Section: 5.5.3.2.5 Normal and periodic tracking area updating procedure not accepted by the network
Content: If the tracking area updating cannot be accepted by the network, the MME sends a TRACKING AREA UPDATE REJECT message to the UE including an appropriate EMM cause value. If a tracking area update request from a UE with a LIPA PDN connection is not accepted due to the reasons specified in clause 5.5.3.2.4, the MME shall send the TRACKING AREA UPDATE REJECT message with EMM cause value #10 "Implicitly detached". If the tracking area update request is rejected due to general NAS level mobility management congestion control, the network shall set the EMM cause value to #22 "congestion" and assign a value for back-off timer T3346. In NB-S1 mode, if the tracking area update request is rejected due to operator determined barring (see 3GPP TS 29.272[ Evolved Packet System (EPS); Mobility Management Entity (MME) and Serving GPRS Support Node (SGSN) related interfaces based on Diameter protocol ]  [16C]), the network shall set the EMM cause value to #22 "congestion" and assign a value for back-off timer T3346. If the tracking area request is rejected due to service gap control as specified in clause 5.3.17 i.e. the T3447 timer is running, the network shall set the EMM cause value to #22 "congestion" and may assign a back-off timer T3346 with the remaining time of the running T3447 timer. If the tracking area update request is rejected due to incompatibility between the CIoT EPS optimizations supported by the UE and what the network supports and the network sets the EMM cause value to #15 "no suitable cells in tracking area", the network may additionally include the Extended EMM cause IE with value "requested EPS optimization not supported". NOTE 1: How the UE uses the Extended EMM cause IE with value "requested EPS optimization not supported" is implementation specific. The UE still behaves according to the EMM cause value #15. Based on operator policy, if the tracking area update request is rejected due to core network redirection for CIoT optimizations, the network shall set the EMM cause value to #31 "Redirection to 5GCN required". NOTE 2: The network can take into account the UE's N1 mode capability, the 5GS CIoT network behaviour supported by the UE or the 5GS CIoT network behaviour supported by the 5GCN to determine the rejection with the EMM cause value #31 "Redirection to 5GCN required". If the UE initiated the tracking area updating procedure due to inter-system change from N1 mode to S1 mode, and the MME does not support N26 interface, the MME shall send a TRACKING AREA UPDATE REJECT message with EMM cause value #9 "UE identity cannot be derived by the network". When the UE performs inter-system change from N1 mode to S1 mode, if the MME is informed that verification of the integrity protection of the TRACKING AREA UPDATE REQUEST message has failed in the AMF, then: a) If the MME can retrieve the current EPS security context as indicated by the eKSI and GUTI sent by the UE, the MME shall proceed as specified in clause 5.5.3.2.4; b) if the MME cannot retrieve the current EPS security context as indicated by the eKSI and GUTI sent by the UE, or the eKSI or GUTI was not sent by the UE, the MME may initiate the identification procedure by sending the IDENTITY REQUEST message with the "Type of identity" of the Identity type IE set to "IMSI" before taking actions as specified in clause 4.4.4.3; or c) If the MME needs to reject the tracking area updating procedure, the MME shall send a TRACKING AREA UPDATE REJECT message with EMM cause value #9 "UE identity cannot be derived by the network". In NB-S1 mode or WB-S1 mode via satellite E-UTRAN access, if the tracking area updating request is from a UE via a satellite E-UTRA cell and the network using the User Location Information provided by the eNodeB (see 3GPP TS 36.413[ Evolved Universal Terrestrial Radio Access Network (E-UTRAN); S1 Application Protocol (S1AP) ]  [23]), is able to determine that the UE is in a location where the network is not allowed to operate, the network shall set the EMM cause value in the TRACKING AREA UPDATE REJECT message to #78 "PLMN not allowed to operate at the present UE location". Upon receiving the TRACKING AREA UPDATE REJECT message, if the message is integrity protected or contains a reject cause other than EMM cause value #25, the UE shall stop timer T3430 and stop any transmission of user data. If the TRACKING AREA UPDATE REJECT message with EMM cause #25 or #78 