Content for  TS 24.501  Word version:  17.5.0

The purpose of the UE-initiated NAS transport procedure is to provide a transport of:

1. a single 5GSM message as defined in subclause 8.3;
2. SMS (see TS 24.011);
3. an LPP message;
4. an SOR transparent container;
5. a UE policy container; or
6. a UE parameters update transparent container;
7. a location services message;
8. a CIoT user data container;
9. a Service-level-AA container; or
10. multiple of the above types.

and:

• for a) to e), g) and h), optional associated payload routing information from the UE to the AMF in a 5GMM message; and
• for j), the Payload container IE consists a list of payload container entries, where each of the payload container entry contains the payload and optional associated payload routing information (e.g. PDU session information for 5GSM message payload).

In the connected mode, the UE initiates the NAS transport procedure by sending the UL NAS TRANSPORT message to the AMF, as shown in Figure 5.4.5.2.2.1. In case a) in subclause 5.4.5.2.1, the UE shall:

• include the PDU session information (PDU session ID, old PDU session ID, S-NSSAI, mapped S-NSSAI (if available in roaming scenarios), DNN, request type), if available;
• set the Payload container type IE to "N1 SM information"; and
• set the Payload container IE to the 5GSM message.

The UE shall set the PDU session ID IE to the PDU session ID. If an old PDU session ID is to be included, the UE shall set the Old PDU session ID IE to the old PDU session ID. If an S-NSSAI is to be included, the UE shall set the S-NSSAI IE to the S-NSSAI selected for the PDU session from the allowed NSSAI for the current PLMN, associated with the mapped S-NSSAI (if available in roaming scenarios). If a DNN is to be included, the UE shall set the DNN IE to the DNN. 5GSM procedures specified in clause 6 describe conditions for inclusion of the S-NSSAI, mapped S-NSSAI (if available in roaming scenarios), and the DNN. If a request type is to be included, the UE shall set the Request type IE to the request type. The request type is not provided along 5GSM messages other than the PDU SESSION ESTABLISHMENT REQUEST message and the PDU SESSION MODIFICATION REQUEST message. If an MA PDU session information is to be included, the UE shall set the MA PDU session information IE to the MA PDU session information. The MA PDU session information is not provided along 5GSM messages other than the PDU SESSION ESTABLISHMENT REQUEST message and the PDU SESSION MODIFICATION REQUEST message as specified in TS 24.193. In case b) in subclause 5.4.5.2.1, the UE shall:

• set the Payload container type IE to "SMS"; and
• set the Payload container IE to the SMS payload.

Based on the UE preferences regarding access selection for mobile originated (MO) transmission of SMS over NAS as described in TS 23.501:

• when SMS over NAS is preferred to be sent over 3GPP access: the UE attempts to deliver MO SMS over NAS via the 3GPP access if the UE is registered over both 3GPP access and non-3GPP access. If the delivery of SMS over NAS via the 3GPP access is not available, the UE attempts to deliver MO SMS over NAS via the non-3GPP access; and
• when SMS over NAS is preferred to be sent over non-3GPP access: the UE attempts to deliver MO SMS over NAS via the non-3GPP access if the UE is registered over both 3GPP access and non-3GPP access. If the delivery of SMS over NAS via the non-3GPP access is not available, the UE attempts to deliver MO SMS over NAS via the 3GPP access.

In case c) in subclause 5.4.5.2.1, the UE shall:

• set the Payload container type IE to "LTE Positioning Protocol (LPP) message container";
• set the Payload container IE to the LPP message payload; and
• set the Additional information IE to the routing information provided by the upper layer location services application.

In case d) in subclause 5.4.5.2.1, the UE shall:

• set the Payload container type IE to "SOR transparent container"; and
• set the Payload container IE to the UE acknowledgement due to successful reception of steering of roaming information, and set the ME support of SOR-CMCI indicator to "SOR-CMCI supported by the ME" in the Payload container IE carrying the acknowledgement (see TS 23.122).

In case e) in subclause 5.4.5.2.1, the UE shall:

• set the Payload container type IE to "UE policy container"; and
• set the contents of the Payload container IE as specified in Annex D.

In case f) in subclause 5.4.5.2.1, the UE shall:

• set the Payload container type IE to "UE parameters update transparent container"; and
• set the contents of the Payload container IE to the UE acknowledgement due to successful reception of UE parameters update data (see TS 23.502).

In case g) in subclause 5.4.5.2.1, the UE shall:

• set the Payload container type IE to "Location services message container";
• set the Payload container IE to the Location services message payload; and
• set the Additional information IE to the routing information, if provided by the upper layer location services application.

In case h) in subclause 5.4.5.2.1, the UE shall:

• include the PDU session ID, and Release assistance indication (if available);
• set the Payload container type IE to "CIoT user data container"; and
• set the Payload container IE to the user data container.

In case i) in subclause 5.4.5.2.1, the UE shall:

• set the Payload container type IE to "Service-level-AA container"; and
• set the Payload container IE to the Service-level-AA container.

In case j) in subclause 5.4.5.2.1, the UE shall:

• set the Payload container type IE to "Multiple payloads"; and
• set each payload container entry of the Payload container IE (see subclause 9.11.3.39), as follows:
  1. set the payload container type field of the payload container entry to a payload container type value set in the Payload container type IE as specified in cases a) to i) above;
  2. set the payload container entry contents field of the payload container entry to the payload container contents set in the Payload container IE as specified in cases a) to i) above, and
  3. set the optional IE fields, if any, to the optional associated payload routing information as specified in cases a) to i) above.

Upon reception of a UL NAS TRANSPORT message, if the Payload container type IE is set to:

1. "N1 SM information", the AMF looks up a PDU session routing context for:
   1. the UE and the PDU session ID IE in case the Old PDU session ID IE is not included, and:
      1. if the AMF has a PDU session routing context for the PDU session ID and the UE, and the Request type IE is either not included or is included but set to other value than "initial request", "existing PDU session", "initial emergency request", "existing emergency PDU session" or "MA PDU request", the AMF shall forward the 5GSM message, and the PDU session ID IE towards the SMF identified by the SMF ID of the PDU session routing context;
      2. if the AMF has a PDU session routing context for the PDU session ID and the UE, the PDU session routing context indicates that the PDU session is not an emergency PDU session, the Request type IE is included and is set to "existing PDU session" or "MA PDU request", and the S-NSSAI associated with the PDU session identified by the PDU session ID is allowed for the target access type, the AMF shall forward the 5GSM message, the PDU session ID, the S-NSSAI, the mapped S-NSSAI (if available in roaming scenarios), the DNN (if received) and the request type towards the SMF identified by the SMF ID of the PDU session routing context;
      3. if the AMF does not have a PDU session routing context for the PDU session ID and the UE, and the Request type IE is included and is set to "initial request" or "MA PDU request":
         A)

         the AMF shall select an SMF with following handlings in case the UE is not registered for onboarding services in SNPN:

         If the S-NSSAI IE is not included and the allowed NSSAI contains:

         • one S-NSSAI, the AMF shall use the S-NSSAI in the allowed NSSAI as the S-NSSAI;
         • two or more S-NSSAIs and the user's subscription context obtained from UDM contains only one default S-NSSAI that is included in the allowed NSSAI, the AMF shall use the S-NSSAI in the allowed NSSAI that matches the default S-NSSAI as the S-NSSAI; or
         • two or more S-NSSAIs and the user's subscription context obtained from UDM contains zero, two or more default S-NSSAI(s) included in the allowed NSSAI, the AMF shall use an S-NSSAI in the allowed NSSAI selected based on operator policy as the S-NSSAI.

