Core Network: Architecture and Signaling Procedures v2.2.0 PDF

6.9. Tracking Area Update Procedure

6.9.1. Technical Overview

The TAU procedure is an EMM procedure that a UE in the EMM-REGISTERED state starts by sending a NAS Tracking Area Update Request message to the MME (TS 24.301 clause 5.5.3.2.2). The UE starts the procedure in either the ECM-IDLE state or the ECM-CONNECTED state (TS 23.401 clause 5.3.3.0), for example in these cases:

  • The UE enters a tracking area whose TAI isn’t in the list of TAIs that it has registered with the network, so that the network learns the current location of the UE.

  • The periodic tracking area update timer T3412 expires, so that the UE periodically notifies the network that it is still available, and the UE then indicates "periodic updating" in the EPS update type IE.

  • The UE performs an inter-system change, for example from N1 mode to S1 mode, which is a change from 5GS to EPS.

  • The UE changes its UE network capability, MS network capability, or UE specific DRX parameter, or the CIoT EPS optimizations that it needs to use change.

TS 24.301 clause 5.5.3.2.2 lists all the triggers, and TS 23.401 clause 5.3.3.0 lists the stage 2 triggers. The MME decides whether to relocate the S-GW independently of the trigger (TS 23.401 clause 5.3.3.0). This section describes the procedure with an MME change, both with S-GW relocation (TS 23.401 clause 5.3.3.1) and without S-GW relocation (TS 23.401 clause 5.3.3.2).

The procedure has these high-level effects on the network elements:

On the UE

The UE stores the TAI list that it receives, sets its EPS update status to EU1 UPDATED when the network accepts the update, and stores the new GUTI if the MME has reallocated one (TS 24.301 clause 5.5.3.2.4). If the UE has set the "active" flag, the network can set up the user-plane radio and S1 bearers together with the Tracking Area Update Accept message (TS 23.401 clause 5.3.3.1, steps 2 and 20).

On the eNodeB

The eNodeB relays the NAS signaling between the UE and the MME over S1AP and adds the TAI and the E-UTRAN CGI of the cell from which it has received the Tracking Area Update Request message (TS 23.401 clause 5.3.3.1, step 3).

On the new MME

The new MME uses the NAS integrity protection of the request to validate the UE, retrieves the MM context and the EPS bearer contexts of the UE from the old MME over S10, or from the old AMF over N26 (TS 29.274 clause 7.3.5), and selects a new S-GW when the S-GW is relocated. It then registers itself with the HSS over S6a and updates the bearers in the S-GW (TS 23.401 clause 5.3.3.1, steps 4 to 17).

On the old MME

The old MME validates the Context Request message, transfers the security context and the PDN connections of the UE to the new MME, removes the MM context when the HSS cancels the location, and, when the S-GW is relocated, deletes the bearer resources in the old S-GW (TS 23.401 clause 5.3.3.1, steps 5, 14, and 18).

On the S-GW

With S-GW relocation, the new S-GW allocates the tunnel endpoints for the bearers and establishes the S5/S8 bearers towards the P-GW. Without S-GW relocation, the S-GW updates its bearer context with the information from the new MME (TS 23.401 clause 5.3.3.1, step 11, and clause 5.3.3.2, step 13). When an S1-U GTP-U tunnel is set up during the TAU, the S-GW receives the downlink S1 eNodeB F-TEID in a Modify Bearer Request message (TS 29.274 clause 7.2.7).

On the P-GW

The P-GW remains the IP anchor of the PDN connection. With S-GW relocation, the P-GW switches the downlink path to the new S-GW and sends one or more end marker packets on the old path. If dynamic PCC is deployed and the RAT type information needs to reach the PCRF, the P-GW sends it to the PCRF in an IP-CAN Session Modification procedure (TS 23.401 clause 5.3.3.1, steps 9, 9a, and 10).

On the HSS

The HSS stores the identity of the new MME, cancels the location in the old MME, and returns the subscription data of the UE to the new MME (TS 23.401 clause 5.3.3.1, steps 12, 13, and 17).