was received without integrity protection, then the UE shall discard the message. If the MME received multiple TAIs from the satellite E-UTRAN as described in 3GPP TS 23.401[ General Packet Radio Service (GPRS) enhancements for Evolved Universal Terrestrial Radio Access Network (E-UTRAN) access ]  [10], and determines that, by UE subscription and operator's preferences, all of the received TAIs are forbidden for roaming or for regional provision of service, the MME shall include the TAI(s) in: a) the Forbidden TAI(s) for the list of "forbidden tracking areas for roaming" IE; b) the Forbidden TAI(s) for the list of "forbidden tracking areas for regional provision of service" IE; or c) both, in the TRACKING AREA UPDATE REJECT message. Regardless of the EMM cause value received in the TRACKING AREA UPDATE REJECT message via satellite E-UTRAN, - if the UE receives the Forbidden TAI(s) for the list of "forbidden tracking areas for roaming" IE in the TRACKING AREA UPDATE REJECT message, the UE shall store the TAI(s) included in the IE which are belonging to the serving PLMN or equivalent PLMN(s), if not already stored, into the list of "forbidden tracking areas for roaming" and ignore the TAI(s) which do not belong to the serving PLMN or equivalent PLMN(s); and - if the UE receives the Forbidden TAI(s) for the list of "forbidden tracking areas for regional provision of service" IE in the TRACKING AREA UPDATE REJECT message, the UE shall store the TAI(s) included in the IE which are belonging to the serving PLMN or equivalent PLMN(s), if not already stored, into the list of "forbidden tracking areas for regional provision of service" and ignore the TAI(s) which do not belong to the serving PLMN or equivalent PLMN(s) Furthermore. the UE shall take the following actions depending on the EMM cause value received in the TRACKING AREA UPDATE REJECT message. #3 (Illegal UE); #6 (Illegal ME); or #8 (EPS services and non-EPS services not allowed); The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and eKSI. The UE shall consider the USIM as invalid for EPS services until switching off or the UICC containing the USIM is removed or the timer T3245 expires as described in clause 5.3.7a. The UE shall delete the list of equivalent PLMNs and shall enter the state EMM-DEREGISTERED.NO-IMSI. If the message has been successfully integrity checked by the NAS and the UE maintains a counter for "SIM/USIM considered invalid for GPRS services", then the UE shall set this counter to UE implementation-specific maximum value. If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number and the MM parameters update status, TMSI, LAI and ciphering key sequence number as specified in 3GPP TS 24.008[ Mobile radio interface Layer 3 specification; Core network protocols; Stage 3 ]  [13] for the case when the normal routing area updating procedure is rejected with the GMM cause with the same value. The USIM shall be considered as invalid also for non-EPS services until switching off or the UICC containing the USIM is removed or the timer T3245 expires as described in clause 5.3.7a. If the message has been successfully integrity checked by the NAS and the UE maintains a counter for "SIM/USIM considered invalid for non-GPRS services", then the UE shall set this counter to UE implementation-specific maximum value. For the EMM cause value #3 or #6, if the UE is operating in single-registration mode, the UE shall in addition handle the 5GMM parameters 5GMM state, 5GS update status, 5G-GUTI, last visited registered TAI, TAI list and ngKSI as specified in 3GPP TS 24.501[ Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3 ]  [54] for the case when the registration procedure for mobility and periodic registration update performed over 3GPP access and indicating "mobility registration updating" in the 5GS registration type IE of the REGISTRATION REQUEST message is rejected with the 5GMM cause with the same value. For the EMM cause value #8, if the UE is operating in single-registration mode, the UE shall in addition set the 5GMM state to 5GMM-DEREGISTERED, 5GS update status to 5U3 ROAMING NOT ALLOWED, and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. NOTE 3: The possibility to configure a UE so that the radio transceiver for a specific radio access technology is not active, although it is implemented in the UE, is out of scope of the present specification. #7 (EPS services not allowed); The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and eKSI. The UE shall consider the USIM