM cause value is #29 "user authentication or authorization failed", the network should include a Back-off timer value IE. If the Back-off timer value IE is included and the 5GSM cause value is different from #26 "insufficient resources", #28 "unknown PDU session type", #46 "out of LADN service area", #50 "PDU session type IPv4 only allowed", #51 "PDU session type IPv6 only allowed", #54 "PDU session does not exist", #57 "PDU session type IPv4v6 only allowed", #58 "PDU session type Unstructured only allowed", #61 "PDU session type Ethernet only allowed", #67 "insufficient resources for specific slice and DNN", #68 "not supported SSC mode", and #69 "insufficient resources for specific slice", the network may include the Re-attempt indicator IE to indicate whether the UE is allowed to attempt a PDN connectivity procedure in the PLMN for the same DNN in S1 mode, whether another attempt in S1 mode or in N1 mode is allowed in an equivalent PLMN or whether another attempt in N1 mode is allowed in an equivalent SNPN. If the 5GSM cause value is #50 "PDU session type IPv4 only allowed", #51 "PDU session type IPv6 only allowed", #57 "PDU session type IPv4v6 only allowed", #58 "PDU session type Unstructured only allowed", or #61 "PDU session type Ethernet only allowed", the network may include the Re-attempt indicator IE without Back-off timer value IE to indicate whether the UE is allowed to attempt a PDU session establishment procedure in an equivalent PLMN or equivalent SNPN in N1 mode using the same PDU session type for the same DNN (or no DNN, if no DNN was indicated by the UE) and the same S-NSSAI (or no S-NSSAI, if no S-NSSAI was indicated by the UE). The SMF shall send the PDU SESSION ESTABLISHMENT REJECT message. Upon receipt of a PDU SESSION ESTABLISHMENT REJECT message and a PDU session ID, using the NAS transport procedure as specified in subclause 5.4.5, the UE shall stop timer T3580 shall release the allocated PTI value and shall consider that the PDU session was not established. If the PDU SESSION ESTABLISHMENT REQUEST message was sent with request type set to "initial emergency request" or "existing emergency PDU session" and the UE receives a PDU SESSION ESTABLISHMENT REJECT message, then the UE may:

1. inform the upper layers of the failure of the procedure; or
2. de-register locally, if not de-registered already, attempt initial registration for emergency services.

If the PDU SESSION ESTABLISHMENT REJECT message includes 5GSM cause #39 "reactivation requested" and the PDU session is being transferred from EPS to 5GS and established with the request type set to "existing PDU session", the UE should re-initiate the UE-requested PDU session establishment procedure as specified in subclause 6.4.1 for:

1. the PDU session type associated with the transferred PDU session;
2. the SSC mode associated with the transferred PDU session;
3. the DNN associated with the transferred PDU session; and
4. the S-NSSAI associated with (if available in roaming scenarios) a mapped S-NSSAI if provided in the UE-requested PDU session establishment procedure of the transferred PDU session.

If the PDU SESSION ESTABLISHMENT REJECT message includes 5GSM cause #86 "UAS services not allowed" and the UE has not included the service-level device ID in the Service-level-AA container IE of the PDU SESSION ESTABLISHMENT REQUEST message and set the value to the CAA-level UAV ID:

1. the UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for UAS services without including the CAA-level UAV ID in the service-level device ID of the Service-level-AA container IE; and
2. upon receipt of the request from the upper layers to establish a PDU session for UAS services, the UE shall initiate the UE-requested PDU session establishment procedure by including the service-level device ID in the Service-level-AA container IE of the PDU SESSION ESTABLISHMENT REQUEST message and set the value to the CAA-level UAV ID as specified in subclause 6.4.1.2.

If the 5GSM cause value is different from #26 "insufficient resources", #28 "unknown PDU session type", #39 "reactivation requested", #46 "out of LADN service area", #50 "PDU session type IPv4 only allowed", #51 "PDU session type IPv6 only allowed", #54 "PDU session does not exist", #57 "PDU session type IPv4v6 only allowed", #58 "PDU session type Unstructured only allowed", #61 "PDU session type Ethernet only allowed", #67 "insufficient resources for specific slice and DNN", #68 "not supported SSC mode", and #69 "insufficient resources for specific slice", #86 "UAS services not allowed", and #33 "requested service option not subscribed" and the PDU SESSION ESTABLISHMENT REQUEST message was received from a UE configured for high priority access in selected PLMN, the network shall not include a Back-off timer value IE.

If:

• the 5GSM cause value #26 "insufficient resources" and the Back-off timer value IE are included in the PDU SESSION ESTABLISHMENT REJECT message; or
• an indication that the 5GSM message was not forwarded due to DNN based congestion control is received along a Back-off timer value and a PDU SESSION ESTABLISHMENT REQUEST message with the PDU session ID IE set to the PDU session ID of the PDU session;

the UE shall ignore the 5GSM congestion re-attempt indicator or the Re-attempt indicator IE provided by the network, if any, and the UE shall take different actions depending on the timer value received for timer T3396 in the Back-off timer value IE or depending on the Back-off timer value received from the 5GMM sublayer (if the UE is a UE configured for high priority access in selected PLMN or SNPN, exceptions are specified in subclause 6.2.7):

1. If the timer value indicates neither zero nor deactivated and a DNN was provided during the PDU session establishment, the UE shall stop timer T3396 associated with the corresponding DNN, if it is running. If the timer value indicates neither zero nor deactivated and no DNN was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop timer T3396 associated with no DNN if it is running. In an SNPN, the timer T3396 to be stopped includes:
   1. the timer T3396 applied for all the equivalent SNPNs, and associated with the RSNPN or an equivalent SNPN and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running; and
   2. the timer T3396 applied for the registered SNPN, associated with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running.
   The UE shall then start timer T3396 with the value provided in the Back-off timer value IE or with the Back-off timer value received from the 5GMM sublayer and:
   1. shall not send another PDU SESSION ESTABLISHMENT REQUEST message or PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for the same DNN that was sent by the UE, until timer T3396 expires or timer T3396 is stopped; and
   2. shall not send another PDU SESSION ESTABLISHMENT REQUEST message without a DNN and with request type different from "initial emergency request" and different from "existing emergency PDU session", or another PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for a non-emergency PDU session established without a DNN provided by the UE, if no DNN was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", until timer T3396 expires or timer T3396 is stopped.
   The UE shall not stop timer T3396 upon a PLMN change, SNPN change, or inter-system change;
2. if the timer value indicates that this timer is deactivated and a DNN was provided during the PDU session establishment, the UE shall stop timer T3396 associated with the corresponding DNN, if it is running. If the timer value indicates that this timer is deactivated and no DNN was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop timer T3396 associated with no DNN if it is running. In an SNPN, the timer T3396 to be stopped includes:
   1. the timer T3396 applied for all the equivalent SNPNs, and associated with the RSNPN or an equivalent SNPN and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running; and
   2. the timer T3396 applied for the registered SNPN, associated with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running.
   The UE:
   1. shall not send another PDU SESSION ESTABLISHMENT REQUEST message or PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for the same DNN until the UE is switched off, the USIM is removed, the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder, or the UE receives a PDU SESSION MODIFICATION COMMAND message for the same DNN from the network, or a PDU SESSION AUTHENTICATION COMMAND message for the same DNN from the network, or a PDU SESSION RELEASE COMMAND message without the Back-off timer value IE for the same DNN from the network; and
   2. shall not send another PDU SESSION ESTABLISHMENT REQUEST message without a DNN and with request type different from "initial emergency request" and different from "existing emergency PDU session", or another PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for a non-emergency PDU session established without a DNN provided by the UE, if no DNN was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", until the UE is switched off, the USIM is removed, the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder, or the UE receives a PDU SESSION MODIFICATION COMMAND message for a non-emergency PDU session established without a DNN provided by the UE, or a PDU SESSION AUTHENTICATION COMMAND message for a non-emergency PDU session established without a DNN provided by the UE, or a PDU SESSION RELEASE COMMAND message without the Back-off timer value IE for a non-emergency PDU session established without a DNN provided by the UE.
   The timer T3396 remains deactivated upon a PLMN change, SNPN change, or inter-system change; and
3. if the timer value indicates zero, the UE:
   1. shall stop timer T3396 associated with the corresponding DNN, if running. In an SNPN, the timer T3396 to be stopped includes:
      1. the timer T3396 applied for all the equivalent SNPNs, and associated with the RSNPN or an equivalent SNPN and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running; and
      2. the timer T3396 applied for the registered SNPN, associated with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running.
      The UE may send another PDU SESSION ESTABLISHMENT REQUEST message or PDU SESSION MODIFICATION REQUEST message for the same DNN; and
   2. if no DNN was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop timer T3396 associated with no DNN, if running. In an SNPN, the timer T3396 to be stopped includes:
      1. the timer T3396 applied for all the equivalent SNPNs, and associated with the RSNPN or an equivalent SNPN and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running; and
      2. the timer T3396 applied for the registered SNPN, associated with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running.
      The UE may send another PDU SESSION ESTABLISHMENT REQUEST message without a DNN, or another PDU SESSION MODIFICATION REQUEST message without a DNN provided by the UE.

