Skip to content

Mobility and Access Transitions⚓︎

Handover between radios of one site, reselection in idle mode, roaming between two private Sites through a Shared System, and the transitions a device makes between the mobile operator's public radio network and the private radio network with the same SIM.

ID Test Category Applies to
EXP-MOB-001 X2 (Xn) handover between two radios Functional 4G, 5G · Local radio · Single node, HA cluster, Geo-redundant
EXP-MOB-002 S1 (N2) handover between two radios Functional 4G, 5G · Local radio · Single node, HA cluster, Geo-redundant
EXP-MOB-003 Idle-mode reselection with tracking area update Functional 4G, 5G · Local radio · Single node, HA cluster, Geo-redundant
EXP-MOB-004 Roaming between two private Sites through a Shared System Functional 4G, 5G · Local radio · Single node, HA cluster, Geo-redundant
EXP-MOB-005 Transition from the public radio network to the private radio Functional 4G, 5G · Local radio, Public radio · Single node, HA cluster, Geo-redundant
EXP-MOB-006 Transition from the private radio to the public radio network Functional 4G, 5G · Local radio, Public radio · Single node, HA cluster, Geo-redundant
EXP-MOB-007 Repeated transitions between public and private radio Resilience 4G, 5G · Local radio, Public radio · Single node, HA cluster, Geo-redundant

EXP-MOB-001 — X2 (Xn) handover between two radios⚓︎

Attribute Value
Status Accepted
Category Functional
Components xCore, xControl
Applies to 4G, 5G · Local radio · Single node, HA cluster, Geo-redundant
Duration About 30 min
Prerequisite procedures EXP-SES-001 — UE-initiated attach
Automated by Platform suite, 4G split core: session flow x2-handover

Objective. A UE with an active data session moves from one radio to another of the same site. The radios hand the UE over directly, the core switches the user-plane path, and the session, its address and its traffic continue with no re-attach.

Preconditions

  • Platform
    • Two radios are connected to the xCore (EXP-INS-003 for each), with the X2 (4G) or Xn (5G) interface configured between them, in the same tracking area.
    • Both radios appear as Connected Private Radios on the Site.
  • Device
    • The UE has a web browser or a terminal application that can send ICMP echo requests (ping).
    • A way to move the UE between the coverage of the two radios (walking between them, or attenuating the serving radio).
  • Tooling and access
    • Start a 3GPP signalling capture (pcap) with your preferred tool on the interfaces the procedure exercises.
    • Log in to xControl with an account that can view the Mobile Asset under test.
    • Access to the CLI.
  • Procedures executed first

Procedure

# Where Action Expected result
1 — Execute EXP-SES-001 — UE-initiated attach as a prerequisite procedure. As defined in EXP-SES-001.
2 UE Start a continuous ping (one per second) to a host on the enterprise LAN and note the serving cell in the UE's field-test menu. Replies arrive; the serving cell is the first radio.
3 UE Move the UE into the coverage of the second radio until it hands over. The serving cell changes to the second radio; the ping continues with no lost reply.
4 Capture Inspect the signalling capture. The messages match the sequence under Expected signalling; there is no Attach Request or Registration Request.
5 xControl Open the Mobile Asset and its Event Log. The status is Connected with the same IP address; no new session was created; the session record now names the second radio.
6 CLI Run read mme -f imsi=<imsi> (or read amf <imsi>). The context names the second radio as serving and the state is connected.
7 UE Move the UE back into the first radio's coverage. The UE hands back with the same behaviour.

Expected signalling

Capture points: S1-MME / N2 (point 1), S11 / N4 (point 3).

4G (EPS) sequence

  1. Path Switch Request from the target eNodeB (the X2 handover preparation itself is between the eNodeBs and not visible on S1)
  2. Modify Bearer Request / Modify Bearer Response on S11 with the target eNodeB's user-plane address
  3. Path Switch Request Acknowledge

5G (5GS) sequence

  1. Path Switch Request from the target gNodeB
  2. PFCP Session Modification Request / Response on N4 with the target gNodeB's N3 tunnel
  3. Path Switch Request Acknowledge

Pass criteria

  • The session continues with the same IP address and no re-attach.
  • No ping reply is lost during the handover.
  • The core's context and the xControl session record name the new serving radio after the handover.