6.9.2. Call Flow

The call flow has four phases: Tracking Area Update Request and Context Transfer, Session Update, Location Update, and Completion. When the S-GW isn’t relocated, the New S-GW in the figure is the S-GW that already serves the UE. Without an MME change, the context transfer and the location update are skipped, and when the S-GW isn’t relocated either, the Modify Bearer exchanges of the Session Update phase are also skipped (TS 23.401 clause 5.3.3.1, NOTE 2, and clause 5.3.3.2, NOTE 2).

Tracking area update procedure call flow
Figure 26. Tracking area update procedure call flow

6.9.3. Step-by-Step Description

  1. The UE sends a NAS Tracking Area Update Request message over the Uu interface to the eNodeB, together with RRC parameters that indicate the selected network and the old GUMMEI (TS 23.401 clause 5.3.3.1, step 2). The message carries the EPS update type, which can be "TA updating", "combined TA/LA updating", "combined TA/LA updating with IMSI attach", "periodic updating", or "disaster roaming update", the "active" flag, which is part of the EPS update type IE and requests the establishment of the radio and S1 bearers, the NAS key set identifier with the eKSI, the old GUTI, the old GUTI type, which indicates whether the old GUTI is native or mapped from a P-TMSI and Routeing Area Identity (RAI), the last visited registered TAI, the EPS bearer context status, the UE network capability, the MS network capability, and the voice domain preference and UE’s usage setting (TS 24.301 clause 8.2.29.1, and clause 9.9.3.14). A UE that uses the control plane CIoT EPS optimization sets the "signalling active" flag in the Additional update type IE (TS 24.301 clause 5.5.3.2.2). The UE integrity protects the message with the NAS-MAC (TS 23.401 clause 5.3.3.1, step 2, and TS 33.401 clause 7.2.7), and starts timer T3430 after it has sent the message (TS 24.301 clause 5.5.3.2.2).

  2. The eNodeB derives the MME address from the old GUMMEI and the selected network. If that MME isn’t associated with the eNodeB, if the GUMMEI isn’t available, or if the UE indicates load re-balancing, the eNodeB selects an MME with the MME selection function (TS 23.401 clause 5.3.3.1, step 3, and clause 4.3.8.3). The eNodeB forwards the NAS message to the new MME over S1-MME in an S1AP Initial UE Message message, which carries the eNB UE S1AP ID, the NAS-PDU, the TAI, the E-UTRAN CGI, the RRC Establishment Cause, and, optionally, the S-TMSI and the GUMMEI (TS 36.413 clause 9.1.7.1). When the UE is already in the ECM-CONNECTED state, the eNodeB uses an S1AP Uplink NAS Transport message, which carries the MME UE S1AP ID, the eNB UE S1AP ID, the NAS-PDU, the E-UTRAN CGI, and the TAI (TS 36.413 clause 9.1.7.3, and TS 23.401 clause 5.3.3.0A).

  3. If the MME has changed, the new MME derives the address of the old MME from the old GUTI and sends a GTPv2 Context Request message to the old MME over S10 to retrieve the MM context and the EPS bearer contexts of the UE (TS 23.401 clause 5.3.3.1, step 4). The message carries the GUTI, the Complete TAU Request Message, which the old MME uses to check the integrity of the request, the S3/S16/S10/N26 Address and TEID for Control Plane of the new MME, the RAT Type, and the Indication IE with the MS Validated flag, which the new MME sets when it has authenticated the UE or validated the integrity protection of the request (TS 29.274 clause 7.3.5).

  4. The old MME validates the request with the Complete TAU Request Message and, if the validation succeeds, starts a timer and returns a GTPv2 Context Response message to the new MME over S10 (TS 23.401 clause 5.3.3.1, steps 4 and 5). The message carries the Cause set to "Request accepted" (16), the IMSI, and the MME/SGSN/AMF UE MM Context, which holds the KASME, the eKSI, the NAS security algorithms, the NAS uplink and downlink counts, and the subscribed UE-AMBR (TS 29.274 clauses 7.3.6 and 8.38). The MME/SGSN/AMF UE EPS PDN Connections IE carries, for each PDN connection, the APN, the APN-AMBR, the PGW S5/S8 IP Address for Control Plane or PMIP, and the bearer contexts, each with the EBI, the Bearer Level QoS, the SGW S1/S4/S12/S11 IP Address and TEID for user plane, and the PGW S5/S8 IP Address and TEID for user plane (TS 29.274 clause 7.3.6). The message also carries the SGW S11/S4 IP Address and TEID for Control Plane and, when session trace is active, the Trace Information (TS 29.274 clause 7.3.6). If the UE isn’t known in the old MME, or if the integrity check of the request fails, the old MME responds with an error cause instead (TS 23.401 clause 5.3.3.1, step 5).