as invalid for EPS services until switching off or the UICC containing the USIM is removed or the timer T3245 expires as described in clause 5.3.7a. The UE shall enter the state EMM-DEREGISTERED. If the message has been successfully integrity checked by the NAS and the UE maintains a counter for "SIM/USIM considered invalid for GPRS services", then the UE shall set this counter to UE implementation-specific maximum value. If the EPS update type is "periodic updating", a UE operating in CS/PS mode 1 or CS/PS mode 2 of operation, which is IMSI attached for non-EPS services, is still IMSI attached for non-EPS services. The UE operating in CS/PS mode 1 or CS/PS mode 2 of operation shall set the update status to U2 NOT UPDATED, shall attempt to select GERAN or UTRAN radio access technology and shall proceed with appropriate MM specific procedure according to the MM service state. The UE shall not reselect E-UTRAN radio access technology until switching off or the UICC containing the USIM is removed. If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number as specified in 3GPP TS 24.008[ Mobile radio interface Layer 3 specification; Core network protocols; Stage 3 ]  [13] for the case when the normal routing area updating procedure is rejected with the GMM cause with the same value. If the UE is operating in single-registration mode, the UE shall in addition handle the 5GMM parameters 5GMM state, 5GS update status, 5G-GUTI, last visited registered TAI, TAI list and ngKSI as specified in 3GPP TS 24.501[ Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3 ]  [54] for the case when the registration procedure for mobility and periodic registration update performed over 3GPP access and indicating "mobility registration updating" in the 5GS registration type IE of the REGISTRATION REQUEST message is rejected with the 5GMM cause with the same value. #9 (UE identity cannot be derived by the network); The UE shall set the EPS update status to EU2 NOT UPDATED (and shall store it according to clause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and eKSI. The UE shall enter the state EMM-DEREGISTERED.NORMAL-SERVICE. If the rejected request was not for initiating a PDN connection for emergency bearer services, the UE shall subsequently, automatically initiate the attach procedure. NOTE 4: User interaction is necessary in some cases when the UE cannot re-activate the EPS bearer(s) automatically. If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number as specified in 3GPP TS 24.008[ Mobile radio interface Layer 3 specification; Core network protocols; Stage 3 ]  [13] for the case when the normal routing area updating procedure is rejected with the GMM cause with the same value. If the UE is operating in the single-registration mode, the UE shall handle the 5GMM parameters 5GMM state, 5GS update status, 5G-GUTI, last visited registered TAI, TAI list and ngKSI as specified in 3GPP TS 24.501[ Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3 ]  [54] for the case when the registration procedure for mobility and periodic registration update performed over 3GPP access and indicating "mobility registration updating" in the 5GS registration type IE of the REGISTRATION REQUEST message is rejected with the 5GMM cause with the same value. #10 (Implicitly detached); If the EPS update type is "periodic updating", a UE in CS/PS mode 1 or CS/PS mode 2 of operation is IMSI detached for both EPS services and non-EPS services. The UE shall enter the state EMM-DEREGISTERED.NORMAL-SERVICE. The UE shall delete any mapped EPS security context or partial native EPS security context. If the rejected request was not for initiating a PDN connection for emergency bearer services, the UE shall then perform a new attach procedure. NOTE 5: User interaction is necessary in some cases when the UE cannot re-activate the EPS bearer(s) automatically. If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the GMM state as specified in 3GPP TS 24.008[ Mobile radio interface Layer 3 specification; Core network protocols; Stage 3 ]  [13] for the case when the normal routing area updating procedure is rejected with the GMM cause with the same value. If the UE is operating in single-registration mode, the UE shall in addition handle the 5GMM state as specified in 3GPP TS 24.501[ Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3 ]  [54] for the case when the registration procedure for mobility and periodic registration update performed over 3GPP access and indicating "mobility