In an SNPN, if the UE supports equivalent SNPNs, then the UE shall apply the timer T3396 for all the equivalent SNPNs. Otherwise, the UE shall apply the timer T3396 for the registered SNPN. If the Back-off timer value IE is not included or no Back-off timer value is received from the 5GMM sublayer, then the UE may send another PDU SESSION ESTABLISHMENT REQUEST message or PDU SESSION MODIFICATION REQUEST message for the same DNN or without a DNN as specified in subclause 6.2.7. When the timer T3396 is running or the timer is deactivated, the UE is allowed to initiate a PDU session establishment procedure for emergency services. If the timer T3396 is running when the UE enters state 5GMM-DEREGISTERED, the UE remains switched on, and the USIM in the UE (if any) remains the same and the entry in the "list of subscriber data" to which timer T3396 is associated (if any) is not updated, then timer T3396 is kept running until it expires or it is stopped. If the UE is switched off when the timer T3396 is running, and if the USIM in the UE (if any) remains the same and the entry in the "list of subscriber data" to which timer T3396 is associated (if any) is not updated when the UE is switched on, the UE shall behave as follows:

• let t1 be the time remaining for T3396 timeout at switch off and let t be the time elapsed between switch off and switch on. If t1 is greater than t, then the timer shall be restarted with the value t1 – t. If t1 is equal to or less than t, then the timer need not be restarted. If the UE is not capable of determining t, then the UE shall restart the timer with the value t1.

If:

• the 5GSM cause value #67 "insufficient resources for specific slice and DNN" and the Back-off timer value IE are included in the PDU SESSION ESTABLISHMENT REJECT message; or
• an indication that the 5GSM message was not forwarded due to S-NSSAI and DNN based congestion control is received along a Back-off timer value and a PDU SESSION ESTABLISHMENT REQUEST message with the PDU session ID IE set to the PDU session ID of the PDU session;

the UE shall ignore the Re-attempt indicator IE provided by the network, if any, and take different actions depending on the timer value received for timer T3584 in the Back-off timer value IE or depending on the Back-off timer value received from the 5GMM sublayer (if the UE is a UE configured for high priority access in selected PLMN or SNPN, exceptions are specified in subclause 6.2.8):

1. If the timer value indicates neither zero nor deactivated, the UE shall stop timer T3584 associated with the same [S-NSSAI, DNN] combination as that the UE provided during the PDU session establishment, if it is running. If the timer value indicates neither zero nor deactivated and no DNN was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop timer T3584 associated with [S-NSSAI, no DNN] combination as that the UE provided during the PDU session establishment, if it is running. If the timer value indicates neither zero nor deactivated and no S-NSSAI was provided during the PDU session establishment, the UE shall stop timer T3584 associated with [no S-NSSAI, DNN] combination as that the UE provided during the PDU session establishment, if it is running. If the timer value indicates neither zero nor deactivated and neither S-NSSAI nor DNN was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop timer T3584 associated with [no S-NSSAI, no DNN] combination as that the UE provided during the PDU session establishment, if it is running. The timer T3584 to be stopped includes:
   1. in a PLMN:
      1. the timer T3584 applied for all the PLMNs, if running; and
      2. the timer T3584 applied for the registered PLMN, if running; or
   2. in an SNPN:
      1. the timer T3584 applied for all the equivalent SNPNs, and associated with the RSNPN or an equivalent SNPN and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running; and
      2. the timer T3584 applied for the registered SNPN, associated with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running.
   The UE shall then start timer T3584 with the value provided in the Back-off timer value IE or with the Back-off timer value received from the 5GMM sublayer and:
   1. shall not send another PDU SESSION ESTABLISHMENT REQUEST message, or PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for the same [S-NSSAI, DNN] combination that was sent by the UE, until timer T3584 expires or timer T3584 is stopped;
   2. shall not send another PDU SESSION ESTABLISHMENT REQUEST message with request type different from "initial emergency request" and different from "existing emergency PDU session", or another PDU SESSION MODIFICATION REQUEST with exception of those identified in subclause 6.4.2.1, message for the same [S-NSSAI, no DNN] combination that was sent by the UE, if no DNN was provided during the PDU session establishment, until timer T3584 expires or timer T3584 is stopped;
   3. shall not send another PDU SESSION ESTABLISHMENT REQUEST message, or another PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for the same [no S-NSSAI, DNN] combination that was sent by the UE, if no S-NSSAI was provided during the PDU session establishment, until timer T3584 expires or timer T3584 is stopped; and
   4. shall not send another PDU SESSION ESTABLISHMENT REQUEST message with request type different from "initial emergency request" and different from "existing emergency PDU session", or another PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for the same [no S-NSSAI, no DNN] combination that was sent by the UE, if neither S-NSSAI nor DNN was provided during the PDU session establishment, until timer T3584 expires or timer T3584 is stopped.
   The UE shall not stop timer T3584 upon a PLMN change, SNPN change, or inter-system change;
2. if the timer value indicates that this timer is deactivated, the UE:
   1. shall stop timer T3584 associated with the same [S-NSSAI, DNN] combination as that the UE provided during the PDU session establishment, if running. The timer T3584 to be stopped includes:
      1. in a PLMN:
         1. the timer T3584 applied for all the PLMNs, if running; and
         2. the timer T3584 applied for the registered PLMN, if running; or
      2. in an SNPN:
         1. the timer T3584 applied for all the equivalent SNPNs, and associated with the RSNPN or an equivalent SNPN and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running; and
         2. the timer T3584 applied for the registered SNPN, associated with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running.
      The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message, or PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for the same [S-NSSAI, DNN] combination that was sent by the UE, until the UE is switched off, the USIM is removed, the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder, or the UE receives a PDU SESSION MODIFICATION COMMAND message for the same [S-NSSAI, DNN] combination from the network, or a PDU SESSION AUTHENTICATION COMMAND message for the same [S-NSSAI, DNN] combination from the network, or a PDU SESSION RELEASE COMMAND message without the Back-off timer value IE for the same [S-NSSAI, DNN] combination from the network;
   2. shall stop timer T3584 associated with the same [S-NSSAI, no DNN] combination as that the UE provided during the PDU session establishment, if running. The timer T3584 to be stopped includes:
      1. in a PLMN:
         1. the timer T3584 applied for all the PLMNs, if running; and
         2. the timer T3584 applied for the registered PLMN, if running; or
      2. in an SNPN:
         1. the timer T3584 applied for all the equivalent SNPNs, and associated with the RSNPN or an equivalent SNPN and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running; and
         2. the timer T3584 applied for the registered SNPN, associated with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running.
      The UE shall not send a PDU SESSION ESTABLISHMENT REQUEST message with request type different from "initial emergency request" and different from "existing emergency PDU session", or a PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for the same [S-NSSAI, no DNN] combination that was sent by the UE, if no DNN was provided during the PDU session establishment, until the UE is switched off, the USIM is removed, the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" if the UE supports access to an SNPN using credentials from a credentials holder, or the UE receives an PDU SESSION MODIFICATION COMMAND message for a non-emergency PDU session established for the same [S-NSSAI, no DNN] combination from the network, or a PDU SESSION AUTHENTICATION COMMAND message for a non-emergency PDU session established for the same [S-NSSAI, DNN] combination from the network, or a PDU SESSION RELEASE COMMAND message without the Back-off timer value IE for a non-emergency PDU session established for the same [S-NSSAI, no DNN] combination from the network;
   3. shall stop timer T3584 associated with the same [no S-NSSAI, DNN] combination as that the UE provided during the PDU session establishment, if running. The timer T3584 to be stopped includes:
      1. in a PLMN:
         1. the timer T3584 applied for all the PLMNs, if running; and
         2. the timer T3584 applied for the registered PLMN, if running; or
      2. in an SNPN:
         1. the timer T3584 applied for all the equivalent SNPNs, and associated with the RSNPN or an equivalent SNPN and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running; and
         2. the timer T3584 applied for the registered SNPN, associated with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running.
      The UE shall not send a PDU SESSION ESTABLISHMENT REQUEST message, or a PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for the same [no S-NSSAI, DNN] combination that was sent by the UE, if no S-NSSAI was provided during the PDU session establishment, until the UE is switched off, the USIM is removed, the entry in the "list of subscriber data" for the current SNPN is updated, or the UE receives a PDU SESSION MODIFICATION COMMAND message for the same [no S-NSSAI, DNN] combination from the network, or a PDU SESSION AUTHENTICATION COMMAND message for a non-emergency PDU session established for the same [no S-NSSAI, no DNN] combination from the network, or a PDU SESSION RELEASE COMMAND message without the Back-off timer value IE for the same [no S-NSSAI, DNN] combination from the network; and
   4. shall stop timer T3584 associated with the same [no S-NSSAI, no DNN] combination as that the UE provided during the PDU session establishment , if running. The timer T3584 to be stopped includes:
      1. in a PLMN:
         1. the timer T3584 applied for all the PLMNs, if running; and
         2. the timer T3584 applied for the registered PLMN, if running; or
      2. in an SNPN:
         1. the timer T3584 applied for all the equivalent SNPNs, and associated with the RSNPN or an equivalent SNPN and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running; and
         2. the timer T3584 applied for the registered SNPN, associated with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running.
      The UE shall not send a PDU SESSION ESTABLISHMENT REQUEST message with request type different from "initial emergency request" and different from "existing emergency PDU session", or a PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for the same [no S-NSSAI, no DNN] combination that was sent by the UE, if neither S-NSSAI nor DNN was provided during the PDU session establishment, until the UE is switched off, the USIM is removed, the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder, or the UE receives an PDU SESSION MODIFICATION COMMAND message for a non-emergency PDU session established for the same [no S-NSSAI, no DNN] combination from the network or a PDU SESSION RELEASE COMMAND message without the Back-off timer value IE for a non-emergency PDU session established for the same [no S-NSSAI, no DNN] combination from the network.
   The timer T3584 remains deactivated upon a PLMN change, SNPN change, or inter-system change; and
3. if the timer value indicates zero, the UE:
   1. shall stop timer T3584 associated with the same [S-NSSAI, DNN] combination as that the UE provided during the PDU session establishment, if running. The timer T3584 to be stopped includes:
      1. in a PLMN:
         1. the timer T3584 applied for all the PLMNs, if running; and
         2. the timer T3584 applied for the registered PLMN, if running; or
      2. in an SNPN:
         1. the timer T3584 applied for all the equivalent SNPNs, and associated with the RSNPN or an equivalent SNPN and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running; and
         2. the timer T3584 applied for the registered SNPN, associated with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running.
      The UE may send another PDU SESSION ESTABLISHMENT REQUEST message or PDU SESSION MODIFICATION REQUEST message for the same [S-NSSAI, DNN] combination;
   2. shall stop timer T3584 associated with the same [S-NSSAI, no DNN] combination as that the UE provided during the PDU session establishment, if running. The timer T3584 to be stopped includes:
      1. in a PLMN:
         1. the timer T3584 applied for all the PLMNs, if running; and
         2. the timer T3584 applied for the registered PLMN, if running; or
      2. in an SNPN:
         1. the timer T3584 applied for all the equivalent SNPNs, and associated with the RSNPN or an equivalent SNPN and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running; and
         2. the timer T3584 applied for the registered SNPN, associated with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running.
      The UE may send another PDU SESSION ESTABLISHMENT REQUEST message or PDU SESSION MODIFICATION REQUEST message for the same [S-NSSAI, no DNN] combination if no DNN was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session";
   3. shall stop timer T3584 associated with the same [no S-NSSAI, DNN] combination as that the UE provided during the PDU session establishment, if running. The timer T3584 to be stopped includes:
      1. in a PLMN:
         1. the timer T3584 applied for all the PLMNs, if running; and
         2. the timer T3584 applied for the registered PLMN, if running; or
      2. in an SNPN:
         1. the timer T3584 applied for all the equivalent SNPNs, and associated with the RSNPN or an equivalent SNPN and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running; and
         2. the timer T3584 applied for the registered SNPN, associated with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running.
      The UE may send another PDU SESSION ESTABLISHMENT REQUEST message, or PDU SESSION MODIFICATION REQUEST message for the same [no S-NSSAI, DNN] combination if no NSSAI was provided during the PDU session establishment; and
   4. shall stop timer T3584 associated with the same [no S-NSSAI, no DNN] combination as that the UE provided during the PDU session establishment, if running. The timer T3584 to be stopped includes:
      1. in a PLMN:
         1. the timer T3584 applied for all the PLMNs, if running; and
         2. the timer T3584 applied for the registered PLMN, if running; or
      2. in an SNPN:
         1. the timer T3584 applied for all the equivalent SNPNs, and associated with the RSNPN or an equivalent SNPN and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running; and
         2. the timer T3584 applied for the registered SNPN, associated with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running.
      The UE may send another PDU SESSION ESTABLISHMENT REQUEST message, or PDU SESSION MODIFICATION REQUEST message for the same [no S-NSSAI, no DNN] combination if neither S-NSSAI nor DNN was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session".