  5. If the integrity check of the Tracking Area Update Request message has failed, authentication is mandatory, and the new MME and the UE perform the authentication and NAS security procedures of TS 23.401 clause 5.3.10 (TS 23.401 clause 5.3.3.1, steps 4 and 6). The NAS Authentication Request message carries the NAS key set identifier for the KASME, the RAND, and the AUTN, and the UE returns the RES in the NAS Authentication Response message (TS 24.301 clauses 8.2.7 and 8.2.8). If the NAS algorithms change with the change of MME, the new MME starts a NAS security mode command procedure, whose Security Mode Command message carries the selected NAS security algorithms for ciphering and integrity protection, the NAS key set identifier, and the replayed UE security capabilities, protected with the NAS-MAC (TS 33.401 clause 7.2.4.3.2, and TS 24.301 clause 8.2.20).

  6. If the MME has changed, the new MME sends a GTPv2 Context Acknowledge message to the old MME over S10, with the Cause set to "Request accepted" (16) (TS 23.401 clause 5.3.3.1, step 7, and TS 29.274 clause 7.3.7). If the new MME has selected a new S-GW, the message carries the Indication Flags with the SGW Change Indication set to 1 (TS 29.274 clause 7.3.7). The old MME then marks in its UE context that the information in the gateways and in the HSS is invalid, so that it updates the gateways and the HSS if the UE returns to it before the procedure completes (TS 23.401 clause 5.3.3.1, step 7, and clause 5.3.3.2, step 7).

  7. If the MME relocates the S-GW, the new MME selects a new S-GW with the Serving GW selection function, which can use DNS to resolve the candidate S-GW addresses, and sends a GTPv2 Create Session Request message to the new S-GW over S11, one message for each PDN connection (TS 23.401 clause 5.3.3.1, steps 7 and 8, and clause 4.3.8.2). The message carries the IMSI, the Sender F-TEID for Control Plane of the new MME, the PGW S5/S8 Address for Control Plane or PMIP, the Bearer Contexts to be created, with the EBI, the Bearer Level QoS, and the S5/S8-U PGW F-TEID, the RAT Type, the Serving Network, and the Indication Flags (TS 29.274 clause 7.2.1). The new MME includes the User Location Information if the P-GW has requested location information change reporting and the information has changed (TS 23.401 clause 5.3.3.1, step 8).

  8. If the S-GW is relocated, the new S-GW sends a GTPv2 Modify Bearer Request message to the P-GW over S5/S8, one message for each PDN connection, to report the change of S-GW and, for example, the RAT type for charging (TS 23.401 clause 5.3.3.1, step 9). The message carries the Sender F-TEID for Control Plane of the new S-GW, the Bearer Contexts to be modified, with the EBI and the S5/8-U SGW F-TEID of each bearer, the RAT Type, and the Serving Network, together with the User Location Information and the User CSG Information if the new MME has sent them in step 7 (TS 23.401 clause 5.3.3.1, step 9, and TS 29.274 clause 7.2.7). The APN-AMBR is sent in this message only for a TAU from a Gn/Gp SGSN (TS 29.274 clause 7.2.7).

  9. If the S-GW is relocated, the P-GW updates its bearer contexts, switches the downlink path to the new S-GW, and sends one or more GTP-U end marker packets on the old path. It then returns a GTPv2 Modify Bearer Response message to the new S-GW (TS 23.401 clause 5.3.3.1, step 10). The message carries the Cause set to "Request accepted" (16), the MSISDN, if the P-GW has it stored, the Bearer Contexts modified, with the Charging ID of each bearer, and, when location change reporting is started or stopped, the Change Reporting Action (TS 29.274 clause 7.2.8).

  10. The new S-GW stores the tunnel endpoints of the P-GW, updates its bearer context, and returns a GTPv2 Create Session Response message to the new MME over S11 (TS 23.401 clause 5.3.3.1, step 11). The message carries the Cause set to "Request accepted" (16), the Sender F-TEID for Control Plane of the new S-GW, and the Bearer Contexts created, with the EBI, the Cause, and the S1-U SGW F-TEID for the uplink of each bearer (TS 29.274 clause 7.2.2), together with the P-GW TEIDs for the uplink traffic and for the control plane (TS 23.401 clause 5.3.3.1, step 11).