registration updating" in the 5GS registration type IE of the REGISTRATION REQUEST message is rejected with the 5GMM cause with the same value. #11 (PLMN not allowed); or #35 (Requested service option not authorized in this PLMN); The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and eKSI. The UE shall reset the tracking area updating attempt counter, delete the list of equivalent PLMNs and enter the state EMM-DEREGISTERED.PLMN-SEARCH. The UE shall store the PLMN identity in the "forbidden PLMN list" and if the UE is configured to use timer T3245 (see 3GPP TS 24.368[ Non-Access Stratum (NAS) configuration Management Object (MO) ]  [15A] or 3GPP TS 31.102[ Characteristics of the Universal Subscriber Identity Module (USIM) application ]  [17]) then the UE shall start timer T3245 and proceed as described in clause 5.3.7a. If the message has been successfully integrity checked by the NAS and the UE maintains a PLMN-specific attempt counter for that PLMN, then the UE shall set this counter to the UE implementation-specific maximum value. The UE shall perform a PLMN selection according to 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [6]. If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number and routing area updating attempt counter and the MM parameters update status, TMSI, LAI, ciphering key sequence number and the location update attempt counter as specified in 3GPP TS 24.008[ Mobile radio interface Layer 3 specification; Core network protocols; Stage 3 ]  [13] for the case when the normal routing area updating procedure is rejected with the GMM cause value #11 and no RR connection exists. For the EMM cause value #11, if the UE is operating in single-registration mode, the UE shall in addition handle the 5GMM parameters 5GMM state, 5GS update status, 5G-GUTI, last visited registered TAI, TAI list, ngKSI and registration attempt counter as specified in 3GPP TS 24.501[ Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3 ]  [54] for the case when the registration procedure for mobility and periodic registration update performed over 3GPP access and indicating "mobility registration updating" in the 5GS registration type IE of the REGISTRATION REQUEST message is rejected with the 5GMM cause with the same value. For the EMM cause value #35, if the UE is operating in single-registration mode, the UE shall in addition set the 5GMM state to 5GMM-DEREGISTERED, 5GS update status to 5U3 ROAMING NOT ALLOWED, and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. In addition, the UE shall reset the registration attempt counter. #12 (Tracking area not allowed); The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and eKSI. The UE shall reset the tracking area updating attempt counter and shall enter the state EMM-DEREGISTERED.LIMITED-SERVICE. The UE shall store the current TAI in the list of "forbidden tracking areas for regional provision of service". If the TRACKING AREA UPDATE REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "forbidden tracking areas for regional provision of service" for non-integrity protected NAS reject message. If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number and routing area updating attempt counter as specified in 3GPP TS 24.008[ Mobile radio interface Layer 3 specification; Core network protocols; Stage 3 ]  [13] for the case when the normal routing area updating procedure is rejected with the GMM cause with the same value. If the UE is operating in single-registration mode, the UE shall in addition handle the 5GMM parameters 5GMM state, 5GS update status, 5G-GUTI, last visited registered TAI, TAI list, ngKSI and registration attempt counter as specified in 3GPP TS 24.501[ Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3 ]  [54] for the case when the registration procedure for mobility and periodic registration update performed over 3GPP access and indicating "mobility registration updating" in the 5GS registration type IE of the REGISTRATION REQUEST message is rejected with the 5GMM cause with the same value. #13 (Roaming not allowed in this tracking area); The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.3) and shall delete the list of equivalent PLMNs. The UE shall reset the tracking area updating attempt counter and shall change to state EMM-REGISTERED.PLMN-SEARCH. The UE shall store the current TAI in the list of "forbidden tracking areas for roaming" and shall remove the current TAI from the stored TAI list if present. If the TRACKING AREA UPDATE REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "forbidden tracking areas for roaming" for non-integrity protected NAS reject message. If the UE is registered in N1 mode and operating in dual-registration mode, the PLMN that the UE chooses to register in is specified in 3GPP TS 24.501[ Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3 ]  [54] clause 4.8.3. Otherwise the UE shall perform a PLMN selection according to 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [6]. If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the GMM parameters GMM state, GPRS update status and routing area updating attempt counter as specified in 3GPP TS 24.008[ Mobile radio interface Layer 3 specification; Core network protocols; Stage 3 ]  [13] for the case when the normal routing area updating procedure is rejected with the GMM cause with the same value. If the UE is operating in single-registration mode, the UE shall in addition handle the 5GMM parameters 5GMM state, 5GS update status, and registration attempt counter as specified in 3GPP TS 24.501[ Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3 ]  [54] for the case when the registration procedure for mobility and periodic registration update performed over 3GPP access and indicating "mobility registration updating" in the 5GS registration type IE of the REGISTRATION REQUEST message is rejected with the 5GMM cause with the same value. #14 (EPS services not allowed in this PLMN); The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.3). Furthermore, the UE shall delete any GUTI, last visited registered TAI, TAI list and eKSI. The UE shall reset the tracking area updating attempt counter and shall enter the state EMM-DEREGISTERED.PLMN-SEARCH. The UE shall store the PLMN identity in the "forbidden PLMNs for GPRS service" list and if the UE is configured to use timer T3245 (see 3GPP TS 24.368[ Non-Access Stratum (NAS) configuration Management Object (MO) ]  [15A] or 3GPP TS 31.102[ Characteristics of the Universal Subscriber Identity Module (USIM) application ]  [17]) then the UE shall start timer T3245 and proceed as described in clause 5.3.7a. If the message has been successfully integrity checked by the NAS and the UE maintains a PLMN-specific PS-attempt counter for that PLMN, then the UE shall set this counter to the UE implementation-specific maximum value. If the EPS update type is "TA updating", or the EPS update type is "periodic updating" and the UE is in PS mode 1 or PS mode 2 of operation, the UE shall perform a PLMN selection according to 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [6]. In this case, the UE supporting S1 mode only shall delete the list of equivalent PLMNs before performing the procedure. If the EPS update type is "periodic updating", a UE operating in CS/PS mode 1 or CS/PS mode 2 of operation, which is IMSI attached for non-EPS services, is still IMSI attached for non-EPS services and shall proceed as follows: - a UE operating in CS/PS mode 1 or CS/PS mode 2 of operation shall set the update status to U2 NOT UPDATED; - a UE operating in CS/PS mode 1 of operation and supporting A/Gb mode or Iu mode may select GERAN or UTRAN radio access technology and proceed with the appropriate MM specific procedure according to the MM service state. In this case, the UE shall disable the E-UTRA capability (see clause 4.5); - a UE operating in CS/PS mode 1 of operation and supporting A/Gb mode or Iu mode may perform a PLMN selection according to 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [6]; - a UE operating in CS/PS mode 1 of operation and supporting S1 mode only, or operating in CS/PS mode 2 of operation shall delete the list of equivalent PLMNs and shall perform a PLMN selection according to 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [6]. If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the GMM parameters GMM state, GPRS update status, P-TMSI, P-TMSI signature, RAI, GPRS ciphering key sequence number and routing area updating attempt counter as specified in 3GPP TS 24.008[ Mobile radio interface Layer 3 specification; Core network protocols; Stage 3 ]  [13] for the case when the normal routing area updating procedure is rejected with the GMM cause with the same value. If the UE is operating in single-registration mode, the UE shall in addition set the 5GMM state to 5GMM-DEREGISTERED, 5GS update status to 5U3 ROAMING NOT ALLOWED, and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. In addition, the UE shall reset the registration attempt counter. #15 (No suitable