         If the DNN IE is included, the AMF shall use the UE requested DNN as the DNN determined by the AMF; and

         If the DNN IE is not included, and the user's subscription context obtained from UDM:

         • contains the default DNN for the S-NSSAI, the AMF shall use the default DNN as the DNN determined by the AMF; and
         • does not contain the default DNN for the S-NSSAI, the AMF shall use a locally configured DNN as the DNN determined by the AMF; and

         A1)

         the AMF shall select an SMF with following handlings in case the UE is registered for onboarding services in SNPN:

         • if the AMF onboarding configuration data contains the S-NSSAI used for onboarding services in SNPN, the AMF shall use the S-NSSAI used for onboarding services in SNPN as the S-NSSAI;
         • if the AMF onboarding configuration data contains the DNN for the S-NSSAI used for onboarding services in SNPN, the AMF shall use the DNN as the DNN determined by the AMF;
         • if the AMF onboarding configuration data does not contain the S-NSSAI used for onboarding services in SNPN and contains a configured SMF for the DNN used for onboarding services in SNPN, the AMF shall select the configured SMF for the DNN used for onboarding services in SNPN; and
         • if the AMF onboarding configuration data contains neither the S-NSSAI used for onboarding services in SNPN nor a configured SMF for the DNN used for onboarding services in SNPN, the AMF shall use a locally configured DNN used for onboarding services in SNPN as the DNN determined by the AMF; and

         B)

         if the SMF selection is successful:

         • if the DNN selected by the network is a LADN DNN, the AMF shall determine the UE presence in LADN service area;
         • the AMF shall store a PDU session routing context for the PDU session ID and the UE, shall set the SMF ID in the stored PDU session routing context to the SMF ID corresponding to the DNN in the user's subscription context obtained from the UDM; and
         • the AMF shall forward the 5GSM message, the PDU session ID, the S-NSSAI, the mapped S-NSSAI (if available in roaming scenarios), the DNN determined by the AMF, DNN selected by the network (if different from DNN determined by the AMF), the request type, the MA PDU session information and UE presence in LADN service area (if DNN received corresponds to an LADN DNN) towards the SMF identified by the SMF ID of the PDU session routing context;
      4. if the AMF does not have a PDU session routing context for the PDU session ID and the UE, the Request type IE is included and is set to "existing PDU session" or "MA PDU request", and the AMF retrieves an SMF ID associated with:
         1. the PDU session ID matching the PDU session ID received from the UE, if any; or
         2. the DNN matching the DNN received from the UE, otherwise;
         such that the SMF ID includes a PLMN identity corresponding to the UE's HPLMN or the current PLMN, then:
         1. the AMF shall store a PDU session routing context for the PDU session ID and the UE, shall set the SMF ID in the stored PDU session routing context to the retrieved SMF ID; and
         2. the AMF shall forward the 5GSM message, the PDU session ID, the S-NSSAI, the mapped S-NSSAI (if available in roaming scenarios), the DNN (if received) and the request type towards the SMF identified by the SMF ID of the PDU session routing context;
      5. if the AMF does not have a PDU session routing context for the PDU session ID and the UE, the Request type IE is included and is set to "initial emergency request", and the AMF does not have a PDU session routing context for another PDU session ID of the UE indicating that the PDU session is an emergency PDU session:
         1. the AMF shall select an SMF. The AMF shall use the emergency DNN from the AMF emergency configuration data as the DNN, if configured. The AMF shall derive the SMF from the emergency DNN or use the statically configured SMF from the AMF emergency configuration data, if configured; and
         2. if the SMF selection is successful:
            • the AMF shall store a PDU session routing context for the PDU session ID and the UE, shall set the SMF ID in the stored PDU session routing context to the SMF ID of the selected SMF, and shall store an indication that the PDU session is an emergency PDU session in the stored PDU session routing context; and
            • the AMF shall forward the 5GSM message, the PDU session ID, the S-NSSAI (if configured in the AMF emergency configuration data), the DNN (if configured in the AMF emergency configuration data), and the request type towards the SMF identified by the SMF ID of the PDU session routing context; and
      6. if the AMF does not have a PDU session routing context for the PDU session ID and the UE, the Request type IE is included and is set to "initial emergency request", and the AMF has a PDU session routing context indicating that the PDU session is an emergency PDU session for another PDU session ID of the UE:
         1. the AMF shall store a PDU session routing context for the PDU session ID and the UE and shall set the SMF ID in the stored PDU session routing context to the SMF ID of the PDU session routing context for the other PDU session ID of the UE; and
         2. the AMF shall forward the 5GSM message, the PDU session ID, the S-NSSAI (if configured in the AMF emergency configuration data), the DNN (if configured in the AMF emergency configuration data) and the request type towards the SMF identified by the SMF ID of the PDU session routing context; or
      7. if the AMF has a PDU session routing context for the PDU session ID and the UE, the PDU session routing context indicates that the PDU session is an emergency PDU session, and the Request type IE is included and is set to "existing emergency PDU session", the AMF shall forward the 5GSM message, the PDU session ID, the S-NSSAI (if configured in the AMF emergency configuration data), the DNN (if configured in the AMF emergency configuration data), and the request type towards the SMF identified by the SMF ID of the PDU session routing context; and
      8. if the AMF does not have a PDU session routing context for the PDU session ID and the UE, the Request type IE is included and is set to "existing emergency PDU session", and the AMF retrieves an SMF ID associated with emergency services such that the SMF ID includes a PLMN identity corresponding to the current PLMN, then:
         1. the AMF shall store a PDU session routing context for the PDU session ID and the UE, shall set the SMF ID in the stored PDU session routing context to the retrieved SMF ID; and
         2. the AMF shall forward the 5GSM message, the PDU session ID, the S-NSSAI (if configured in the AMF emergency configuration data), the DNN (if configured in the AMF emergency configuration data), and the request type towards the SMF identified by the SMF ID of the PDU session routing context; or
   2. the UE and the Old PDU session ID IE in case the Old PDU session ID IE is included, and:
      1. the AMF has a PDU session routing context for the old PDU session ID and the UE and does not have a PDU session routing context for the PDU session ID and the UE, the Request type IE is included and is set to "initial request", and the AMF received a reallocation requested indication from the SMF indicating that the SMF is to be reused, the AMF shall store a PDU session routing context for the PDU session ID and the UE, set the SMF ID in the stored PDU session routing context to the SMF ID of the PDU session routing context for the old PDU session ID and the UE. If the DNN is a LADN DNN, the AMF shall determine the UE presence in LADN service area. The AMF shall forward the 5GSM message, the PDU session ID, the old PDU session ID, the S-NSSAI (if received), the mapped S-NSSAI (if available in roaming scenarios), the DNN, the request type and UE presence in LADN service area (if DNN received corresponds to an LADN DNN) towards the SMF identified by the SMF ID of the PDU session routing context;
      2. the AMF has a PDU session routing context for the old PDU session ID and the UE and does not have a PDU session routing context for the PDU session ID and the UE, the Request type IE is included and is set to "initial request", and the AMF received a reallocation requested indication from the SMF indicating that the SMF is to be reallocated:
         1. the AMF shall select an SMF with the following handling;
            If the S-NSSAI IE is not included and the allowed NSSAI contains:
            • one S-NSSAI, the AMF shall use the S-NSSAI in the allowed NSSAI as the S-NSSAI;
            • two or more S-NSSAIs and the user's subscription context obtained from UDM contains only one default S-NSSAI that is included in the allowed NSSAI, the AMF shall use the S-NSSAI in the allowed NSSAI that matches the default S-NSSAI; or
            • two or more S-NSSAIs and the user's subscription context obtained from UDM contains zero, two or more default S-NSSAI(s) included in the allowed NSSAI, the AMF shall use an S-NSSAI in the allowed NSSAI selected based on operator policy as the S-NSSAI.
            If the DNN is a LADN DNN, the AMF shall determine the UE presence in LADN service area.
         2. if the SMF selection is successful:
            • the AMF shall store a PDU session routing context for the PDU session ID and the UE and set the SMF ID of the PDU session routing context to the SMF ID of the selected SMF; and
            • the AMF shall forward the 5GSM message, the PDU session ID, the old PDU session ID, the S-NSSAI, the mapped S-NSSAI (if available in roaming scenarios), the DNN, the request type, the MA PDU session information and UE presence in LADN service area (if DNN received corresponds to an LADN DNN) towards the SMF identified by the SMF ID of the PDU session routing context for the PDU session ID and the UE;
2. "SMS", the AMF shall forward the content of the Payload container IE to the SMSF associated with the UE;
3. "LTE Positioning Protocol (LPP) message container", the AMF shall forward the Payload container type and the content of the Payload container IE to the LMF associated with the routing information included in the Additional information IE of the UL NAS TRANSPORT message;
4. "SOR transparent container", the AMF shall forward the content of the Payload container IE to the UDM (see TS 29.503);
5. "UE policy container", the AMF shall forward the content of the Payload container IE to the PCF.
6. "UE parameters update transparent container", the AMF shall forward the content of the Payload container IE to the UDM.
7. "Location services message container":
   1. if the Additional information IE is not included in the UL NAS TRANSPORT message, the AMF shall provide the Payload container type and the content of the Payload container IE to the location services application; and
   2. if the Additional information IE is included in the UL NAS TRANSPORT message, the AMF shall forward the Payload container type and the content of the Payload container IE to an LMF associated with routing information included in the Additional information IE of the UL NAS TRANSPORT message.
8. "CIoT user data container", the AMF shall look up a PDU session routing context for the UE and the PDU session ID, and
   1. forward the content of the Payload container IE towards the SMF identified by the SMF ID of the PDU session routing context; and
   2. initiate the release of the N1 NAS signalling connection:
      1. if the Release assistance indication IE is included in the UL NAS TRANSPORT message and the DDX field of the Release assistance indication IE indicates "No further uplink and no further downlink data transmission subsequent to the uplink data transmission is expected" and if there is no downlink signalling or downlink data for the UE; or
      2. upon subsequent delivery of the next received downlink data transmission to the UE if the Release assistance indication IE is included in the UL NAS TRANSPORT message and the DDX field of the Release assistance indication IE indicates "Only a single downlink data transmission and no further uplink data transmission subsequent to the uplink data transmission is expected" and if there is no additional downlink signalling or downlink data for the UE.
9. "Service-level-AA container" and the Service-level AA container is included in the Payload container IE of the UL NAS TRANSPORT message, and the Service-level device ID included in the Service-level AA container is set to a CAA-level UAV ID, the AMF shall forward the content of the Payload container IE to the UAS-NF corresponding to the CAA-level UAV ID. If the Service-level device ID is not included in the Service-level AA container and a CAA-level UAV ID is included in the 5GMM context of the UE, then the AMF shall forward the content of the Payload container IE to the UAS-NF corresponding to the CAA-level UAV ID included in the 5GMM context of the UE.
10. "Multiple payloads", the AMF shall first decode the content of the Payload container IE (see subclause 9.11.3.39) to obtain the number of payload container entries and for each payload container entry, the AMF shall:
    1. decode the payload container type field;
    2. decode the optional IE fields and the payload container contents field in the payload container entry; and
    3. handle the content of each payload container entry the same as the content of the Payload container IE and the associated optional IEs as specified in bullets a) to i) above according to the payload container type field.