  11. If the S-GW isn’t relocated and the MME has changed, the new MME sends a GTPv2 Modify Bearer Request message to the S-GW over S11, one message for each PDN connection. If the S-GW doesn’t need to signal to the P-GW, the new MME can instead send one Modify Access Bearers Request message for the UE (TS 23.401 clause 5.3.3.2, step 9). The Modify Bearer Request message carries the Sender F-TEID for Control Plane of the new MME and the Bearer Contexts to be modified, with the EBI, and, when they apply, the User Location Information, the RAT Type, the UE Time Zone, the Serving Network, and the User CSG Information (TS 29.274 clause 7.2.7, and TS 23.401 clause 5.3.3.2, step 9). The User CSG Information is sent only if the "active" flag is set (TS 23.401 clause 5.3.3.2, NOTE 7). When an S1-U GTP-U tunnel is set up during the TAU, the Bearer Contexts to be modified also carry the S1 eNodeB F-TEID for the downlink (TS 29.274 clause 7.2.7). Without an MME change, this step is skipped, and the MME reports a change of the UE Time Zone, the User CSG Information, or the Serving Network in the next Service Request (TS 23.401 clause 5.3.3.2, NOTE 2).

  12. If the RAT type has changed, or if the S-GW has received the User Location Information, the UE Time Zone, the User CSG Information, or the Serving Network from the new MME, the S-GW sends a GTPv2 Modify Bearer Request message with this information to the P-GW over S5/S8, one message for each PDN connection (TS 23.401 clause 5.3.3.2, step 10). For a TAU without S-GW change, the message doesn’t carry the Bearer Contexts to be modified (TS 29.274 clause 7.2.7).

  13. The P-GW updates its context so that it routes downlink packets to the correct S-GW and returns a GTPv2 Modify Bearer Response message to the S-GW (TS 23.401 clause 5.3.3.2, step 12). If there has been a RAT change towards E-UTRAN and location information change reporting is required and supported in the new MME, the message carries the MS Info Change Reporting Action (TS 23.401 clause 5.3.3.2, step 12). TS 23.401 clause 5.3.3.2, step 12, also lists the MSISDN when the P-GW has it stored, but TS 29.274 clause 7.2.8 requires the MSISDN on S5/S8 only for a TAU, RAU, or handover with S-GW relocation.

  14. The S-GW updates its bearer context and returns a GTPv2 Modify Bearer Response message to the new MME over S11 (TS 23.401 clause 5.3.3.2, step 13). The message carries the Cause set to "Request accepted" (16) and the Bearer Contexts modified, with the EBI, the Cause, and the S1-U SGW F-TEID of each bearer (TS 29.274 clause 7.2.8).

  15. If the new MME holds no subscription data for the UE, or, in some network sharing scenarios, if the PLMN-ID of the TAI differs from that of the GUTI, the new MME sends a Diameter Update-Location-Request (ULR) message to the HSS over S6a (TS 23.401 clause 5.3.3.1, step 12). The message registers the new MME as the serving MME and carries the User-Name with the IMSI, the ULR-Flags, the Visited-PLMN-Id, the RAT-Type, and, optionally, the Terminal-Information with the International Mobile Equipment Identity (IMEI) and the Software-Version (TS 29.272 clause 5.2.1.1.1). The HSS takes the MME identity from the Origin-Host AVP of the request (TS 29.272 clause 5.2.1.1.3). The new MME sets the S6a/S6d-Indicator in the ULR-Flags, sets the Single-Registration-Indication only if the previous node is a Gn/Gp SGSN, and, as a combined MME/SGSN, sets the Skip Subscriber Data flag if it already holds the subscriber data (TS 29.272 clause 5.2.1.1.2, and clause 7.3.7).

  16. The HSS sends a Diameter Cancel-Location-Request (CLR) message to the old MME over S6a, carrying the User-Name with the IMSI and the Cancellation-Type set to MME_UPDATE_PROCEDURE (0) (TS 23.401 clause 5.3.3.1, step 13, and TS 29.272 clauses 5.2.1.1.3 and 7.3.24).