If the 5GSM congestion re-attempt indicator IE with the ABO bit set to "The back-off timer is applied in all PLMNs or all equivalent SNPNs" is included in the PDU SESSION ESTABLISHMENT REJECT message with the 5GSM cause value #67 "insufficient resources for specific slice and DNN", then the UE shall apply the timer T3584 for all the PLMNs or all the equivalent SNPNs. Otherwise, the UE shall apply the timer T3584 for the registered PLMN. If the Back-off timer value IE is not included or no Back-off timer value is received from the 5GMM sublayer, then the UE may send another PDU SESSION ESTABLISHMENT REQUEST message or PDU SESSION MODIFICATION REQUEST message for the same [S-NSSAI, DNN] combination, or for the same [S-NSSAI, no DNN] combination, or for the same [no S-NSSAI, DNN] combination, or for the same [no S-NSSAI, no DNN] combination as specified in subclause 6.2.8. When the timer T3584 is running or the timer is deactivated, the UE is allowed to initiate a PDU session establishment procedure for emergency services. If the timer T3584 is running when the UE enters state 5GMM-DEREGISTERED, the UE remains switched on, and the USIM in the UE (if any) remains the same and the entry in the "list of subscriber data" to which timer T3584 is associated (if any) is not updated, then timer T3584 is kept running until it expires or it is stopped. If the UE is switched off when the timer T3584 is running, and if the USIM in the UE (if any) remains the same and the entry in the "list of subscriber data" to which timer T3584 is associated (if any) is not updated when the UE is switched on, the UE shall behave as follows:

• let t1 be the time remaining for T3584 timeout at switch off and let t be the time elapsed between switch off and switch on. If t1 is greater than t, then the timer shall be restarted with the value t1 – t. If t1 is equal to or less than t, then the timer need not be restarted. If the UE is not capable of determining t, then the UE shall restart the timer with the value t1.

If:

• the 5GSM cause value #69 "insufficient resources for specific slice" and the Back-off timer value IE are included in the PDU SESSION ESTABLISHMENT REJECT message; or
• an indication that the 5GSM message was not forwarded due to S-NSSAI only based congestion control is received along a Back-off timer value and a PDU SESSION ESTABLISHMENT REQUEST message with the PDU session ID IE set to the PDU session ID of the PDU session;

the UE shall ignore the Re-attempt indicator IE provided by the network, if any, and take different actions depending on the timer value received for timer T3585 in the Back-off timer value IE or depending on the Back-off timer value received from the 5GMM sublayer (if the UE is a UE configured for high priority access in selected PLMN or SNPN, exceptions are specified in subclause 6.2.8):