Upon reception of an UL NAS TRANSPORT message, if the Payload container type IE is set to "N1 SM information" and the UE is not configured for high priority access in selected PLMN, and:

1. if the Request type IE is set to "initial request", "existing PDU session" or "MA PDU request";
   1. DNN based congestion control is activated for the DNN included in the UL NAS TRANSPORT message, or DNN based congestion control is activated for the selected DNN in case of no DNN included in the UL NAS TRANSPORT message, e.g. configured by operation and maintenance, the AMF shall send back to the UE the 5GSM message which was not forwarded, a back-off timer value and 5GMM cause #22 "congestion" as specified in subclause 5.4.5.3.1 case f);
   2. S-NSSAI and DNN based congestion control is activated for the S-NSSAI and DNN included in the UL NAS TRANSPORT message, or S-NSSAI and DNN based congestion control is activated for the S-NSSAI included in the UL NAS TRANSPORT message and the selected DNN in case of no DNN included in the UL NAS TRANSPORT message, or S-NSSAI and DNN based congestion control is activated for the selected S-NSSAI in case of no S-NSSAI included in the UL NAS TRANSPORT message and the DNN included in the UL NAS TRANSPORT message, or S-NSSAI and DNN based congestion control is activated for the selected S-NSSAI and the selected DNN in case of no S-NSSAI and no DNN included in the UL NAS TRANSPORT message, e.g. configured by operation and maintenance, the AMF shall send back to the UE the 5GSM message which was not forwarded, a back-off timer value and 5GMM cause #67 "insufficient resources for specific slice and DNN" as specified in subclause 5.4.5.3.1 case f);
   3. S-NSSAI only based congestion control is activated for the S-NSSAI included in the UL NAS TRANSPORT message, or S-NSSAI based congestion control is activated for the selected S-NSSAI in case of no S-NSSAI included in the UL NAS TRANSPORT message, e.g. configured by operation and maintenance, the AMF shall send back to the UE the 5GSM message which was not forwarded, a back-off timer value and 5GMM cause #69 "insufficient resources for specific slice" as specified in subclause 5.4.5.3.1 case f);
2. void;
3. if the Request type IE is set to "modification request" and the PDU session is not an emergency PDU session;
   1. DNN based congestion control is activated for the stored DNN, e.g. configured by operation and maintenance, the AMF shall send back to the UE the 5GSM message which was not forwarded, a back-off timer value and 5GMM cause #22 "congestion" as specified in subclause 5.4.5.3.1 case f);
   2. S-NSSAI and DNN based congestion control is activated for the stored S-NSSAI and DNN, e.g. configured by operation and maintenance, the AMF shall send back to the UE the 5GSM message which was not forwarded, a back-off timer value and 5GMM cause #67 "insufficient resources for specific slice and DNN" as specified in subclause 5.4.5.3.1 case f);
   3. S-NSSAI only based congestion control is activated for the stored S-NSSAI, e.g. configured by operation and maintenance, the AMF shall send back to the UE the 5GSM message which was not forwarded, a back-off timer value and 5GMM cause #69 "insufficient resources for specific slice" as specified in subclause 5.4.5.3.1 case f); or
4. the timer T3447 is running and the UE does not support service gap control:
   1. the Request type IE:
      1. is set to "initial request";
      2. is set to "existing PDU session"; or
      3. is set to "modification request" and the PDU session being modified is a non-emergency PDU session;
   2. the current NAS signalling connection was not triggered by paging; and
   3. mobile terminated signalling has not been sent or no user-plane resources have been established for any PDU session after the establishment of the current NAS signalling connection,
   the AMF shall send back to the UE the message which was not forwarded, send the 5GMM cause #22 "Congestion", and may include a back-off timer set to the remaining time of the timer T3447 as specified in subclause 5.4.5.3.1 case f).

Upon reception of a UL NAS TRANSPORT message, if the Payload container type IE is set to "N1 SM information", the Request type IE is set to "initial request", "existing PDU session" or "MA PDU request", and the AMF determines that the PLMN's maximum number of PDU sessions has already been reached for the UE, the AMF shall send back to the UE the 5GSM message which was not forwarded and 5GMM cause #65 "maximum number of PDU sessions reached" as specified in subclause 5.4.5.3.1 case h). Upon reception of a UL NAS TRANSPORT message, if the Payload container type IE is set to "N1 SM information", the Request type IE is set to "initial request", and

1. the UE is in NB-N1 mode;
2. the UE has indicated preference for user plane CIoT 5GS optimization;
3. the network accepted the use of user plane CIoT 5GS optimization; and
4. the AMF determines that there are user-plane resources established for a number of PDU sessions that is equal to the UE' s maximum number of supported user-plane resources (see TS 23.501),

the AMF shall either:

1. send back to the UE the message which was not forwarded as specified in in subclause 5.4.5.3.1 case h1); or
2. proceed with the PDU session establishment and include the Control Plane CIoT 5GS Optimisation indication or Control Plane Only indicator to the SMF.

Upon reception of an UL NAS TRANSPORT message, if the Payload container type IE is set to "CIoT user data container", the UE is not configured for high priority access in selected PLMN, and:

1. the timer T3447 is running and the UE does not support service gap control;
2. the current NAS signalling connection was not triggered by paging; and
3. mobile terminated signalling has not been sent or no user-plane resources have been established for any PDU session after the establishment of the current NAS signalling connection;

the AMF shall send back to the UE the CIoT user data which was not forwarded, send the 5GMM cause #22 "Congestion", and include a back-off timer set to the remaining time of the timer T3447 as specified in subclause 5.4.5.3.1 case l2). Upon reception of a UL NAS TRANSPORT message, if the Payload container type IE is set to "N1 SM information", the Request type IE is set to "existing PDU session", and

1. the UE is in NB-N1 mode;
2. the UE has indicated preference for user plane CIoT 5GS optimization;
3. the network accepted the use of user plane CIoT 5GS optimization; and
4. the AMF determines that there are user-plane resources established for a number of PDU sessions that equals to the UE's maximum number of supported user-plane resources (see TS 23.501),

the AMF shall send back to the UE the message which was not forwarded as specified in in subclause 5.4.5.3.1 case h1). Upon reception of an UL NAS TRANSPORT message, if the Payload container type IE is set to "N1 SM information", the Request type IE is set to "initial request" or "modification request", the associated S-NSSAI that the AMF determined through the S-NSSAI IE or the PDU session ID IE is an S-NSSAI for which the AMF is performing NSSAA, and the AMF determines to not forward the 5GSM message to the SMF based on local policy, the AMF shall send back to the UE the 5GSM message which was not forwarded as specified in subclause 5.4.5.3.1 case h2). Upon reception of an UL NAS TRANSPORT message, if the Payload container type IE is set to "SMS" or "LTE Positioning Protocol (LPP) message container", the UE is not configured for high priority access in selected PLMN, and:

1. the timer T3447 is running and the UE does not support service gap control;
2. the current NAS signalling connection was not triggered by paging; and
3. mobile terminated signalling has not been sent or no user-plane resources have been established for any PDU session after the establishment of the current NAS signalling connection;

the AMF shall abort the procedure.