  17. If the timer that the old MME started in step 4 isn’t running, the old MME removes the MM context of the UE; otherwise, the old MME removes the contexts when the timer expires, so that the MM context is kept for the case in which the UE starts another TAU towards the old MME. The old MME acknowledges the cancellation with a Diameter Cancel-Location-Answer (CLA) message to the HSS, carrying the Result-Code DIAMETER_SUCCESS (2001) (TS 23.401 clause 5.3.3.1, step 14, TS 29.272 clause 5.2.1.2.2, and IETF RFC 6733 section 7.1.2).

  18. The HSS acknowledges the location update with a Diameter Update-Location-Answer (ULA) message to the new MME (TS 23.401 clause 5.3.3.1, step 17). The message carries the Result-Code DIAMETER_SUCCESS (2001), the ULA-Flags, and the Subscription-Data, with the Subscriber-Status, the AMBR, the APN-Configuration-Profile, whose Context-Identifier identifies the default APN configuration and whose APN-Configuration AVPs carry the EPS-Subscribed-QoS-Profile and the APN-AMBR of each APN, and the CSG-Subscription-Data (TS 29.272 clauses 5.2.1.1.1, 7.3.2, 7.3.34, and 7.3.35). If the TAU is started at a CSG cell, the new MME checks the CSG subscription and rejects the TAU if the CSG ID isn’t present or has expired (TS 23.401 clause 5.3.3.1, step 17).

  19. If the MME has changed and the old MME has received the SGW Change Indication in step 6, the old MME deletes the EPS bearer resources in the old S-GW when the timer started in step 4 expires, by sending GTPv2 Delete Session Request messages over S11 (TS 23.401 clause 5.3.3.1, step 18). The message carries the Indication Flags with the Operation Indication flag not set, so that the old S-GW doesn’t start a deletion towards the P-GW, and with the Scope Indication flag set to 1 (TS 29.274 clause 7.2.9.1). The message carries a Cause when ISR is deactivated, with the value "ISR deactivation", or when the MME sends the message because of a network failure. The User Location Information is sent only for the Detach procedure (TS 29.274 clause 7.2.9.1). Without an MME change, the Create Session Response message of step 10 triggers the release of the resources in the old S-GW (TS 23.401 clause 5.3.3.1, step 18).

  20. The old S-GW discards any packets that it has buffered for the UE and returns a GTPv2 Delete Session Response message to the old MME over S11, with the Cause set to "Request accepted" (16) (TS 23.401 clause 5.3.3.1, step 19, and TS 29.274 clause 7.2.10).

  21. The new MME sends a NAS Tracking Area Update Accept message to the UE (TS 23.401 clause 5.3.3.1, step 20). The message carries the EPS update result, the TAI list, the EPS bearer context status, and, if the MME has allocated one, a new GUTI (TS 24.301 clause 8.2.26.1, and TS 23.401 clause 5.3.3.1, step 20). It can also carry the T3412 extended value, which provides a longer periodic TAU timer, the T3324 value, which the network includes when the UE has requested Power Saving Mode (PSM) and the network accepts it, the EPS network feature support IE, with the IMS voice over PS session indicator and the emergency bearer services indicator, and, if a combined TAU was successful for EPS services only, the EMM cause (TS 24.301 clauses 8.2.26.8, 8.2.26.13, 8.2.26.15, and 8.2.26.16). If the MME includes a GUTI, it starts timer T3450 (TS 24.301 clause 5.5.3.2.4). On receiving the message, the UE stops timer T3430, enters the EMM-REGISTERED state, and sets its EPS update status to EU1 UPDATED (TS 24.301 clause 5.5.3.2.4).

  22. The UE returns a NAS Tracking Area Update Complete message to the new MME to acknowledge a GUTI, a TMSI in a combined TAU, a UE radio capability ID IE, or a UE radio capability ID deletion indication IE in the Tracking Area Update Accept message. The UE also returns the message when it has a negotiated IMSI offset stored and the accept message doesn’t contain the Negotiated IMSI offset IE (TS 24.301 clause 5.5.3.2.4). The message carries only the protocol discriminator, the security header type, and the message type (TS 24.301 clause 8.2.27). On receiving the message, the MME stops timer T3450 and considers the new GUTI valid (TS 24.301 clause 5.5.3.2.4). If the "active" flag isn’t set and the TAU wasn’t started in the ECM-CONNECTED state, the new MME then releases the signaling connection with the UE (TS 23.401 clause 5.3.3.1, step 21).