1. If the timer value indicates neither zero nor deactivated and an S-NSSAI was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop timer T3585 associated with the corresponding S-NSSAI, if it is running. If the timer value indicates neither zero nor deactivated and no S-NSSAI was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop timer T3585 associated with no S-NSSAI if it is running. The timer T3585 to be stopped includes:
   1. in a PLMN:
      1. the timer T3585 applied for all the PLMNs and for the access over which the PDU SESSION ESTABLISHMENT REJECT is received, if running;
      2. the timer T3585 applied for all the PLMNs and for both 3GPP access type and non-3GPP access type, if running;
      3. the timer T3585 applied for the registered PLMN and for the access over which the PDU SESSION ESTABLISHMENT REJECT is received, if running; and
      4. the timer T3585 applied for the registered PLMN and for both 3GPP access type and non-3GPP access type, if running; or
   2. in an SNPN:
      1. the timer T3585 applied for all the equivalent SNPNs and for the access over which the PDU SESSION AUTHENTICATION COMMAND message is received, associated with the RSNPN or an equivalent SNPN and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running;
      2. the timer T3585 applied for all the equivalent SNPNs and for both 3GPP access type and non-3GPP access type, associated with the RSNPN or an equivalent SNPN and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running;
      3. the timer T3585 applied for the registered SNPN and for the access over which the PDU SESSION AUTHENTICATION COMMAND message is received, associated with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running; and
      4. the timer T3585 applied for the registered PLMN and for both 3GPP access type and non-3GPP access type, associated with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running.
   The UE shall then start timer T3585 with the value provided in the Back-off timer value IE or with the Back-off timer value received from the 5GMM sublayer and:
   1. shall not send another PDU SESSION ESTABLISHMENT REQUEST message with request type different from "initial emergency request" and different from "existing emergency PDU session", or another PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for a non-emergency PDU session for the same S-NSSAI that was sent by the UE, until timer T3585 expires or timer T3585 is stopped; and
   2. shall not send another PDU SESSION ESTABLISHMENT REQUEST message without an S-NSSAI and with request type different from "initial emergency request" and different from "existing emergency PDU session", or another PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for a non-emergency PDU session established without an S-NSSAI provided by the UE, if no S-NSSAI was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", until timer T3585 expires or timer T3585 is stopped.
   The UE shall not stop timer T3585 upon a PLMN change, SNPN change, or inter-system change;
2. if the timer value indicates that this timer is deactivated and an S-NSSAI was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop timer T3585 associated with the corresponding S-NSSAI, if it is running. If the timer value indicates that this timer is deactivated and no S-NSSAI was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop timer T3585 associated with no S-NSSAI if it is running. The timer T3585 to be stopped includes:
   1. in a PLMN:
      1. the timer T3585 applied for all the PLMNs and for the access over which the PDU SESSION ESTABLISHMENT REJECT is received, if running;
      2. the timer T3585 applied for all the PLMNs and for both 3GPP access type and non-3GPP access type, if running;
      3. the timer T3585 applied for the registered PLMN and for the access over which the PDU SESSION ESTABLISHMENT REJECT is received, if running; and
      4. the timer T3585 applied for the registered PLMN and for both 3GPP access type and non-3GPP access type, if running; or
   2. in an SNPN:
      1. the timer T3585 applied for all the equivalent SNPNs and for the access over which the PDU SESSION AUTHENTICATION COMMAND message is received, associated with the RSNPN or an equivalent SNPN and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running;
      2. the timer T3585 applied for all the equivalent SNPNs and for both 3GPP access type and non-3GPP access type, associated with the RSNPN or an equivalent SNPN and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running;
      3. the timer T3585 applied for the registered SNPN and for the access over which the PDU SESSION AUTHENTICATION COMMAND message is received, associated with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running; and
      4. the timer T3585 applied for the registered PLMN and for both 3GPP access type and non-3GPP access type, associated with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running.
   The UE:
   1. shall not send another PDU SESSION ESTABLISHMENT REQUEST message with request type different from "initial emergency request" and different from "existing emergency PDU session", or another PDU SESSION MODIFICATION REQUEST with exception of those identified in subclause 6.4.2.1, for a non-emergency PDU session for the same S-NSSAI until the UE is switched off, the USIM is removed, the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder, or the UE receives a PDU SESSION MODIFICATION COMMAND message for a non-emergency PDU session for the same S-NSSAI from the network, or a PDU SESSION AUTHENTICATION COMMAND message for a non-emergency PDU session for the same S-NSSAI from the network, or a PDU SESSION RELEASE COMMAND message without the Back-off timer value IE for the same S-NSSAI from the network; and
   2. shall not send another PDU SESSION ESTABLISHMENT REQUEST message without an S-NSSAI and with request type different from "initial emergency request" and different from "existing emergency PDU session", or another PDU SESSION MODIFICATION REQUEST message with exception of those identified in subclause 6.4.2.1, for a non-emergency PDU session established without an S-NSSAI provided by the UE, if no S-NSSAI was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", until the UE is switched off, the USIM is removed, the entry in the "list of subscriber data" for the current SNPN is updated if the UE does not support access to an SNPN using credentials from a credentials holder, or the selected entry of the "list of subscriber data" is updated if the UE supports access to an SNPN using credentials from a credentials holder, or the UE receives a PDU SESSION MODIFICATION COMMAND message for a non-emergency PDU session established without an S-NSSAI provided by the UE, or a PDU SESSION AUTHENTICATION COMMAND message for a non-emergency PDU session established without an S-NSSAI provided by the UE, or a PDU SESSION RELEASE COMMAND message without the Back-off timer value IE for a non-emergency PDU session established without an S-NSSAI provided by the UE.
   The timer T3585 remains deactivated upon a PLMN change, SNPN change, or inter-system change; and
3. if the timer value indicates zero, the UE:
   1. shall stop timer T3585 associated with the corresponding S-NSSAI, if running. The timer T3585 to be stopped includes:
      1. in a PLMN:
         1. the timer T3585 applied for all the PLMNs and for the access over which the PDU SESSION RELEASE COMMAND is received, if running;
         2. the timer T3585 applied for all the PLMNs and for the access over which the PDU SESSION RELEASE COMMAND is received, if running;
         3. the timer T3585 applied for the registered PLMN and for current access type or both 3GPP access type and non-3GPP access type, if running; and
         4. the timer T3585 applied for the registered PLMN and for both 3GPP access type and non-3GPP access type, if running; or
      2. in an SNPN:
         1. the timer T3585 applied for all the equivalent SNPNs and for the access over which the PDU SESSION AUTHENTICATION COMMAND message is received, associated with the RSNPN or an equivalent SNPN and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running;
         2. the timer T3585 applied for all the equivalent SNPNs and for both 3GPP access type and non-3GPP access type, associated with the RSNPN or an equivalent SNPN and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running;
         3. the timer T3585 applied for the registered SNPN and for the access over which the PDU SESSION AUTHENTICATION COMMAND message is received, associated with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running; and
         4. the timer T3585 applied for the registered PLMN and for both 3GPP access type and non-3GPP access type, associated with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running.
      The UE may send another PDU SESSION ESTABLISHMENT REQUEST message or PDU SESSION MODIFICATION REQUEST message for the same S-NSSAI; and
   2. if no S-NSSAI was provided during the PDU session establishment and the request type was different from "initial emergency request" and different from "existing emergency PDU session", the UE shall stop timer T3585 associated with no S-NSSAI, if running. The timer T3585 to be stopped includes:
      1. in a PLMN:
         1. the timer T3585 applied for all the PLMNs and for the access over which the PDU SESSION RELEASE COMMAND is received, if running;
         2. the timer T3585 applied for all the PLMNs and for the access over which the PDU SESSION RELEASE COMMAND is received, if running;
         3. the timer T3585 applied for the registered PLMN and for current access type or both 3GPP access type and non-3GPP access type, if running; and
         4. the timer T3585 applied for the registered PLMN and for both 3GPP access type and non-3GPP access type, if running; or
      2. in an SNPN:
         1. the timer T3585 applied for all the equivalent SNPNs and for the access over which the PDU SESSION AUTHENTICATION COMMAND message is received, associated with the RSNPN or an equivalent SNPN and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running;
         2. the timer T3585 applied for all the equivalent SNPNs and for both 3GPP access type and non-3GPP access type, associated with the RSNPN or an equivalent SNPN and with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running;
         3. the timer T3585 applied for the registered SNPN and for the access over which the PDU SESSION AUTHENTICATION COMMAND message is received, associated with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running; and
         4. the timer T3585 applied for the registered PLMN and for both 3GPP access type and non-3GPP access type, associated with the RSNPN and, if the UE supports access to an SNPN using credentials from a credentials holder, equivalent SNPNs or both, associated with the selected entry of the "list of subscriber data" or the selected PLMN subscription, if running.
      The UE may send another PDU SESSION ESTABLISHMENT REQUEST message without an S-NSSAI, or another PDU SESSION MODIFICATION REQUEST message without an S-NSSAI provided by the UE.

If the 5GSM congestion re-attempt indicator IE with the ABO bit set to "The back-off timer is applied in all PLMNs or equivalent SNPNs" is included in the PDU SESSION ESTABLISHMENT REJECT message with the 5GSM cause value #69 "insufficient resources for specific slice", then the UE shall apply the timer T3585 for all the PLMNs or all the equivalent SNPNs. Otherwise, the UE shall apply the timer T3585 for the registered PLMN or the registered SNPN. Additionally, if the 5GSM congestion re-attempt indicator IE with the CATBO bit set to "The back-off timer is applied in the current access type" is included in the PDU SESSION ESTABLISHMENT REJECT message with the 5GSM cause value #69 "insufficient resources for specific slice", then the UE shall apply the timer T3585 for the current access type. Otherwise, the UE shall apply the timer T3585 for both 3GPP access type and non-3GPP access type and the UE shall stop any running timer T3585 for the applied PLMN or SNPN and for the access different from the access from which the PDU SESSION ESTABLISHMENT REJECT message is received. If the Back-off timer value IE is not included or no Back-off timer value is received from the 5GMM sublayer, then the UE may send another PDU SESSION ESTABLISHMENT REQUEST message or PDU SESSION MODIFICATION REQUEST message for the same S-NSSAI or without an S-NSSAI as specified in subclause 6.2.8. When the timer T3585 is running or the timer is deactivated, the UE is allowed to initiate a PDU session establishment procedure for emergency services. If the timer T3585 is running when the UE enters state 5GMM-DEREGISTERED, the UE remains switched on, and the USIM in the UE (if any) remains the same and the entry in the "list of subscriber data" to which timer T3585 is associated (if any) is not updated, then timer T3585 is kept running until it expires or it is stopped. If the UE is switched off when the timer T3585 is running, and if the USIM in the UE (if any) remains the same and the entry in the "list of subscriber data" to which timer T3585 is associated (if any) is not updated when the UE is switched on, the UE shall behave as follows:

• let t1 be the time remaining for T3585 timeout at switch off and let t be the time elapsed between switch off and switch on. If t1 is greater than t, then the timer shall be restarted with the value t1 – t. If t1 is equal to or less than t, then the timer need not be restarted. If the UE is not capable of determining t, then the UE shall restart the timer with the value t1.