The following abnormal cases in AMF are identified:

1. If the Payload container type IE is set to "N1 SM information" and:
   1)

   if the Old PDU session ID IE is not included in the UL NAS TRANSPORT message, the AMF does not have a PDU session routing context for the PDU session ID and the UE, the Request type IE is set to "initial request" or "MA PDU request", and the SMF selection fails, then the AMF shall send back to the UE the 5GSM message which was not forwarded as specified in subclause 5.4.5.3.1 case e) or case f);

   2)

   if the Old PDU session ID IE is included in the UL NAS TRANSPORT message, the AMF has a PDU session routing context for the old PDU session ID and the UE and does not have a PDU session routing context for the PDU session ID and the UE, the Request type IE is set to "initial request", the AMF received a reallocation requested indication from the SMF indicating that the SMF is to be reallocated, and the SMF selection fails, then the AMF shall send back to the UE the 5GSM message which was not forwarded as specified in subclause 5.4.5.3.1 case e) or case f);

   3)

   if the AMF does not have a PDU session routing context for the PDU session ID and the UE, the Request type IE is set to "existing PDU session" or "MA PDU request", and the user's subscription context obtained from the UDM does not contain an SMF ID for the PDU session ID matching the PDU session ID received from the UE or for the DNN matching the DNN received from the UE such that the SMF ID includes a PLMN identity corresponding to the UE's HPLMN or the current PLMN or the PLMN ID part of the current SNPN, then the AMF may send back to the UE the 5GSM message which was not forwarded as specified in subclause 5.4.5.3.1 case e) or case f).

   4)

   if the Old PDU session ID IE is included in the UL NAS TRANSPORT message, and the AMF has a PDU session routing context for the old PDU session ID and the UE and does not have a PDU session routing context for the PDU session ID and the UE, the Request type IE is set to "initial request" and the AMF has not received a reallocation requested indication, the AMF should select an SMF with following handlings:

   1. if the S-NSSAI IE is not included and the allowed NSSAI contains:
      1. one S-NSSAI, the AMF shall use the S-NSSAI in the allowed NSSAI as the S-NSSAI;
      2. two or more S-NSSAIs and the user's subscription context obtained from UDM contains only one default S-NSSAI that is included in the allowed NSSAI, the AMF shall use the S-NSSAI in the allowed NSSAI as the S-NSSAI; or
      3. two or more S-NSSAIs and the user's subscription context obtained from UDM contains zero, two or more default S-NSSAI(s) included in the allowed NSSAI, the AMF shall use an S-NSSAI in the allowed NSSAI selected based on operator policy as the S-NSSAI;
   2. if the DNN IE is not included, and the user's subscription context obtained from UDM:
      1. contains the default DNN for the S-NSSAI, the AMF shall use the default DNN as the DNN; and
      2. does not contain the default DNN for the S-NSSAI, the AMF shall use a locally configured DNN as the DNN;
   3. if the DNN selected by the network is a LADN DNN, the AMF shall determine the UE presence in LADN service area;
   4. if the SMF selection is successful, the AMF should store a PDU session routing context for the PDU session ID and the UE, set the SMF ID in the stored PDU session routing context to the selected SMF ID, and forward the 5GSM message, the PDU session ID, the old PDU session ID, the S-NSSAI, the mapped S-NSSAI (if available in roaming scenarios), the DNN determined by the AMF, DNN selected by the network (if different from DNN determined by the AMF), the request type and UE presence in LADN service area (if DNN selected by the network corresponds to an LADN DNN) towards the SMF ID of the PDU session routing context; and
   5. if the SMF selection fails, then the AMF shall send back to the UE the 5GSM message which was not forwarded as specified in subclause 5.4.5.3.1 case e) or case f);

   5)

   if the AMF has a PDU session routing context for the PDU session ID and the UE, the PDU session routing context indicates that the PDU session is an emergency PDU session, the Request type IE is set to "initial emergency request", the AMF should forward the 5GSM message, the PDU session ID, the S-NSSAI (if configured in the AMF emergency configuration data), the DNN (if configured in the AMF emergency configuration data) and the request type towards the SMF ID of the PDU session routing context;

   6)

   if the Request type IE is set to "initial emergency request" and the S-NSSAI or the DNN is received, the AMF ignores the received S-NSSAI or the DNN and uses the emergency DNN from the AMF emergency configuration data, if any;

   7)

   if the AMF does not have a PDU session routing context for the PDU session ID and the UE, and the Request type IE of the UL NAS TRANSPORT message is either not provided or is provided but set to other value than "initial request", "existing PDU session", "initial emergency request", "existing emergency PDU session" and "MA PDU request", then the AMF may send back to the UE the 5GSM message which was not forwarded as specified in subclause 5.4.5.3.1 case e) or case f);

   8)

   if the AMF unsuccessfully attempted to forward the 5GSM message, the PDU session ID, the S-NSSAI, the mapped S-NSSAI (if available in roaming scenarios), the DNN and the request type (if received) towards a SMF ID, then the AMF may send back to the UE the 5GSM message which was not forwarded as specified in subclause 5.4.5.3.1 case e) or case f).

   9)

   if the Old PDU session ID IE is included in the UL NAS TRANSPORT message, the AMF does not have a PDU session routing context for the old PDU session ID and the UE, the AMF does not have a PDU session routing context for the PDU session ID and the UE, the Request type IE is set to "initial request", the AMF should select an SMF with following handlings:

   1. if the S-NSSAI IE is not included and the allowed NSSAI contains:
      1. one S-NSSAI, the AMF shall use the S-NSSAI in the allowed NSSAI as the S-NSSAI;
      2. two or more S-NSSAIs and the user's subscription context obtained from UDM contains only one default S-NSSAI that is included in the allowed NSSAI, the AMF shall use the default S-NSSAI in the allowed NSSAI as the S-NSSAI; or
      3. two or more S-NSSAIs and the user's subscription context obtained from UDM contains zero, two or more default S-NSSAI(s) included in the allowed NSSAI, the AMF shall use an S-NSSAI in the allowed NSSAI selected based on operator policy as the S-NSSAI.
   2. if the DNN IE is not included, and the user's subscription context obtained from UDM:
      1. contains the default DNN for the S-NSSAI, the AMF shall use the default DNN as the DNN; and
      2. does not contain the default DNN for the S-NSSAI, the AMF shall use a locally configured DNN as the DNN;
   3. if the DNN selected by the network is a LADN DNN, the AMF shall determine the UE presence in LADN service area;
   4. if the SMF selection is successful, the AMF should store a PDU session routing context for the PDU session ID and the UE, set the SMF ID in the stored PDU session routing context to the selected SMF ID, and forward the 5GSM message, the PDU session ID, the old PDU session ID, the S-NSSAI, the mapped S-NSSAI (if available in roaming scenarios), the DNN determined by the AMF, DNN selected by the network (if different from DNN determined by the AMF), the request type and UE presence in LADN service area (if DNN selected by the network corresponds to an LADN DNN) towards the SMF ID of the PDU session routing context; and
   5. if the SMF selection fails, then the AMF shall send back to the UE the 5GSM message which was not forwarded as specified in subclause 5.4.5.3.1 case e) or case f);