6.9.4. Summary of Key Information Elements

The following table summarizes the key IEs of the main messages of the procedure, grouped by protocol.

Protocol Message Key IEs

NAS EMM (TS 24.301)

Tracking Area Update Request

EPS update type ("active" flag), NAS key set identifier (eKSI), Old GUTI, Old GUTI type, Last visited registered TAI, EPS bearer context status, UE network capability, MS network capability, Additional update type ("signalling active" flag)

NAS EMM (TS 24.301)

Tracking Area Update Accept

EPS update result, GUTI (if reallocated), TAI list, EPS bearer context status, T3412 extended value, T3324 value, EPS network feature support

NAS EMM (TS 24.301)

Tracking Area Update Complete

Protocol discriminator, Security header type, Message type only

S1AP (TS 36.413)

Initial UE Message / Uplink NAS Transport

eNB UE S1AP ID (and MME UE S1AP ID in Uplink NAS Transport), NAS-PDU, TAI, E-UTRAN CGI, RRC Establishment Cause, S-TMSI, GUMMEI (Initial UE Message only)

GTPv2-C (TS 29.274)

Context Request (S10)

GUTI, Complete TAU Request Message, S3/S16/S10/N26 Address and TEID for Control Plane, RAT Type, Indication (MS Validated flag)

GTPv2-C (TS 29.274)

Context Response (S10)

Cause ("Request accepted", 16), IMSI, MME/SGSN/AMF UE MM Context (KASME, eKSI, NAS counts), MME/SGSN/AMF UE EPS PDN Connections (APN, PGW S5/S8 IP Address for Control Plane or PMIP, bearer contexts with EBI and Bearer Level QoS), SGW S11/S4 IP Address and TEID for Control Plane

GTPv2-C (TS 29.274)

Context Acknowledge (S10)

Cause ("Request accepted", 16), Indication Flags (SGW Change Indication)

GTPv2-C (TS 29.274)

Create Session Request (S11)

IMSI, Sender F-TEID for Control Plane, PGW S5/S8 Address for Control Plane or PMIP, Bearer Contexts to be created (EBI, Bearer Level QoS, S5/S8-U PGW F-TEID), RAT Type, ULI

GTPv2-C (TS 29.274)

Create Session Response (S11)

Cause ("Request accepted", 16), Sender F-TEID for Control Plane, Bearer Contexts created (EBI, Cause, S1-U SGW F-TEID)

GTPv2-C (TS 29.274)

Modify Bearer Request

Sender F-TEID for Control Plane, Bearer Contexts to be modified (EBI, S1 eNodeB F-TEID on S11 when S1-U is set up, S5/8-U SGW F-TEID on S5/S8 with S-GW change), ULI, RAT Type

GTPv2-C (TS 29.274)

Modify Bearer Response

Cause ("Request accepted", 16), Bearer Contexts modified (EBI, Cause, S1-U SGW F-TEID on S11, Charging ID on S5/S8), MSISDN (on S5/S8 with S-GW relocation), Change Reporting Action

GTPv2-C (TS 29.274)

Delete Session Request (S11)

Indication Flags (Operation Indication not set, Scope Indication set to 1), Cause ("ISR deactivation" when ISR is deactivated, or a network failure cause)

Diameter S6a (TS 29.272)

Update-Location-Request (ULR)

User-Name (IMSI), ULR-Flags, Visited-PLMN-Id, RAT-Type, Terminal-Information, Origin-Host (MME identity)

Diameter S6a (TS 29.272)

Cancel-Location-Request (CLR)

User-Name (IMSI), Cancellation-Type (MME_UPDATE_PROCEDURE)

Diameter S6a (TS 29.272)

Update-Location-Answer (ULA)

Result-Code (DIAMETER_SUCCESS), ULA-Flags, Subscription-Data (Subscriber-Status, AMBR, APN-Configuration-Profile with the default APN, EPS-Subscribed-QoS-Profile, and APN-AMBR, CSG-Subscription-Data)