Upon PLMN change or SNPN change, if T3584 applied for the registered PLMN or the registered SNPN is running or is deactivated for an S-NSSAI, a DNN, and old PLMN or old SNPN, but T3584 is not running and is not deactivated for the S-NSSAI, the DNN, and new PLMN or new SNPN, then the UE is allowed to send a PDU SESSION ESTABLISHMENT REQUEST message for the same S-NSSAI and the same DNN in the new PLMN or new SNPN. Upon PLMN change or SNPN change, if T3585 applied for the registered PLMN or the registered SNPN is running or is deactivated for an S-NSSAI and old PLMN or old SNPN, but T3585 is not running and is not deactivated for the S-NSSAI and new PLMN or new SNPN, then the UE is allowed to send a PDU SESSION ESTABLISHMENT REQUEST message for the same S-NSSAI in the new PLMN or new SNPN. Upon SNPN change, if T3585 applied for all the equivalent SNPNs is running or is deactivated for an S-NSSAI and old SNPN, but T3585 is not running and is not deactivated for the S-NSSAI and new non-equivalent SNPN, then the UE is allowed to send a PDU SESSION ESTABLISHMENT REQUEST message for the same S-NSSAI in the new SNPN.

If the 5GSM cause value is different from #26 "insufficient resources", #28 "unknown PDU session type", #39 "reactivation requested", #46 "out of LADN service area", #50 "PDU session type IPv4 only allowed", #51 "PDU session type IPv6 only allowed", #54 "PDU session does not exist", #57 "PDU session type IPv4v6 only allowed", #58 "PDU session type Unstructured only allowed", #61 "PDU session type Ethernet only allowed", #67 "insufficient resources for specific slice and DNN", #68 "not supported SSC mode", and #69 "insufficient resources for specific slice", #86 "UAS services not allowed", and #33 "requested service option not subscribed" upon sending PDU SESSION ESTABLISHMENT REQUEST to establish an MA PDU session, and the Back-off timer value IE is included, the UE shall behave as follows: (if the UE is a UE configured for high priority access in selected PLMN or SNPN, exceptions are specified in subclause 6.2.12):

1. if the timer value indicates neither zero nor deactivated and:
   1. if the UE provided a DNN and S-NSSAI to the network during the PDU session establishment and the 5GSM cause value is different from #27 "missing or unknown DNN", the UE shall start the back-off timer with the value provided in the Back-off timer value IE for the PDU session establishment procedure and:
      1. in a PLMN, [PLMN, DNN, (mapped) HPLMN S-NSSAI] combination. The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same DNN and (mapped) HPLMN S-NSSAI in the current PLMN, until the back-off timer expires, the UE is switched off, or the USIM is removed; or
      2. in an SNPN, [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, DNN, (mapped) subscribed SNPN S-NSSAI] combination. The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same DNN and (mapped) subscribed SNPN S-NSSAI in the current SNPN using the selected entry of the "list of subscriber data" or selected PLMN subscription, until the back-off timer expires, the UE is switched off, the USIM is removed, or the selected entry of the "list of subscriber data" is updated;
   2. if the UE provided a DNN to the network during the PDU session establishment and the 5GSM cause value is #27 "missing or unknown DNN", the UE shall start the back-off timer with the value provided in the Back-off timer value IE for the PDU session establishment procedure and:
      1. in a PLMN, [PLMN, DNN] combination. The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same DNN in the current PLMN, until the back-off timer expires, the UE is switched off, or the USIM is removed; or
      2. in an SNPN, [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, DNN] combination. The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same DNN in the current SNPN using the selected entry of the "list of subscriber data" or selected PLMN subscription, until the back-off timer expires, the UE is switched off, the USIM is removed, or the selected entry of the "list of subscriber data" is updated;
   3. if the UE did not provide a DNN or S-NSSAI or any of the two parameters to the network during the PDU session establishment and the 5GSM cause value is different from #27 "missing or unknown DNN", it shall start the back-off timer accordingly for the PDU session establishment procedure and:
      1. in a PLMN, [PLMN, DNN, no S-NSSAI], [PLMN, no DNN, (mapped) HPLMN S-NSSAI] or [PLMN, no DNN, no S-NSSAI] combination. Dependent on the combination, the UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same [PLMN, DNN, no S-NSSAI], [PLMN, no DNN, (mapped) HPLMN S-NSSAI] or [PLMN, no DNN, no S-NSSAI] combination in the current PLMN, until the back-off timer expires, the UE is switched off, or the USIM is removed; or
      2. in an SNPN, [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, DNN, no S-NSSAI], [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN, (mapped) subscribed SNPN S-NSSAI] or [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN, no S-NSSAI] combination. Dependent on the combination, the UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, DNN, no S-NSSAI], [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN, (mapped) subscribed SNPN S-NSSAI] or [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN, no S-NSSAI] combination in the current PLMN using the selected entry of the "list of subscriber data" or selected PLMN subscription, until the back-off timer expires, the UE is switched off, the USIM is removed or the selected entry of the "list of subscriber data" is updated; or
   4. if the UE did not provide a DNN to the network during the PDU session establishment and the 5GSM cause value is #27 "missing or unknown DNN", it shall start the back-off timer accordingly for the PDU session establishment procedure and:
      1. in a PLMN, [PLMN, no DNN] combination. The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same [PLMN, no DNN] in the current PLMN, until the back-off timer expires, the UE is switched off, or the USIM is removed; or
      2. in an SNPN, [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN] combination. The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN] in the current PLMN, using the selected entry of the "list of subscriber data" or selected PLMN subscription, until the back-off timer expires, the UE is switched off, the USIM is removed or the selected entry of the "list of subscriber data" is updated;
2. if the timer value indicates that this timer is deactivated and:
   1. if the UE provided a DNN and S-NSSAI to the network during the PDU session establishment and the 5GSM cause value is different from #27 "missing or unknown DNN", the UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for:
      1. in a PLMN, the same DNN and (mapped) HPLMN S-NSSAI in the current PLMN, until the UE is switched off, or the USIM is removed; or
      2. in an SNPN, the same DNN and (mapped) subscribed SNPN S-NSSAI in the current SNPN using the selected entry of the "list of subscriber data" or selected PLMN subscription, until the UE is switched off, the USIM is removed, or the selected entry of the "list of subscriber data" is updated;
   2. if the UE provided a DNN to the network during the PDU session establishment and the 5GSM cause value is #27 "missing or unknown DNN", the UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for:
      1. in a PLMN, the same DNN in the current PLMN, until the UE is switched off, or the USIM is removed; or
      2. in an SNPN, the same DNN in the current SNPN using the selected entry of the "list of subscriber data" or selected PLMN subscription, until the UE is switched off, the USIM is removed, or the selected entry of the "list of subscriber data" is updated;
   3. if the UE did not provide a DNN or S-NSSAI or any of the two parameters to the network during the PDU session establishment and the 5GSM cause value is different from #27 "missing or unknown DNN", the UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for:
      1. in a PLMN, the same [PLMN, DNN, no S-NSSAI], [PLMN, no DNN, (mapped) HPLMN S-NSSAI] or [PLMN, no DNN, no S-NSSAI] combination in the current PLMN, until the UE is switched off, or the USIM is removed; or
      2. in an SNPN, the same [SNPN, the selected entry of the "list of subscriber data" or selected PLMN subscription, DNN, no S-NSSAI], [SNPN, the selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN, (mapped) subscribed SNPN S-NSSAI] or [SNPN, the selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN, no S-NSSAI] combination in the current SNPN using the selected entry of the "list of subscriber data" or selected PLMN subscription, until the UE is switched off, the USIM is removed, or the selected entry of the "list of subscriber data" is updated; or
   4. if the UE did not provide a DNN to the network during the PDU session establishment and the 5GSM cause value is #27 "missing or unknown DNN", the UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for:
      1. in a PLMN, the same [PLMN, no DNN] in the current PLMN, until the UE is switched off, or the USIM is removed; or
      2. in an SNPN, the same [SNPN, the selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN] in the current SNPN using the selected entry of the "list of subscriber data" or selected PLMN subscription, until the UE is switched off, the USIM is removed, or the selected entry of the "list of subscriber data" is updated; and
3. if the timer value indicates zero and the 5GSM cause value is different from #27 "missing or unknown DNN", the UE may send another PDU SESSION ESTABLISHMENT REQUEST message for:
   1. in a PLMN, the same combination of [PLMN, DNN, (mapped) HPLMN S-NSSAI], [PLMN, DNN, no S-NSSAI], [PLMN, no DNN, (mapped) HPLMN S-NSSAI], or [PLMN, no DNN, no S-NSSAI] in the current PLMN. If the timer value indicates zero and the 5GSM cause value is #27 "missing or unknown DNN", the UE may send another PDU SESSION ESTABLISHMENT REQUEST message for the same combination of [PLMN, DNN], or [PLMN, no DNN] in the current PLMN; or
   2. in an SNPN, the same combination of [SNPN, the selected entry of the "list of subscriber data" or selected PLMN subscription, DNN, (mapped) subscribed SNPN S-NSSAI], [SNPN, the selected entry of the "list of subscriber data" or selected PLMN subscription, DNN, no S-NSSAI], [SNPN, the selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN, (mapped) subscribed S-NSSAI], or [SNPN, the selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN, no S-NSSAI] in the current SNPN using the selected entry of the "list of subscriber data" or selected PLMN subscription. If the timer value indicates zero and the 5GSM cause value is #27 "missing or unknown DNN", the UE may send another PDU SESSION ESTABLISHMENT REQUEST message for the same combination of [SNPN, the selected entry of the "list of subscriber data" or selected PLMN subscription, DNN], or [SNPN, the selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN] in the current SNPN using the selected entry of the "list of subscriber data" or selected PLMN subscription.