   10)

   if the AMF has a PDU session routing context for the PDU session ID and the UE, the PDU session routing context indicates that the PDU session is not an emergency PDU session, and the Request type IE is included and is set to "existing emergency PDU session", the AMF may send back to the UE the 5GSM message which was not forwarded as specified in subclause 5.4.5.3.1 case e) or case f);

   11)

   if the AMF has a PDU session routing context for the PDU session ID and the UE, the PDU session routing context indicates that the PDU session is an emergency PDU session, and the Request type IE is included and is set to "existing PDU session", the AMF may forward the 5GSM message, the PDU session ID, the S-NSSAI (if configured in the AMF emergency configuration data), the DNN (if configured in the AMF emergency configuration data), and the request type towards the SMF identified by the SMF ID of the PDU session routing context;

   12)

   if the AMF has a PDU session routing context for the PDU session ID and the UE, the Request type IE is set to "initial request", then the AMF shall perform a local release of the PDU session identified by the PDU session ID and shall request the SMF to perform a local release of the PDU session, and proceed as specified in subclause 5.4.5.2.3;

   13)

   if the Request type IE is set to "initial request" and the S-NSSAI IE contains an S-NSSAI that is not allowed by the network, then the AMF shall send back to the UE the 5GSM message which was not forwarded as specified in subclause 5.4.5.3.1 case e) or case f);

   14)

   if the Request type IE is set to "existing PDU session", the AMF has a PDU session routing context for the PDU session ID and the UE, the PDU session routing context indicates that the PDU session is not an emergency PDU session, and the S-NSSAI associated with the PDU session identified by the PDU session ID is not allowed for the target access type, the AMF shall send back to the UE the 5GSM message which was not forwarded as specified in subclause 5.4.5.3.1 case e) or case f);

   15)

   if the Request type IE is set to "initial request", "existing PDU session", "modification request" or "MA PDU request", the UE is not configured for high priority access in selected PLMN, and the UE is in non-allowed area or is not in allowed area, the AMF shall send back to the UE the 5GSM message which was not forwarded, and 5GMM cause #28 "Restricted service area" as specified in subclause 5.4.5.3.1 case i);

   15a)

   if the Request type IE is set to "initial request" or "initial emergency request" and the AMF determines that the UE has registered to a PLMN via a satellite NG-RAN cell that is not allowed to operate at the present UE location, then the AMF may send back to the UE the 5GSM message which was not forwarded as specified in subclause 5.4.5.3.1 case i1); and

   16)

   if the Request type IE is set to "initial request" or "MA PDU request", the AMF is pending the receipt of a REGISTRATION REQUEST message indicating "mobility registration updating" in the 5GS registration type IE, and an emergency PDU session exists for the UE (see subclause 5.4.4.3), the AMF shall send back to the UE the 5GSM message which was not forwarded as specified in subclause 5.4.5.3.1 case e) or case f);

   17)

   if the timer T3447 is running and the UE supports service gap control and:

   1. the Request type IE:
      1. is set to "initial request";
      2. is set to "existing PDU session"; or
      3. is set to "modification request" and the PDU session being modified is a non-emergency PDU session;
   2. the UE is not configured for high priority access in selected PLMN;
   3. the current NAS signalling connection was not triggered by paging; and
   4. mobile terminated signalling has not been sent or no user-plane resources have been established for any PDU session after the establishment of the current NAS signalling connection,

   then the AMF shall send back to the UE the 5GSM message which was not forwarded as specified in subclause 5.4.5.3.1 case e) or case f);

   18)

   if the AMF has a PDU session routing context for the PDU session ID and the UE, the Request type IE is not included, the UE is not configured for high priority access in selected PLMN, and the PDU session is not an emergency PDU session, then the AMF shall forward the 5GSM message, and the PDU session ID IE towards the SMF identified by the SMF ID of the PDU session routing context with:

   1. an exemptionInd attribute indicating "message was exempted from the DNN based congestion activated in the AMF" as specified in TS 29.502, if DNN based congestion control is activated for the selected DNN;
   2. an exemptionInd attribute indicating "message was exempted from the S-NSSAI and DNN based congestion activated in the AMF" as specified in TS 29.502, if S-NSSAI and DNN based congestion control is activated for the selected S-NSSAI and the selected DNN; or
   3. an exemptionInd attribute indicating "message was exempted from the S-NSSAI only based congestion activated in the AMF" as specified in TS 29.502, if S-NSSAI only based congestion control is activated for the selected S-NSSAI;

   19)

   if the Request type IE is set to "MA PDU request" and the S-NSSAI IE contains an S-NSSAI that is not allowed by the network on neither access, then the AMF shall send to the UE the 5GSM message which was not forwarded as specified in subclause 5.4.5.3.1 case e) or case f);

   20)

   if the Request type IE is set to "initial request" and the UE is registered for emergency services over the current access, then the AMF may send back to the UE the 5GSM message which was not forwarded as specified in subclause 5.4.5.3.1 case e) or case f); and

   21)

   if the Request type IE is set to "existing PDU session", the UE is attempting to transfer a PDU session from 3GPP access to non-3GPP access, and the PDU session is associated with control plane only indication then the AMF shall send back to the UE the 5GSM message which was not forwarded as specified in subclause 5.4.5.3.1 case e).

   22)

   if the Request type IE is set to "MA PDU request" and the UE requested DNN corresponds to an LADN DNN, the AMF shall send back to the UE the 5GSM message which was not forwarded and 5GMM cause #90 "payload was not forwarded" as specified in subclause 5.4.5.3.1 case hx).

   23)

   if the Request type IE is set to "initial request", the UE requested DNN corresponds to an LADN DNN, and the MA PDU session information IE is included, the AMF shall not forward the MA PDU session information towards the SMF.

   24)

   if the Request type IE is set to "modification request", the DNN associated with the PDU session corresponds to an LADN DNN, and MA PDU session information IE is included, the AMF shall not forward the MA PDU session information towards the SMF.
2. If the Payload container type IE is set to "SMS" and the AMF does not have an SMSF address associated with the UE or the AMF cannot forward the content of the Payload container IE to the SMSF associated with the SMSF address available in the AMF, the AMF shall abort the procedure.
3. If the Payload container type IE is set to "LTE Positioning Protocol (LPP) message container" and if the Additional information IE is not included in the UL NAS TRANSPORT message or the AMF cannot forward the content of the Payload container IE to the LMF associated with the routing information included in the Additional information IE, the AMF shall abort the procedure.
4. If the Payload container type IE is set to "UE policy container" and the AMF does not have a PCF address associated with the UE or the AMF cannot forward the content of the Payload container IE to the PCF associated with the PCF address available in the AMF, the AMF shall abort the procedure.
5. If the Payload container type IE is set to "Location services message container" and if the Additional information IE is included in the UL NAS TRANSPORT message and the AMF cannot forward the content of the Payload container IE to an LMF associated with the routing information included in the Additional information IE, the AMF shall abort the procedure.
6. If the Payload container type IE is set to "SMS" or "LTE Positioning Protocol (LPP) message container":
   1. the timer T3447 is running and the UE supports service gap control;
   2. the UE is not configured for high priority access in selected PLMN;
   3. the current NAS signalling connection was not triggered by paging; and
   4. mobile terminated signalling has not been sent or no user-plane resources have been established for any PDU session after the establishment ofthe UE in 5GMM-CONNECTED mode receives mobile terminated signalling or downlink data over the user-plane the current NAS signalling connection,
   the AMF shall abort the procedure.
7. If the Payload container type IE is set to "CIoT user data container" and:
   1. if the AMF does not have a PDU session routing context for the PDU session ID and the UE; or
   2. if the AMF unsuccessfully attempted to forward the user data container and the PDU session ID,
   then the AMF may send back to the UE the CIoT user data container which was not forwarded as specified in subclause 5.4.5.3.1 case l1).
8. If the Payload container type IE is set to "CIoT user data container":
   1. if the timer T3447 is running and the UE supports service gap control;
   2. the UE is not configured for high priority access in selected PLMN;
   3. the current N1 NAS signalling connection was not triggered by paging; and
   4. mobile terminated signalling has not been sent or no user-plane resources have been established for any PDU session after the establishment of the current NAS signalling connection,
   then the AMF shall send back to the UE the CIoT user data container which was not forwarded as specified in subclause 5.4.5.3.1 case l1).

The following abnormal cases can be identified:

The purpose of the network-initiated NAS transport procedure is to provide a transport of: from the AMF to the UE in a 5GMM message.