6.9.5. Possible Failures and Required Actions

Failed UE validation or context retrieval

If the old MME can’t find the UE, or if the integrity check of the Tracking Area Update Request message fails, the old MME returns the Context Response message with an error cause, and the new MME starts the security functions (TS 23.401 clause 5.3.3.1, steps 4 and 5). If the security functions don’t authenticate the UE correctly, the new MME rejects the TAU and sends a reject indication to the old MME, which continues as if it had never received the Context Request message (TS 23.401 clause 5.3.3.1, step 7). The MME sends a NAS Tracking Area Update Reject message with EMM cause #9 "UE identity cannot be derived by the network" when the UE changes from N1 mode to S1 mode and the MME doesn’t support the N26 interface (TS 24.301 clause 5.5.3.2.5). When the AMF informs the MME that the integrity check of the request has failed and the MME can’t retrieve the current EPS security context of the UE, the MME can first identify the UE with an Identity Request message, and it uses cause #9 if it needs to reject the TAU (TS 24.301 clause 5.5.3.2.5). On receiving the reject message, the UE stops timer T3430. With cause #9, the UE sets its EPS update status to EU2 NOT UPDATED, deletes any GUTI, last visited registered TAI, TAI list, and eKSI, and enters the EMM-DEREGISTERED.NORMAL-SERVICE state. Unless the rejected request was for a PDN connection for emergency bearer services, the UE then automatically starts the attach procedure (TS 24.301 clause 5.5.3.2.5).

Rejection by the HSS or subscription restrictions

If the HSS rejects the Update-Location-Request, for example because the UE isn’t allowed to roam into the visited PLMN, the new MME rejects the TAU with an appropriate cause and releases its local EPS bearer contexts for the UE. With S-GW relocation, the new MME also deletes the bearer resources in the new S-GW with Delete Session Request messages, in which the Operation Indication flag isn’t set (TS 23.401 clause 5.3.3.1, step 17). The MME also rejects the TAU if regional subscription restrictions or access restrictions, such as CSG restrictions, don’t allow the UE to access the tracking area (TS 23.401 clause 5.3.3.1, step 20). TS 29.272 Annex A maps the S6a errors to EMM causes. DIAMETER_ERROR_ROAMING_NOT_ALLOWED (5004) maps to #11 "PLMN not allowed" without an Error Diagnostic, to #14 "EPS services not allowed in this PLMN" with the Error Diagnostic ODB_HPLMN_APN or ODB_VPLMN_APN, and to #15 "No suitable cells in tracking area" with the Error Diagnostic ODB_ALL_APN. The DIAMETER_ERROR_UNKNOWN_EPS_SUBSCRIPTION (5420) error maps to #15, or to #7 "EPS services not allowed" with the Error Diagnostic NO_GPRS_DATA_SUBSCRIBED, and the DIAMETER_ERROR_RAT_NOT_ALLOWED (5421) error maps to #15, #13 "Roaming not allowed in this tracking area", or #12 "Tracking area not allowed", at the choice of the operator (TS 29.272 Table A.1). A regional subscription restriction maps to #12 (TS 29.272 Table A.2). The UE handles the causes differently (TS 24.301 clause 5.5.3.2.5):

  • With cause #12, the UE sets its EPS update status to EU3 ROAMING NOT ALLOWED, deletes any GUTI, last visited registered TAI, TAI list, and eKSI, resets the TAU attempt counter, stores the current TAI in the list of "forbidden tracking areas for regional provision of service", and enters the EMM-DEREGISTERED.LIMITED-SERVICE state.

  • With cause #13, the UE sets its EPS update status to EU3 ROAMING NOT ALLOWED, resets the TAU attempt counter, stores the current TAI in the list of "forbidden tracking areas for roaming", enters the EMM-REGISTERED.PLMN-SEARCH state, and performs a PLMN selection.

  • With cause #15, the UE sets its EPS update status to EU3 ROAMING NOT ALLOWED, resets the TAU attempt counter, usually stores the current TAI in the list of "forbidden tracking areas for roaming", enters the EMM-REGISTERED.LIMITED-SERVICE state, and searches for a suitable cell in another tracking area.

The Tracking Area Update Reject message carries the Forbidden TAI(s) IEs only when the network sends the message via satellite E-UTRAN access (TS 24.301 clauses 8.2.28.4 and 8.2.28.5).