If the Back-off timer value IE is not included, then the UE shall ignore the Re-attempt indicator IE provided by the network in the PDU SESSION ESTABLISHMENT REJECT message, if any.

1. Additionally, if the 5GSM cause value is #8 "operator determined barring", #32 "service option not supported", #33 "requested service option not subscribed" upon sending PDU SESSION ESTABLISHMENT REQUEST not to establish an MA PDU session, or #70 "missing or unknown DNN in a slice", then:
   1. the UE not operating in SNPN access operation mode shall proceed as follows:
      1. if the UE is registered in the HPLMN or in a PLMN that is within the EHPLMN list, the UE shall behave as described above in the present subclause using the configured SM Retry Timer value as specified in TS 24.368 or in USIM file NASCONFIG as specified in TS 31.102, if available, as back-off timer value; and
         • an SM Retry Timer value in ME as specified in TS 24.368; and
         • an SM Retry Timer value in USIM file NASCONFIG as specified in TS 31.102.
      2. otherwise, if the UE is not registered in its HPLMN or in a PLMN that is within the EHPLMN list, or if the SM Retry Timer value is not configured, the UE shall behave as described above in the present subclause, using the default value of 12 minutes for the back-off timer; or
   2. the UE operating in SNPN access operation mode shall proceed as follows:
      1. if:
         1. the SM Retry Timer value for the current SNPN as specified in TS 24.368 is available; or
         2. the UE used the USIM for registration to the current SNPN and the SM Retry Timer value in USIM file NASCONFIG as specified in TS 31.102 is available;
         then the UE shall behave as described above in the present subclause using the configured SM Retry Timer value as back-off timer value; or
      2. otherwise, the UE shall behave as described above in the present subclause, using the default value of 12 minutes for the back-off timer.
2. For 5GSM cause value #27 "missing or unknown DNN", then:
   1. the UE not operating in SNPN access operation mode shall proceed as follows:
      1. if the UE is registered in the HPLMN or in a PLMN that is within the EHPLMN list, the UE shall start the back-off timer with the configured SM Retry Timer value as specified in TS 24.368 or in USIM file NASCONFIG as specified in TS 31.102, if available, as back-off timer value for the PDU session establishment procedure and the [PLMN, DNN] or [PLMN, no DNN] combination. The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same DNN in the current PLMN, until the back-off timer expires, the UE is switched off or the USIM is removed; and
         • an SM Retry Timer value in ME as specified in TS 24.368; and
         • an SM Retry Timer value in USIM file NASCONFIG as specified in TS 31.102.
      2. otherwise, if the UE is not registered in its HPLMN or in a PLMN that is within the EHPLMN list, or if the SM Retry Timer value is not configured, the UE shall start the back-off timer with the default value of 12 minutes as back-off timer value for the PDU session establishment procedure and the [PLMN, DNN] or [PLMN, no DNN] combination. The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same DNN in the current PLMN, until the back-off timer expires, the UE is switched off or the USIM is removed; or
   2. the UE operating in SNPN access operation mode shall proceed as follows:
      1. if:
         1. the SM Retry Timer value for the current SNPN as specified in TS 24.368 is available; or
         2. the UE used the USIM for registration to the current SNPN and the SM Retry Timer value in USIM file NASCONFIG as specified in TS 31.102 is available;
         then:
         the UE shall start the back-off timer with the configured SM Retry Timer value as back-off timer value for the PDU session establishment procedure and the [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, DNN] or [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN] combination. The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same DNN in the current SNPN using the selected entry in the "list of subscriber data" or selected PLMN subscription, until the back-off timer expires, the UE is switched off, the UICC containing the USIM is removed or the selected entry of the "list of subscriber data" is updated; or
      2. otherwise:
         • the UE shall start the back-off timer with the default value of 12 min as back-off timer value for the PDU session establishment procedure and the [SNPN, selected entry of the "list of subscriber data" or selected PLMN subscription, DNN] or [SNPN, selected entry in the "list of subscriber data" or selected PLMN subscription, no DNN] combination. The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message for the same DNN in the current SNPN using the selected entry of the "list of subscriber data", until the back-off timer expires, the UE is switched off, the UICC containing the USIM is removed or the selected entry of the "list of subscriber data" is updated; and
3. For 5GSM cause values different from #8 "operator determined barring", #27 "missing or unknown DNN", #32 "service option not supported", #33 "requested service option not subscribed" and #70 "missing or unknown DNN in a slice", the UE behaviour regarding the start of a back-off timer is specified in subclause 6.2.12.

The UE shall not stop any back-off timer:

1. upon a PLMN or SNPN change;
2. upon an inter-system change; or
3. upon registration over another access type.

If the network indicates that a back-off timer for the PDU session establishment procedure is deactivated, then it remains deactivated;

1. upon a PLMN or SNPN change;
2. upon an inter-system change; or
3. upon registration over another access type.

If the back-off timer is started upon receipt of a PDU SESSION ESTABLISHMENT REJECT (i.e. the timer value was provided by the network, a configured value is available or the default value is used as explained above) or the back-off timer is deactivated, the UE behaves as follows:

1. after a PLMN or SNPN change:
   1. the UE may send a PDU SESSION ESTABLISHMENT REQUEST message for:
      1. in a PLMN, the combination of [new PLMN, DNN, (mapped) HPLMN S-NSSAI], [new PLMN, DNN, no S-NSSAI], [new PLMN, no DNN, (mapped) HPLMN S-NSSAI], or [new PLMN, no DNN, no S-NSSAI] in the new PLMN, if the back-off timer is not running and is not deactivated for the PDU session establishment procedure and the combination of [new PLMN, DNN, (mapped) HPLMN S-NSSAI], [new PLMN, DNN, no S-NSSAI], [new PLMN, no DNN, (mapped) HPLMN S-NSSAI], or [new PLMN, no DNN, no S-NSSAI]; or
      2. in an SNPN, the combination of [new SNPN, the selected entry of the "list of subscriber data" or selected PLMN subscription, DNN, (mapped) subscribed SNPN S-NSSAI], [new SNPN, the selected entry of the "list of subscriber data" or selected PLMN subscription, DNN, no S-NSSAI], [new PLMN, the selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN, (mapped) subscribed SNPN S-NSSAI], or [new SNPN, the selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN, no S-NSSAI] in the new SNPN, if the back-off timer is not running and is not deactivated for the PDU session establishment procedure and the combination of [new SNPN, the selected entry of the "list of subscriber data" or selected PLMN subscription, DNN, (mapped) subscribed SNPN S-NSSAI], [new SNPN, the selected entry of the "list of subscriber data" or selected PLMN subscription, DNN, no S-NSSAI], [new SNPN, the selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN, (mapped) subscribed SNPN S-NSSAI], or [new SNPN, the selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN, no S-NSSAI];
   2. as an implementation option, for the 5GSM cause value #8 "operator determined barring", #32 "service option not supported", #33 "requested service option not subscribed" and #70 "missing or unknown DNN in a slice", if the network does not include a Re-attempt indicator IE, the UE may decide not to automatically send another PDU SESSION ESTABLISHMENT REQUEST message for:
      1. in a PLMN, the same combination of [PLMN, DNN, (mapped) HPLMN S-NSSAI], [PLMN, DNN, no S-NSSAI], [PLMN, no DNN, (mapped) HPLMN S-NSSAI], or [PLMN, no DNN, no S-NSSAI] using the same PDU session type if the UE is registered to a new PLMN which is in the list of equivalent PLMNs; or
      2. in an SNPN, if the UE supports equivalent SNPNs, the same combination of [SNPN, the selected entry of the "list of subscriber data" or selected PLMN subscription, DNN, (mapped) subscribed SNPN S-NSSAI], [SNPN, the selected entry of the "list of subscriber data" or selected PLMN subscription, DNN, no S-NSSAI], [SNPN, the selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN, (mapped) subscribed SNPN S-NSSAI], or [SNPN, the selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN, no S-NSSAI] using the same PDU session type and using the selected entry of the "list of subscriber data" or selected PLMN subscription, if the UE is registered to a new SNPN which is in the list of equivalent SNPNs; and
   3. as an implementation option, for the 5GSM cause value #27 "missing or unknown DNN", if the network does not include a Re-attempt indicator IE, the UE may decide not to automatically send another PDU SESSION ESTABLISHMENT REQUEST message for:
      1. in a PLMN, the same combination of [PLMN, DNN] or [PLMN, no DNN] using the same PDU session type if the UE is registered to a new PLMN which is in the list of equivalent PLMNs; or
      2. in an SNPN, if the UE supports equivalent SNPNs, the same combination of [SNPN, the selected entry of the "list of subscriber data" or selected PLMN subscription, DNN] or [SNPN, the selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN] using the same PDU session type if the UE is registered to a new SNPN which is in the list of equivalent SNPNs; or
2. if the network does not include the Re-attempt indicator IE to indicate whether re-attempt in S1 mode is allowed, or the UE ignores the Re-attempt indicator IE, e.g. because the Back-off timer value IE is not included, then:
   1. if the UE is registered in its HPLMN or in a PLMN that is within the EHPLMN list and the back-off timer is running for the combination of [PLMN, DNN, (mapped) HPLMN S-NSSAI] or [PLMN, DNN, no S-NSSAI], the UE shall apply the configured SM_RetryAtRATChange value as specified in TS 24.368 or in USIM file NASCONFIG as specified in TS 31.102, if available, to determine whether the UE may attempt a PDN connectivity procedure for the same [PLMN, DNN] combination in S1 mode. If the back-off timer is running for the combination of [PLMN, no DNN, (mapped) HPLMN S-NSSAI] or [PLMN, no DNN, no S-NSSAI], the same applies for the PDN connectivity procedure for the [PLMN, no DNN] combination in S1 mode accordingly; and
   2. if the UE is not registered in its HPLMN or in a PLMN that is within the EHPLMN list, or if the NAS configuration MO as specified in TS 24.368 is not available and the value for inter-system change is not configured in the USIM file NASCONFIG, then the UE behaviour regarding a PDN connectivity procedure for the same [PLMN, DNN] or [PLMN, no DNN] combination in S1 mode is unspecified; and
3. if the network includes the Re-attempt indicator IE indicating that re-attempt in an equivalent PLMN or SNPN is not allowed, then depending on the timer value received in the Back-off timer value IE, for:
   1. in a PLMN, each combination of a PLMN from the equivalent PLMN list and the respective [DNN, (mapped) HPLMN S-NSSAI], [DNN, no S-NSSAI], [no DNN, (mapped) HPLMN S-NSSAI], or [no DNN, no S-NSSAI] combination, the UE shall start a back-off timer for the PDU session establishment procedure with the value provided by the network, or deactivate the respective back-off timer as follows:
      1. if the Re-attempt indicator IE additionally indicates that re-attempt in S1 mode is allowed, the UE shall start or deactivate the back-off timer for N1 mode only; and
      2. otherwise, the UE shall start or deactivate the back-off timer for S1 and N1 mode; or
   2. in a SNPN, if the UE supports equivalent SNPNs, each combination of a SNPN from the equivalent SNPN list and the respective [the selected entry of the "list of subscriber data" or selected PLMN subscription, DNN, (mapped) subscribed SNPN S-NSSAI], [the selected entry of the "list of subscriber data" or selected PLMN subscription, DNN, no S-NSSAI], [the selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN, (mapped) subscribed SNPN S-NSSAI], or [the selected entry of the "list of subscriber data" or selected PLMN subscription, no DNN, no S-NSSAI] combination, the UE shall start a back-off timer for the PDU session establishment procedure with the value provided by the network, or deactivate the respective back-off timer, for N1 mode.

If the back-off timer for a [PLMN, DNN] or [PLMN, no DNN] combination, was started or deactivated in S1 mode upon receipt of PDN CONNECTIVITY REJECT message (see TS 24.301) and the network indicated that re-attempt in N1 mode is allowed, then this back-off timer does not prevent the UE from sending a PDU SESSION ESTABLISHMENT REQUEST message in this PLMN for the same DNN, or without DNN, after inter-system change to N1 mode. If the network indicated that re-attempt in N1 mode is not allowed, the UE shall not send any PDU SESSION ESTABLISHMENT REQUEST message in this PLMN for the same DNN in combination with any S-NSSAI or without S-NSSAI, or in this PLMN without DNN in combination with any S-NSSAI or without S-NSSAI, after inter-system change to N1 mode until the timer expires, the UE is switched off or the USIM is removed. When the back-off timer is running or the timer is deactivated, the UE is allowed to initiate a PDU session establishment procedure if the procedure is for emergency services. If the 5GSM cause value is #28 "unknown PDU session type" and the PDU SESSION ESTABLISHMENT REQUEST message contained a PDU session type IE indicating a PDU session type, the UE shall ignore the Back-off timer value IE and Re-attempt indicator IE provided by the network, if any. The UE may send another PDU SESSION ESTABLISHMENT REQUEST message to establish a new PDU session with the PDU session type IE indicating another PDU session type, e.g. using another value which can be used for the rejected component in another route selection descriptor, if any, as specified in TS 24.526. The behaviour of the UE for 5GSM cause value #28 also applies if the PDU session is a MA PDU Session. If the 5GSM cause value is #39 "reactivation requested", the UE shall ignore the Back-off timer value IE and Re-attempt indicator IE provided by the network, if any. If the 5GSM cause value is #46 "out of LADN service area", the UE shall ignore the Back-off timer value IE and Re-attempt indicator IE provided by the network, if any. If the UE is not located inside the LADN service area, the UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message or another PDU SESSION MODIFICATION REQUEST message except for indicating a change of 3GPP PS data off UE status for the LADN DNN provided by the UE during the PDU session establishment procedure until the LADN information for the specific LADN DNN or the extended LADN information for the specific LADN DNN and S-NSSAI is updated as described in subclause 5.4.4 and subclause 5.5.1. If the UE is not located inside the LADN service area, the UE shall not indicate the PDU session(s) for the LADN DNN provided by the UE during the PDU session establishment procedure in the Uplink data status IE included in the SERVICE REQUEST message until the LADN information for the specific LADN DNN or the extended LADN information for the specific LADN DNN and S-NSSAI is updated as described in subclause 5.4.4 and subclause 5.5.1. If the 5GSM cause value is #50 "PDU session type IPv4 only allowed", #51 "PDU session type IPv6 only allowed", #57 "PDU session type IPv4v6 only allowed", #58 "PDU session type Unstructured only allowed", or #61 "PDU session type Ethernet only allowed", the UE shall ignore the Back-off timer value IE provided by the network, if any. The UE shall evaluate the URSP rules if available as specified in TS 24.526. The UE shall not subsequently send another PDU SESSION ESTABLISHMENT REQUEST message for:

1. in a PLMN, the same DNN (or no DNN, if no DNN was indicated by the UE) and the same (mapped) HPLMN S-NSSAI (or no S-NSSAI, if no S-NSSAI was indicated by the UE) to obtain a PDU session type different from the one allowed by the network until any of the following conditions is fulfilled:
   1. the UE is registered to a new PLMN which was not in the list of equivalent PLMNs at the time when the PDU SESSION ESTABLISHMENT REJECT message was received;
   2. the UE is registered to a new PLMN which was in the list of equivalent PLMNs at the time when the PDU SESSION ESTABLISHMENT REJECT message was received, and either the network did not include a Re-attempt indicator IE in the PDU SESSION ESTABLISHMENT REJECT message or the Re-attempt indicator IE included in the message indicated that re-attempt in an equivalent PLMN is allowed;
   3. the UE is switched off; or
   4. the USIM is removed; or
2. in an SNPN, the same DNN (or no DNN, if no DNN was indicated by the UE) and the same (mapped) subscribed SNPN S-NSSAI (or no S-NSSAI, if no S-NSSAI was indicated by the UE), using the selected entry of the "list of subscriber data" or selected PLMN subscription until any of the following conditions is fulfilled:
   1. the UE is registered to a new SNPN which was not in the list of equivalent SNPNs at the time when the PDU SESSION ESTABLISHMENT REJECT message was received;
   2. the UE is registered to a new SNPN which was in the list of equivalent SNPNs at the time when the PDU SESSION ESTABLISHMENT REJECT message was received, and either the network did not include a Re-attempt indicator IE in the PDU SESSION ESTABLISHMENT REJECT message or the Re-attempt indicator IE included in the message indicated that re-attempt in an equivalent SNPN is allowed;
   3. the UE is switched off;
   4. the USIM is removed; or
   5. the selected entry of the "list of subscriber data" is updated.