In 5GMM-CONNECTED mode, the AMF initiates the NAS transport procedure by sending the DL NAS TRANSPORT message, as shown in Figure 5.4.5.3.2.1. In case a) in subclause 5.4.5.3.1, i.e. upon reception from an SMF of a 5GSM message without an N1 SM delivery skip allowed indication for a UE or a 5GSM message with an N1 SM delivery skip allowed indication for a UE in the 5GMM-CONNECTED mode, the AMF shall:

1. include the PDU session information (PDU session ID) in the PDU session ID IE;
2. set the Payload container type IE to "N1 SM information"; and
3. set the Payload container IE to the 5GSM message.

In case b) in subclause 5.4.5.3.1, i.e. upon reception from an SMSF of an SMS payload, the AMF shall:

1. set the Payload container type IE to "SMS";
2. set the Payload container IE to the SMS payload; and
3. select the access type to deliver the DL NAS TRANSPORT message as follows in case the access type selection is required:
   1. if the UE to receive the DL NAS TRANSPORT message is registered to the network via both 3GPP access and non-3GPP access, the 5GMM context of the UE indicates that SMS over NAS is allowed, the UE is in MICO mode, and the UE is in 5GMM-IDLE mode for 3GPP access and in 5GMM-CONNECTED mode for non-3GPP access, then the AMF selects non-3GPP access. Otherwise, the AMF selects either 3GPP access or non-3GPP access.
      If the delivery of the DL NAS TRANSPORT message over 3GPP access has failed, the AMF may re-send the DL NAS TRANSPORT message over the non-3GPP access.
      If the delivery of the DL NAS TRANSPORT message over non-3GPP access has failed, the AMF may re-send the DL NAS TRANSPORT message over the 3GPP access; and
   2. otherwise, the AMF selects 3GPP access.

In case c) in subclause 5.4.5.3.1 i.e. upon reception from an LMF of an LPP message payload, the AMF shall:

1. set the Payload container type IE to "LTE Positioning Protocol (LPP) message container";
2. set the Payload container IE to the LPP message payload received from the LMF;
3. set the Additional information IE to an LCS correlation identifier received from the LMF from which the LPP message was received.

In case d) in subclause 5.4.5.3.1 i.e. upon reception of a steering of roaming information (see TS 23.122) from the UDM to be forwarded to the UE, the AMF shall:

1. set the Payload container type IE to "SOR transparent container"; and
2. set the Payload container IE to the steering of roaming information received from the UDM (see TS 29.503).

In case e) in subclause 5.4.5.3.1, i.e. upon sending a single uplink 5GSM message which was not forwarded due to routing failure, the AMF shall:

1. include the PDU session ID in the PDU session ID IE;
2. set the Payload container type IE to "N1 SM information";
3. set the Payload container IE to the 5GSM message which was not forwarded;
4. set the 5GMM cause IE to the 5GMM cause #90 "payload was not forwarded" or 5GMM cause #91 "DNN not supported or not subscribed in the slice".
   The AMF sets the 5GMM cause IE to the 5GMM cause #91 "DNN not supported or not subscribed in the slice", if the 5GSM message could not be forwarded since SMF selection fails because:
   1. the DNN is not supported in the slice identified by the S-NSSAI used by the AMF; or
   2. neither the DNN provided by the UE nor the wildcard DNN are in the subscribed DNN list of the UE for the S-NSSAI used by the AMF.
   Otherwise, the AMF sets the 5GMM cause IE to the 5GMM cause #90 "payload was not forwarded"; and
5. optionally include the Back-off timer value IE if the 5GMM cause IE is set to 5GMM cause #91 "DNN not supported or not subscribed in the slice" due to the DNN is not supported in the slice.

In case f) in subclause 5.4.5.3.1, i.e. upon sending a single uplink 5GSM message which was not forwarded due to congestion control, the AMF shall:

1. include the PDU session ID in the PDU session ID IE;
2. set the Payload container type IE to "N1 SM information";
3. set the Payload container IE to the 5GSM message which was not forwarded;
4. set the 5GMM cause IE to the 5GMM cause #22 "Congestion", the 5GMM cause #67 "insufficient resources for specific slice and DNN" or the 5GMM cause #69 "insufficient resources for specific slice"; and
5. include the Back-off timer value IE.

In case g) in subclause 5.4.5.3.1, i.e. upon reception of a UE policy container from the PCF to be forwarded to the UE, the AMF shall:

1. set the Payload container type IE to "UE policy container"; and
2. set the Payload container IE to the UE policy container received from the PCF.

In case h) in subclause 5.4.5.3.1, i.e. upon sending a single uplink 5GSM message which was not forwarded, because the PLMN's maximum number of PDU sessions has been reached, the AMF shall:

1. include the PDU session ID in the PDU session ID IE;
2. set the Payload container type IE to "N1 SM information";
3. set the Payload container IE to the 5GSM message which was not forwarded; and
4. set the 5GMM cause IE to the 5GMM cause #65 "maximum number of PDU sessions reached".

In case h1) in subclause 5.4.5.3.1, i.e. upon sending a single uplink 5GSM message which was not forwarded, because the maximum number of PDU sessions with active user-plane resources has been reached, the AMF shall:

1. include the PDU session ID in the PDU session ID IE;
2. set the Payload container type IE to "N1 SM information";
3. set the Payload container IE to the 5GSM message which was not forwarded; and
4. set the 5GMM cause IE to the 5GMM cause #92 "insufficient user-plane resources for the PDU session".
   In case h2) in subclause 5.4.5.3.1, i.e. upon sending a single uplink 5GSM message which was not forwarded because the UE requested to establish a PDU session associated with an S-NSSAI or to modify a PDU session associated with an S-NSSAI for which:
   1. the AMF is performing network slice-specific authentication and authorization and determined to reject the request based on local policy; or
   2. the network slice-specific authentication and authorization has failed or the authorization has been revoked;
   the AMF shall:
   1. include the PDU session ID in the PDU session ID IE;
   2. set the Payload container type IE to "N1 SM information";
   3. set the Payload container IE to the 5GSM message which was not forwarded; and
   4. set the 5GMM cause IE to the 5GMM cause #90 "payload was not forwarded".
   In case h3) in subclause 5.4.5.3.1, i.e. upon sending a single uplink 5GSM message which was not forwarded because the UE requested to establish an MA PDU session for LADN DNN, the AMF shall:
   1. include the PDU session ID in the PDU session ID IE;
   2. set the Payload container type IE to "N1 SM information";
   3. set the Payload container IE to the 5GSM message which was not forwarded; and
   4. set the 5GMM cause IE to the 5GMM cause #90 "payload was not forwarded".
   In case i) in subclause 5.4.5.3.1, i.e. upon sending a single uplink 5GSM message which was not forwarded due to service area restrictions, the AMF shall:
   1. include the PDU session ID in the PDU session ID IE;
   2. set the Payload container type IE to "N1 SM information";
   3. set the Payload container IE to the 5GSM message which was not forwarded; and
   4. set the 5GMM cause IE to the 5GMM cause #28 "Restricted service area".
   In case i1) in subclause 5.4.5.3.1, i.e. upon sending a single uplink 5GSM message which was not forwarded because the UE is registered to a PLMN via a satellite NG-RAN cell that is not allowed to operate at the present UE location, the AMF shall:
   1. include the PDU session ID in the PDU session ID IE;
   2. set the Payload container type IE to "N1 SM information";
   3. set the Payload container IE to the 5GSM message which was not forwarded; and
   4. set the 5GMM cause IE to the 5GMM cause #78 "PLMN not allowed to operate at the present UE location".
   In case j) in subclause 5.4.5.3.1 i.e. upon reception of UE parameters update data (see TS 23.502) from the UDM to be forwarded to the UE, the AMF shall:
   1. set the Payload container type IE to "UE parameters update transparent container"; and
   2. set the contents of the Payload container IE to the UE parameters update data (see TS 23.502) received from the UDM.
   For case k) in subclause 5.4.5.3.1 upon reception from a location services application of a Location services message payload, the AMF shall:
   1. set the Payload container type IE to "Location services message container"; and
   2. set the Payload container IE to the Location services message payload.
   For case k) in subclause 5.4.5.3.1 upon reception from an LMF of a Location services message payload, the AMF shall:
   1. set the Payload container type IE to "Location services message container";
   2. set the Payload container IE to the Location services message payload; and
   3. set the Additional information IE to routing information associated with the LMF from which the Location services message payload was received.
   In case l) in subclause 5.4.5.3.1, i.e. upon reception from an SMF of a user data container payload, the AMF shall:
   1. include the PDU session ID in the PDU session ID IE;
   2. set the Payload container type IE to "CIoT user data container"; and
   3. set the Payload container IE to the user data container.
   For case l1) in subclause 5.4.5.3.1, i.e. upon sending a single uplink CIoT user data container or control plane user data which was not forwarded due to routing failure, the AMF shall:
   1. include the PDU session ID in the PDU session ID IE;
   2. set the Payload container type IE to " CIoT user data container";
   3. set the Payload container IE to the CIoT user data container or control plane user data which was not forwarded; and
   4. set the 5GMM cause IE to the 5GMM cause #90 "payload was not forwarded".
   For case l2) in subclause 5.4.5.3.1, i.e. upon sending a single uplink CIoT user data container which was not forwarded due to congestion control, the AMF shall:
   1. include the PDU session ID in the PDU session ID IE;
   2. set the Payload container type IE to " CIoT user data container";
   3. set the Payload container IE to the CIoT user data container which was not forwarded;
   4. set the 5GMM cause IE to the 5GMM cause #22 "Congestion" and include the Back-off timer value IE.
   In case m) in subclause 5.4.5.3.1, the AMF shall:
   1. set the Payload container type IE to "Service-level-AA container"; and
   2. set the Payload container IE to the Service-level-AA container;
   In case n) in subclause 5.4.5.3.1, the AMF shall:
   1. set the Payload container type IE to "Multiple payloads";
   2. set each payload container entry of the Payload container IE (see subclause 9.11.3.39) as follows:
      1. set the payload container type field of the payload container entry to a payload container type value set in the Payload container type IE as specified for cases a) to m) above;
      2. set the payload container entry contents field of the payload container entry to the payload container contents set in the Payload container IE as specified for cases a) to m) above;
      3. set the optional IE fields, if any, to the optional associated information as specified for cases a) to m) above.