Network congestion

When general NAS level mobility management congestion control is active, the MME rejects the TAU with EMM cause #22 "Congestion" and assigns a value for the mobility management back-off timer T3346 in the Tracking Area Update Reject message (TS 24.301 clauses 5.3.9 and 5.5.3.2.5). If the MME can’t send a request to the HSS because the HSS is overloaded, TS 29.272 recommends cause #22 and allows the MME to ask the UE not to retry before a back-off timer expires (TS 29.272 Table A.2). On receiving cause #22 with a T3346 value that is neither zero nor deactivated, the UE aborts the procedure, resets the TAU attempt counter, sets its EPS update status to EU2 NOT UPDATED, and enters the EMM-REGISTERED.ATTEMPTING-TO-UPDATE state, unless the request was for a PDN connection for emergency bearer services. The UE starts timer T3346 with the received value if the message is integrity protected, and with a random value from the default range otherwise (TS 24.301 clause 5.5.3.2.5). In the EMM-REGISTERED.ATTEMPTING-TO-UPDATE state, the UE sends no user data and starts the TAU again when timer T3346 expires, although it can still start a TAU for a PDN connection for emergency bearer services and still responds to paging (TS 24.301 clause 5.2.3.2.2).

6.9.6. References

Specification Clauses and coverage

TS 23.401

  • Clause 5.3.3.0 — Triggers for tracking area update

  • Clause 5.3.3.0A — Provision of UE’s TAI to MME in ECM-CONNECTED state

  • Clause 5.3.3.1 — Tracking Area Update procedure with Serving GW change

  • Clause 5.3.3.2 — E-UTRAN Tracking Area Update without S-GW Change

  • Clauses 4.3.8.2 and 4.3.8.3 — Serving GW selection function and MME selection function

TS 24.301

  • Clause 5.2.3.2.2 — ATTEMPTING-TO-UPDATE substate

  • Clause 5.3.9 — Handling of NAS level mobility management congestion control

  • Clause 5.5.3 — Tracking area updating procedure (S1 mode only)

  • Clauses 5.5.3.2.2, 5.5.3.2.4, and 5.5.3.2.5 — Normal and periodic tracking area updating procedure initiation, acceptance, and rejection

  • Clauses 8.2.26 to 8.2.29 — TRACKING AREA UPDATE ACCEPT, COMPLETE, REJECT, and REQUEST message contents

  • Clauses 8.2.7, 8.2.8, and 8.2.20 — AUTHENTICATION REQUEST, AUTHENTICATION RESPONSE, and SECURITY MODE COMMAND message contents

  • Clause 9.9.3.14 — EPS update type

  • Tables 10.2.1 and 10.2.2 — EPS mobility management timers (T3430, T3346, and T3450)

TS 36.413

  • Clause 9.1.7.1 — INITIAL UE MESSAGE message content

  • Clause 9.1.7.3 — UPLINK NAS TRANSPORT message content

TS 29.274

  • Clauses 7.3.5, 7.3.6, and 7.3.7 — Context Request, Context Response, and Context Acknowledge

  • Clauses 7.2.1 and 7.2.2 — Create Session Request/Response

  • Clauses 7.2.7 and 7.2.8 — Modify Bearer Request/Response

  • Clauses 7.2.9.1 and 7.2.10 — Delete Session Request/Response

  • Clause 8.38 — MM Context

TS 29.272

  • Clause 5.2.1.1 — Update Location

  • Clause 5.2.1.2 — Cancel Location

  • Clauses 7.3.2, 7.3.7, and 7.3.24 — Subscription-Data, ULR-Flags, and Cancellation-Type

  • Annex A — MME mapping table for S6a and NAS cause code values

TS 33.401

  • Clause 7.2.4.3.2 — NAS algorithm selection at MME change

  • Clause 7.2.7 — Key handling for the TAU procedure when registered in E-UTRAN

IETF RFC 6733

Section 7.1.2 (DIAMETER_SUCCESS result code).

← Previous: RADIUS Usage on the Gi/SGi Interface | ↑ Up: Functional Description and Information Flows | ⌂ Home: Core Network: Architecture and Signaling Procedures | Next: Part III: 5G Core Network (5GC) →