For the 5GSM cause values #50 "PDU session type IPv4 only allowed", #51 "PDU session type IPv6 only allowed", #57 "PDU session type IPv4v6 only allowed", #58 "PDU session type Unstructured only allowed", and #61 "PDU session type Ethernet only allowed", the UE shall ignore the value of the RATC bit in the Re-attempt indicator IE provided by the network, if any. If the 5GSM cause value is #54 "PDU session does not exist", the UE shall ignore the Back-off timer value IE and Re-attempt indicator IE provided by the network, if any. If the PDU session establishment procedure is to perform handover of an existing PDU session between 3GPP access and non-3GPP access, the UE shall release locally the existing PDU session with the PDU session ID included in the PDU SESSION ESTABLISHMENT REJECT message. The UE may initiate another UE-requested PDU session establishment procedure with the request type set to "initial request" in the subsequent PDU SESSION ESTABLISHMENT REQUEST message to establish a PDU session with:

a) in a PLMN, the same DNN (or no DNN, if no DNN was indicated by the UE) and the same (mapped) HPLMN S-NSSAI (or no S-NSSAI, if no S-NSSAI was indicated by the UE); or
1. in an SNPN, the same DNN (or no DNN, if no DNN was indicated by the UE) and the same (mapped) subscribed SNPN S-NSSAI (or no S-NSSAI, if no S-NSSAI was indicated by the UE) using the selected entry of the "list of subscriber data" or selected PLMN subscription.

If the 5GSM cause value is #68 "not supported SSC mode", the UE shall ignore the Back-off timer value IE and Re-attempt indicator IE provided by the network, if any. The UE shall evaluate the URSP rules if available as specified in TS 24.526. The UE shall not subsequently send another PDU SESSION ESTABLISHMENT REQUEST message for:

1. in a PLMN, the same DNN (or no DNN, if no DNN was indicated by the UE) and the same (mapped) HPLMN S-NSSAI (or no S-NSSAI, if no S-NSSAI was indicated by the UE) using the same SSC mode or an SSC mode which was not included in the Allowed SSC mode IE until any of the following conditions is fulfilled:
   1. the UE is registered to a new PLMN which was not in the list of equivalent PLMNs at the time when the PDU SESSION ESTABLISHMENT REJECT message was received;
   2. the SSC mode which is used to access to the DNN (or no DNN, if no DNN was indicated by the UE) and the (mapped) HPLMN S-NSSAI (or no S-NSSAI, if no S-NSSAI was indicated by the UE) is changed by the UE which subsequently requests a new SSC mode in the Allowed SSC mode IE or no SSC mode;
   3. the UE is switched off; or
   4. the USIM is removed; or
2. in an SNPN, the same DNN (or no DNN, if no DNN was indicated by the UE) and the same subscribed SNPN S-NSSAI (or no S-NSSAI, if no S-NSSAI was indicated by the UE) using the same SSC mode or an SSC mode which was not included in the Allowed SSC mode IE, using the selected entry of the "list of subscriber data" or selected PLMN subscription until any of the following conditions is fulfilled:
   1. the UE is registered to a new SNPN which was not in the list of equivalent SNPNs at the time when the PDU SESSION ESTABLISHMENT REJECT message was received;
   2. the SSC mode which is used to access to the DNN (or no DNN, if no DNN was indicated by the UE) and the (mapped) subscribed SNPN S-NSSAI (or no S-NSSAI, if no S-NSSAI was indicated by the UE) is changed by the UE which subsequently requests a new SSC mode in the Allowed SSC mode IE or no SSC mode;
   3. the UE is switched off;
   4. the USIM is removed, or
   5. the selected entry of the "list of subscriber data" is updated.

If the UE receives the 5GSM cause value is #33 "requested service option not subscribed" upon sending PDU SESSION ESTABLISHMENT REQUEST to establish an MA PDU session, the UE shall ignore the Back-off timer value IE and Re-attempt indicator IE provided by the network, if any. The UE shall evaluate URSP rules, if available, as specified in TS 24.526 and the UE may send PDU SESSION ESTABLISHMENT REQUEST after evaluating those URSP rules. If the 5GSM cause value is #86 "UAS services not allowed", the UE shall ignore the Back-off timer value IE and Re-attempt indicator IE provided by the network, if any, and shall behave as specified in subcluase 6.4.1.4.1. Upon receipt of an indication from 5GMM sublayer that the 5GSM message was not forwarded because the DNN is not supported or not subscribed in a slice along with a PDU SESSION ESTABLISHMENT REQUEST message with the PDU session ID IE set to the PDU session ID of the PDU session, the UE shall stop timer T3580, shall abort the procedure and shall behave as follows:

1. if the timer value indicates neither zero nor deactivated, the UE shall start the back-off timer with the value received from the 5GMM sublayer for the PDU session establishment procedure and:
   1. in a PLMN, the [PLMN, DNN, S-NSSAI] combination or the [PLMN, DNN, no S-NSSAI] combination, if no S-NSSAI was provided during the PDU session establishment. The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message in the PLMN for the same DNN and the same S-NSSAI that were sent by the UE, or for the same DNN and no S-NSSAI if S-NSSAI that was not sent by the UE, until:
      1. the back-off timer expires;
      2. the UE is switched off;
      3. the USIM is removed; or
      4. the DNN is included in the LADN information or extended LADN information and the network provides the LADN information or extended LADN information during the registration procedure or the generic UE configuration update procedure; or
   2. in an SNPN, the [SNPN, the selected entry of the "list of subscriber data" or selected PLMN subscription, DNN, S-NSSAI] combination or the [SNPN, the selected entry of the "list of subscriber data" or selected PLMN subscription, DNN, no S-NSSAI] combination, if no S-NSSAI was provided during the PDU session establishment. The UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message in the SNPN for the same DNN and the same S-NSSAI that were sent by the UE, or for the same DNN and no S-NSSAI if S-NSSAI that was not sent by the UE, using the selected entry of the "list of subscriber data" or selected PLMN subscription, until:
      1. the back-off timer expires;
      2. the UE is switched off;
      3. the USIM is removed; or
         iv) the selected entry of the "list of subscriber data" is updated; or
      4. the DNN is included in the LADN information or extended LADN information and the network provides the LADN information or extended LADN information during the registration procedure or the generic UE configuration update procedure;
2. if the timer value is not received from the 5GMM sublayer or the timer value indicates that this timer is deactivated, the UE shall not send another PDU SESSION ESTABLISHMENT REQUEST message
   1. in the PLMN for the same DNN and the same S-NSSAI that were sent by the UE, or for the same DNN and no S-NSSAI if S-NSSAI that was not sent by the UE, until:
      1. the UE is switched off;
      2. the USIM is removed; or
      3. the DNN is included in the LADN information or extended LADN information and the network provides the LADN information or extended LADN information during the registration procedure or the generic UE configuration update procedure; and
   2. in the SNPN, for the same DNN and the same S-NSSAI that were sent by the UE, or for the same DNN and no S-NSSAI if S-NSSAI that was not sent by the UE, using the selected entry of the "list of subscriber data" or selected PLMN subscription, until:
      1. the UE is switched off;
      2. the USIM is removed;
      3. the selected entry of the "list of subscriber data" is updated; or
      4. the DNN is included in the LADN information or extended LADN information and the network provides the LADN information or extended LADN information during the registration procedure or the generic UE configuration update procedure; and
3. if the timer value indicates zero, the UE may send another PDU SESSION ESTABLISHMENT REQUEST message for:
   1. in a PLMN, the same combination of [PLMN, DNN, S-NSSAI], [PLMN, DNN, no S-NSSAI] in the current PLMN; or
   2. in an SNPN, the same combination of [SNPN, the selected entry of the "list of subscriber data" or selected PLMN subscription, DNN, S-NSSAI], [SNPN, the selected entry of the "list of subscriber data" or selected PLMN subscription, DNN, no S-NSSAI] in the current SNPN.