Upon reception of a DL NAS TRANSPORT message, the UE shall stop the timer T3346 if running. Upon reception of a DL NAS TRANSPORT message, if the Payload container type IE is set to:

1. "N1 SM information" and the 5GMM cause IE is not included in the DL NAS TRANSPORT message, the 5GSM message in the Payload container IE and the PDU session ID are handled in the 5GSM procedures specified in clause 6;
2. "SMS", the UE shall forward the content of the Payload container IE to the SMS stack entity;
3. "LTE Positioning Protocol (LPP) message container", the UE shall forward the payload container type, the content of the Payload container IE and the routing information included in the Additional information IE to the upper layer location services application;
4. "SOR transparent container" and if the Payload container IE:
   1. successfully passes the integrity check (see TS 33.501), the ME shall store the received SOR counter as specified in Annex C and proceed as follows:
      1. If the Payload container IE indicates a list of preferred PLMN/access technology combinations is provided and the list type indicates "PLMN ID and access technology list", then the ME shall replace the highest priority entries in the "Operator Controlled PLMN Selector with Access Technology" list stored in the ME.
         If the SOR-CMCI is present and the Store SOR-CMCI in ME indicator is set to "Store SOR-CMCI in ME" then the UE shall store or delete the SOR-CMCI in the non-volatile memory of the ME as described in Annex C.1;
      2. If the list type indicates "secured packet", then the ME shall behave as if a SMS is received with protocol identifier set to SIM data download, data coding scheme set to class 2 message and SMS payload as secured packet contents of SOR transparent container IE. The SMS payload is forwarded to UICC as specified in TS 23.040; or
      3. If the Payload container IE indicates "HPLMN indication that 'no change of the "Operator Controlled PLMN Selector with Access Technology" list stored in the UE is needed and thus no list of preferred PLMN/access technology combinations is provided'", the UE operates in SNPN access operation mode and the Payload container IE includes SOR-SNPN-SI, the ME shall replace SOR-SNPN-SI of the selected entry of the "list of subscriber data" or associated with the selected PLMN subscription, as specified in TS 23.122 with the received SOR-SNPN-SI.
         If the SOR-CMCI is present and the Store SOR-CMCI in ME indicator is set to "Store SOR-CMCI in ME" then the UE shall store or delete the SOR-CMCI in the non-volatile memory of the ME as described in annex C.1;
         If the ACK bit of the SOR header for SOR data type in the SOR transparent container is set to "acknowledgement requested" and the list type indicates:
         1. "PLMN ID and access technology list"; or
         2. "secured packet" and the ME receives status bytes from the UICC indicating that the UICC has received the secured packet successfully;
         then the ME shall send an acknowledgement in the Payload container IE of an UL NAS TRANSPORT message with Payload type IE set to "SOR transparent container" as specified in subclause 5.4.5.2.2. In the Payload container IE carrying the acknowledgement, the UE shall set the ME support of SOR-CMCI indicator to "SOR-CMCI supported by the ME".
         The UE shall proceed with the behaviour as specified in TS 23.122 Annex C; or
      The UE shall proceed with the behaviour as specified in TS 23.122 Annex C; or
   2. does not successfully pass the integrity check (see TS 33.501) then the UE shall discard the content of the payload container IE and proceed with the behaviour as specified in TS 23.122 Annex C.
5. Void;
6. Void;
7. "N1 SM information" and:
   1)

   the 5GMM cause IE is set to the 5GMM cause #22 "Congestion", the UE passes to the 5GSM sublayer an indication that the 5GSM message was not forwarded due to DNN based congestion control along with the 5GSM message from the Payload container IE of the DL NAS TRANSPORT message, and the time value from the Back-off timer value IE;

   2)

   the 5GMM cause IE is set to the 5GMM cause #28 "Restricted service area", the UE passes to the 5GSM sublayer an indication that the 5GSM message was not forwarded due to service area restrictions along with the 5GSM message from the Payload container IE of the DL NAS TRANSPORT message, enters the state 5GMM-REGISTERED.NON-ALLOWED-SERVICE and, if the DL NAS TRANSPORT message is received over 3GPP access, performs the registration procedure for mobility and periodic registration update without waiting for the release of the N1 NAS signalling connection (see subclauses 5.3.5 and 5.5.1.3);

   3)

   the 5GMM cause IE is set to the 5GMM cause #65 "maximum number of PDU sessions reached", the UE passes to the 5GSM sublayer an indication that the 5GSM message was not forwarded because the PLMN's maximum number of PDU sessions has been reached, along with the 5GSM message from the Payload container IE of the DL NAS TRANSPORT message;

   4)

   the 5GMM cause IE is set to the 5GMM cause #67 "insufficient resources for specific slice and DNN", the UE passes to the 5GSM sublayer an indication that the 5GSM message was not forwarded due to S-NSSAI and DNN based congestion control along with the 5GSM message from the Payload container IE of the DL NAS TRANSPORT message, and the time value from the Back-off timer value IE;

   5)

   the 5GMM cause IE is set to the 5GMM cause #69 "insufficient resources for specific slice", the UE passes to the 5GSM sublayer an indication that the 5GSM message was not forwarded due to S-NSSAI only based congestion control along with the 5GSM message from the Payload container IE of the DL NAS TRANSPORT message, and the time value from the Back-off timer value IE;

   5a)

   the 5GMM cause IE is set to the 5GMM cause #78 "PLMN not allowed to operate at the present UE location", the UE passes to the 5GSM sublayer an indication that the 5GSM message was not forwarded because the UE is registered to a PLMN via a satellite NG-RAN cell that is not allowed to operate at the present UE location along with the 5GSM message from the Payload container IE of the DL NAS TRANSPORT message;

   6)

   the 5GMM cause IE is set to the 5GMM cause #90 "payload was not forwarded", the UE passes to the 5GSM sublayer an indication that the 5GSM message was not forwarded due to routing failure along with the 5GSM message from the Payload container IE of the DL NAS TRANSPORT message;

   7)

   the 5GMM cause IE is set to the 5GMM cause #91 "DNN not supported or not subscribed in the slice", the UE passes to the 5GSM sublayer an indication that the 5GSM message was not forwarded because the DNN is not supported or not subscribed in a slice along with the 5GSM message from the Payload container IE of the DL NAS TRANSPORT message, and the time value from the Back-off timer value IE, if any;