cells in tracking area); The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.3). The UE shall reset the tracking area updating attempt counter and shall enter the state EMM-REGISTERED.LIMITED-SERVICE. The UE shall store the current TAI in the list of "forbidden tracking areas for roaming". If the TRACKING AREA UPDATE REJECT message is not integrity protected, the UE shall memorize the current TAI was stored in the list of "forbidden tracking areas for roaming" for non-integrity protected NAS reject message. Additionally, the UE shall remove the current TAI from the stored TAI list if present and: - if the UE is in WB-S1 mode and the Extended EMM cause IE with value "E-UTRAN not allowed" is included in the TRACKING AREA UPDATE REJECT message, the UE supports "E-UTRA Disabling for EMM cause #15", and the "E-UTRA Disabling Allowed for EMM cause #15" parameter as specified in 3GPP TS 24.368[ Non-Access Stratum (NAS) configuration Management Object (MO) ]  [15A] or 3GPP TS 31.102[ Characteristics of the Universal Subscriber Identity Module (USIM) application ]  [17] is present and set to enabled; then the UE shall disable the E-UTRA capability as specified in clause 4.5 and search for a suitable cell in another location area or 5GS tracking area; - if the UE is in NB-S1 mode and the Extended EMM cause IE with value "NB-IoT not allowed" is included in the TRACKING AREA UPDATE REJECT message, then the UE may disable the NB-IoT capability as specified in clause 4.9 and search for a suitable cell in E-UTRAN radio access technology; - otherwise, the UE shall search for a suitable cell in another tracking area or in another location area according to 3GPP TS 36.304[ Evolved Universal Terrestrial Radio Access (E-UTRA); User Equipment (UE) procedures in idle mode ]  [21]. If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the GMM parameters GMM state, GPRS update status and routing area updating attempt counter as specified in 3GPP TS 24.008[ Mobile radio interface Layer 3 specification; Core network protocols; Stage 3 ]  [13] for the case when the normal routing area updating procedure is rejected with the GMM cause with the same value. If the UE is operating in single-registration mode, the UE shall in addition handle the 5GMM parameters 5GMM state, 5GS update status, and registration attempt counter as specified in 3GPP TS 24.501[ Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3 ]  [54] for the case when the registration procedure for mobility and periodic registration update performed over 3GPP access and indicating "mobility registration updating" in the 5GS registration type IE of the REGISTRATION REQUEST message is rejected with the 5GMM cause with the same value. #22 (Congestion); If the T3346 value IE is present in the TRACKING AREA UPDATE REJECT message and the value indicates that this timer is neither zero nor deactivated, the UE shall proceed as described below, otherwise it shall be considered as an abnormal case and the behaviour of the UE for this case is specified in clause 5.5.3.2.6. The UE shall abort the tracking area updating procedure, reset the tracking area updating attempt counter and set the EPS update status to EU2 NOT UPDATED. If the rejected request was not for initiating a PDN connection for emergency bearer services, the UE shall change to state EMM-REGISTERED.ATTEMPTING-TO-UPDATE. The UE shall stop timer T3346 if it is running. If the TRACKING AREA UPDATE REJECT message is integrity protected, the UE shall start timer with the value provided in the T3346 value IE. If the TRACKING AREA UPDATE REJECT message is not integrity protected, the UE shall start timer T3346 with a random value from the default range specified in 3GPP TS 24.008[ Mobile radio interface Layer 3 specification; Core network protocols; Stage 3 ]  [13]. The UE stays in the current serving cell and applies the normal cell reselection process. The tracking area updating procedure is started, if still necessary, when timer T3346 expires or is stopped. If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the GMM parameters GMM state, GPRS update status and routing area updating attempt counter as specified in 3GPP TS 24.008[ Mobile radio interface Layer 3 specification; Core network protocols; Stage 3 ]  [13] for the case when the normal routing area updating procedure is rejected with the GMM cause with the same value. If the tracking area updating procedure was initiated for and MO MMTEL voice or MO MMTEL video call is started, then a notification that the request was not accepted due to network congestion shall be provided to upper layers. NOTE 6: This can result in the upper layers requesting establishment of the originating voice call on an alternative manner e.g. requesting establishment of a CS voice call (see 3GPP TS 24.173[ IMS Multimedia telephony communication service and supplementary services; Stage 3 ]  [13E]). If the UE is operating in single-registration mode, the UE shall in addition handle the 5GMM parameters 5GMM state, 5GS update status and registration attempt counter as specified in 3GPP TS 24.501[ Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3 ]  [54] for the case when the registration procedure for mobility and periodic registration update performed over 3GPP access and indicating "mobility registration updating" in the 5GS registration type IE of the REGISTRATION REQUEST message is rejected with the 5GMM cause with the same value. #25 (Not authorized for this CSG); EMM cause #25 is only applicable when received from a CSG cell. EMM cause #25 received from a non-CSG cell is considered as an abnormal case and the behaviour of the UE is specified in clause 5.5.3.2.6. The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and store it according to clause 5.1.3.3). The UE shall reset the tracking area updating attempt counter and shall enter the state EMM-REGISTERED.LIMITED-SERVICE. If the CSG ID and associated PLMN identity of the cell where the UE has sent the TRACKING AREA UPDATE REQUEST message are contained in the Allowed CSG list, the UE shall remove the entry corresponding to this CSG ID and associated PLMN identity from the Allowed CSG list. If the CSG ID and associated PLMN identity of the cell where the UE has sent the TRACKING AREA UPDATE REQUEST message are contained in the Operator CSG list, the UE shall apply the procedures defined in 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [6] clause 3.1A. The UE shall search for a suitable cell according to 3GPP TS 36.304[ Evolved Universal Terrestrial Radio Access (E-UTRA); User Equipment (UE) procedures in idle mode ]  [21]. If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the GMM parameters GMM state, GPRS update status and routing area updating attempt counter as specified in 3GPP TS 24.008[ Mobile radio interface Layer 3 specification; Core network protocols; Stage 3 ]  [13] for the case when the normal routing area updating procedure is rejected with the GMM cause with the same value. If the UE is operating in single-registration mode, the UE shall in addition set the 5GMM state to 5GMM-REGISTERED and set the 5GS update status to 5U3 ROAMING NOT ALLOWED and reset the registration attempt counter. #31 (Redirection to 5GCN required); EMM cause #31 received by a UE that has not indicated support for CIoT optimizations or not indicated support for N1 mode is considered as an abnormal case and the behaviour of the UE is specified in clause 5.5.3.2.6. The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.3). The UE shall reset the tracking area updating attempt counter and shall enter the state EMM-REGISTERED.LIMITED-SERVICE. The UE shall enable N1 mode capability for 3GPP access if it was disabled and disable the E-UTRA capability (see clause 4.5). If the UE is operating in single-registration mode, the UE shall in addition handle the 5GMM parameters 5GMM state, 5GS update status, and registration attempt counter as specified in 3GPP TS 24.501[ Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3 ]  [54] for the case when the registration procedure for mobility and periodic registration update performed over 3GPP access and indicating "mobility registration updating" in the 5GS registration type IE of the REGISTRATION REQUEST message is rejected with the 5GMM cause with the same value. #36 (IAB-node operation not authorized); The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to subclause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and eKSI. The UE shall reset the tracking area updating attempt counter, delete the list of equivalent PLMNs and enter the state EMM-DEREGISTERED.PLMN-SEARCH. The UE shall store the PLMN identity in the "forbidden PLMN list" and if the UE is configured to use timer T3245 (see 3GPP TS 24.368[ Non-Access Stratum (NAS) configuration Management Object (MO) ]  [15A] or 3GPP TS 31.102[ Characteristics of the Universal Subscriber Identity Module (USIM) application ]  [17]) then the UE shall start timer T3245 and proceed as described in subclause 5.3.7a. If the