   8)

   the 5GMM cause IE is set to the 5GMM cause #92 "insufficient user-plane resources for the PDU session", the UE passes to the 5GSM sublayer an indication that the 5GSM message was not forwarded due to insufficient user-plane resources along with the 5GSM message from the Payload container IE of the DL NAS TRANSPORT message.
8. "UE policy container", the UE policy container in the Payload container IE is handled in the UE policy delivery procedures specified in Annex D;
9. "UE parameters update transparent container" and if the Payload container IE
   1. successfully passes the integrity check (see TS 33.501), the ME shall store the received UE parameter update counter as specified in Annex C and proceed as follows:
      1. if the UE parameters update list includes a UE parameters update data set with UE parameters update data set type indicating "Routing indicator update data",
         1. the ME shall behave as if an SMS is received with protocol identifier set to SIM data download, data coding scheme set to class 2 message and SMS payload as secured packet contents of UE parameters update transparent container IE. The SMS payload is forwarded to UICC as specified in TS 23.040; and
         2. if the ACK bit of the UE parameters update header in the UE parameters update transparent container is set to "acknowledgment requested" and if the ME receives status bytes from the UICC indicating that the UICC has received the secured packet successfully, the ME shall send an acknowledgement in the Payload container IE of an UL NAS TRANSPORT message with Payload type IE set to "UE parameters update transparent container" as specified in subclause 5.4.5.2.2; and
         3. if the ME receives a REFRESH command from the UICC as specified in TS 31.111 and if the REG bit of the UE parameters update header in the UE parameters update transparent container IE is set to "re-registration requested", and:
            C1)

            the UE is registered over 3GPP access, then the UE shall wait until the emergency services over 3GPP access, if any, are completed, enter 5GMM-IDLE mode over 3GPP access or 5GMM-CONNECTED mode with RRC inactive indication, perform a de-registration procedure, and then delete its 5G-GUTI if the UE is registered to different PLMN or SNPN on non-3GPP access or the UE is not registered over non-3GPP access, or wait until the de-registration procedure over non-3GPP access specified in case C2) or C3) is completed before deleting its 5G-GUTI if the UE is registered to same PLMN or SNPN on non-3GPP access, and then initiate a registration procedure for initial registration as specified in subclause 5.5.1.2;

            C2)

            the UE is registered over non-3GPP access and does not have emergency services ongoing over non-3GPP access, then the UE shall locally release the N1 NAS signalling connection and enter 5GMM-IDLE mode over non-3GPP access, perform a de-registration procedure, and then delete its 5G-GUTI if the UE is registered to different PLMN or SNPN on 3GPP access or the UE is not registered over 3GPP access, or wait until the de-registration procedure over 3GPP access specified in case C1) is completed before deleting its 5G-GUTI if the UE is registered to same PLMN or SNPN on 3GPP access, and then initiate a registration procedure for initial registration as specified in subclause 5.5.1.2; and

            C3)

            the UE is registered over non-3GPP access and has an emergency services ongoing over non-3GPP access, then the UE shall wait until the emergency services are completed before locally releasing the N1 NAS signalling connection and enter 5GMM-IDLE mode over non-3GPP access, perform a de-registration procedure, and then delete its 5G-GUTI if the UE is registered to different PLMN or SNPN on 3GPP access or if the UE is not registered over 3GPP access, or wait until the de-registration procedure over 3GPP access specified in case C1) is completed before deleting its 5G-GUTI if the UE is registered to same PLMN or SNPN on 3GPP access, and then initiate a registration procedure for initial registration as specified in subclause 5.5.1.2.
      2. if the UE parameters update list includes a UE parameters update data set with UE parameters update data set type indicating "Default configured NSSAI update data",
         1. if the ACK bit of the UE parameters update header in the UE parameters update transparent container is set to "acknowledgment requested" and if the UE parameters update list does not include a UE parameters update data set with UE parameters update data set type indicating "Routing indicator update data", the ME shall send an acknowledgement in the Payload container IE of an UL NAS TRANSPORT message with Payload type IE set to "UE parameters update transparent container" as specified in subclause 5.4.5.2.2
         2. the ME shall replace the stored default configured NSSAI with the default configured NSSAI included in the default configured NSSAI update data. In case of SNPN, the ME shall replace the stored default configured NSSAI associated with the selected entry of the "list of subscriber data" or the PLMN subscription with the default configured NSSAI included in the default configured NSSAI update data; and
         3. if the REG bit of the UE parameters update header in the UE parameters update transparent container is set to "re-registration requested" and the UE parameters update list does not include a UE parameters update data set with UE parameters update data set type indicating "Routing indicator update data", the UE shall wait until it enters 5GMM-IDLE mode and then the UE shall initiate a registration procedure for mobility registration update as specified in subclause 5.5.1.3.
            if the UE parameters update list does not include a UE parameters update data set with UE parameters update data set type indicating "Routing indicator update data", the UE used the old default configured NSSAI to create the requested NSSAI in a REGISTRATION REQUEST message, the UE does not have a configured NSSAI for the current PLMN and the UE has an allowed NSSAI for the current PLMN which contains one or more S-NSSAIs that are not included in the new default configured NSSAI, the UE shall wait until it enters 5GMM-IDLE mode and then the UE shall initiate a registration procedure for mobility and periodic registration update as specified in subclause 5.5.1.3; and
      3. if the UE parameters update list includes a UE parameters update data set with UE parameters update data set type indicating "Disaster roaming information update data",
         1. if the ACK bit of the UE parameters update header in the UE parameters update transparent container is set to "acknowledgment requested" and if the UE parameters update list does not include a UE parameters update data set with UE parameters update data set type indicating "Routing indicator update data" or a UE parameters update data set with UE parameters update data set type indicating "Default configured NSSAI update data", the ME shall send an acknowledgement in the Payload container IE of an UL NAS TRANSPORT message with Payload type IE set to "UE parameters update transparent container" as specified in subclause 5.4.5.2.2;
         2. the UE shall delete the indication of whether disaster roaming is enabled in the UE stored in the ME, if any, and store the indication of whether disaster roaming is enabled in the UE included in the disaster roaming information update data in the ME; and
         3. if the REG bit of the UE parameters update header in the UE parameters update transparent container is set to "re-registration requested" and the UE parameters update list does not include a UE parameters update data set with UE parameters update data set type indicating "Routing indicator update data", the UE shall wait until it enters 5GMM-IDLE mode and then the UE shall initiate a registration procedure for mobility registration update as specified in subclause 5.5.1.3.
   2. does not successfully pass the integrity check (see TS 33.501) then the UE shall discard the content of the payload container IE;
10. "Location services message container" and the 5GMM cause IE is not included in the DL NAS TRANSPORT message, the UE shall forward the payload container type, the content of the Payload container IE and the routing information in the Additional information IE if included to the upper layer location services application;
11. "CIoT user data container", the UE shall forward the content of the Payload container IE and the PDU session ID to the 5GSM sublayer;
12. "CIoT user data container" and:
    1. the 5GMM cause IE is set to the 5GMM cause #22 "Congestion", the UE passes to the 5GSM sublayer an indication that the CIoT user data was not forwarded due to DNN based congestion control along with the CIoT user data from the Payload container IE of the DL NAS TRANSPORT message, and the time value from the Back-off timer value IE.
    2. the 5GMM cause IE is set to the 5GMM cause #90 "payload was not forwarded", the UE passes to the 5GSM sublayer an indication that the user data container was not forwarded due to routing failure along with the user data container from the Payload container IE and the PDU session ID from the PDU session ID IE of the DL NAS TRANSPORT message.
13. "Service-level-AA container" and the Service-level device ID included in the Service-level-AA container is set to a CAA-level UAV ID, the UE shall forward the content of the Payload container IE to the upper layer application for UAS corresponding to the CAA-level UAV ID; and
14. "Multiple payloads", the UE shall first decode the content of the Payload container IE (see subclause 9.11.3.39) to obtain the number of payload container entries and for each payload container entry, the UE shall:
    1. decode the payload container type field;
    2. decode the optional IE fields and the payload container contents field in the payload container entry; and
    3. handle the content of each payload container entry the same as the content of the Payload container IE and the associated optional IEs as specified in bullets a) to m) above according to the payload container type field.