message has been successfully integrity checked by the NAS and the UE maintains a PLMN-specific attempt counter for that PLMN, then the UE shall set this counter to the UE implementation-specific maximum value. The UE shall perform a PLMN selection according to 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [6]. If the UE is operating in single-registration mode, the UE shall in addition handle the 5GMM parameters 5GMM state, 5GS update status, 5G-GUTI, last visited registered TAI, TAI list and ngKSI as specified in 3GPP TS 24.501[ Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3 ]  [54] for the case when the registration procedure for mobility and periodic registration update performed over 3GPP access and indicating "mobility registration updating" in the 5GS registration type IE of the REGISTRATION REQUEST message is rejected with the 5GMM cause with the same value. #40 (No EPS bearer context activated); The UE shall deactivate all the EPS bearer contexts locally, if any, and shall enter the state EMM-DEREGISTERED.NORMAL-SERVICE. If the rejected request was not for initiating a PDN connection for emergency bearer services, the UE shall perform a new attach procedure. NOTE 7: User interaction is necessary in some cases when the UE cannot re-activate the EPS bearer(s) automatically. If A/Gb mode or Iu mode is supported by the UE, the UE shall handle the GMM state as specified in 3GPP TS 24.008[ Mobile radio interface Layer 3 specification; Core network protocols; Stage 3 ]  [13] for the case when the normal routing area updating procedure is rejected with the GMM cause value #10 "Implicitly detached". If the UE is operating in single-registration mode, the UE shall in addition set the 5GMM state to 5GMM-DEREGISTERED. #42 (Severe network failure); The UE shall set the EPS update status to EU2 NOT UPDATED, and shall delete any GUTI, last visited registered TAI, TAI list, eKSI, and list of equivalent PLMNs, and set the tracking area update counter to 5. The UE shall start an implementation specific timer, setting its value to 2 times the value of T as defined in 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [6]. While this timer is running, the UE shall not consider the PLMN + RAT combination that provided this reject cause as a candidate for PLMN selection. The UE then enters state EMM-DEREGISTERED.PLMN-SEARCH in order to perform a PLMN selection according to 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [6]. If A/Gb mode or Iu mode is supported by the UE, the UE shall in addition set the GMM state to GMM-DEREGISTERED, GPRS update status to GU2 NOT UPDATED, and shall delete the P-TMSI, P-TMSI signature, RAI and GPRS ciphering key sequence number. If the UE is operating in single-registration mode, the UE shall in addition set the 5GMM state to 5GMM-DEREGISTERED, 5GS update status to 5U2 NOT UPDATED, and shall delete any 5G-GUTI, last visited registered TAI, TAI list and ngKSI. #78 (PLMN not allowed to operate at the present UE location). This cause value received from a non-satellite E-UTRA cell is considered as an abnormal case and the behaviour of the UE is specified in clause 5.5.3.2.6. The UE shall set the EPS update status to EU3 ROAMING NOT ALLOWED (and shall store it according to clause 5.1.3.3) and shall delete any GUTI, last visited registered TAI, TAI list and eKSI. Additionally, the UE shall reset the registration attempt counter. The UE shall store the PLMN identity and, if it is known, the current geographical location in the list of "PLMNs not allowed to operate at the present UE location", start a corresponding timer instance (see subclause 4.11.2), enter state EMM-DEREGISTERED.PLMN-SEARCH and perform a PLMN selection according to 3GPP TS 23.122[ Non-Access-Stratum (NAS) functions related to Mobile Station (MS) in idle mode ]  [6]. If the UE is operating in single-registration mode, the UE shall in addition handle the 5GMM parameters 5GMM state, 5GS update status, and registration attempt counter as specified in 3GPP TS 24.501[ Non-Access-Stratum (NAS) protocol for 5G System (5GS); Stage 3 ]  [54] for the case when the registration procedure for mobility and periodic registration update performed over 3GPP access and indicating "mobility registration updating" in the 5GS registration type IE of the REGISTRATION REQUEST message is rejected with the 5GMM cause with the same value. Other values are considered as abnormal cases. The specification of the UE behaviour in those cases is described in clause 5.5.3.2.6.