Evidence collected: 3GPP signalling capture (pcap); UE connectivity check; xControl session event log; CLI output.
References: 3GPP TS 23.401 §5.5.1.1.2 (X2-based handover without Serving GW relocation); 3GPP TS 23.502 §4.9.1.2 (Xn based inter NG-RAN handover).

EXP-MOB-002 — S1 (N2) handover between two radios⚓︎

Attribute Value
Status Accepted
Category Functional
Components xCore, xControl
Applies to 4G, 5G · Local radio · Single node, HA cluster, Geo-redundant
Duration About 30 min
Prerequisite procedures EXP-SES-001 — UE-initiated attach
Automated by Platform suite, 4G split core: session flow s1-handover

Objective. A UE with an active data session moves between two radios that have no direct interface. The core coordinates the handover, and the session, its address and its traffic continue with no re-attach.

Preconditions

  • Platform
    • Two radios are connected to the xCore (EXP-INS-003 for each) with no X2 (4G) or Xn (5G) interface between them.
  • Device
    • The UE has a web browser or a terminal application that can send ICMP echo requests (ping).
    • A way to move the UE between the coverage of the two radios.
  • Tooling and access
    • Start a 3GPP signalling capture (pcap) with your preferred tool on the interfaces the procedure exercises.
    • Log in to xControl with an account that can view the Mobile Asset under test.
    • Access to the CLI.
  • Procedures executed first

Procedure

# Where Action Expected result
1 — Execute EXP-SES-001 — UE-initiated attach as a prerequisite procedure. As defined in EXP-SES-001.
2 UE Start a continuous ping to a host on the enterprise LAN and note the serving cell. Replies arrive; the serving cell is the first radio.
3 UE Move the UE into the coverage of the second radio until it hands over. The serving cell changes; the ping continues with no lost reply.
4 Capture Inspect the signalling capture. The messages match the sequence under Expected signalling.
5 xControl Open the Mobile Asset and its Event Log. The status is Connected with the same IP address and no new session.
6 CLI Run read mme -f imsi=<imsi> (or read amf <imsi>). The context names the second radio and exactly one context exists for the IMSI.

Expected signalling

Capture points: S1-MME / N2 (point 1), S11 / N4 (point 3).

4G (EPS) sequence

  1. Handover Required from the source eNodeB
  2. Handover Request / Handover Request Acknowledge with the target eNodeB
  3. Handover Command to the source eNodeB
  4. eNB Status Transfer / MME Status Transfer
  5. Handover Notify from the target eNodeB
  6. Modify Bearer Request / Modify Bearer Response on S11
  7. UE Context Release Command / Complete toward the source eNodeB

5G (5GS) sequence

  1. Handover Required from the source gNodeB
  2. Handover Request / Handover Request Acknowledge with the target gNodeB
  3. Handover Command to the source gNodeB
  4. Uplink RAN Status Transfer / Downlink RAN Status Transfer
  5. Handover Notify from the target gNodeB
  6. PFCP Session Modification Request / Response on N4
  7. UE Context Release Command / Complete toward the source gNodeB

Pass criteria

  • The session continues with the same IP address and no re-attach.
  • No ping reply is lost during the handover.
  • Exactly one context exists for the IMSI after the handover.

Evidence collected: 3GPP signalling capture (pcap); UE connectivity check; xControl session event log; CLI output.
References: 3GPP TS 23.401 §5.5.1.2.2 (S1-based handover); 3GPP TS 23.502 §4.9.1.3 (Inter NG-RAN node N2 based handover).

EXP-MOB-003 — Idle-mode reselection with tracking area update⚓︎

Attribute Value
Status Accepted
Category Functional
Components xCore
Applies to 4G, 5G · Local radio · Single node, HA cluster, Geo-redundant
Duration About 30 min
Prerequisite procedures EXP-SES-001 — UE-initiated attach
EXP-SES-004 — UE idle mode

Objective. A UE in idle state moves into a radio of a different tracking area of the same site, performs a tracking area update (4G) or mobility registration update (5G), stays registered with its session, and can be paged and served in the new area.

Preconditions

  • Platform
    • Two radios are connected to the xCore with different tracking area codes, and the second area is not in the tracking area list the UE received at attach.
  • Tooling and access
    • Start a 3GPP signalling capture (pcap) with your preferred tool on the interfaces the procedure exercises.
    • Log in to xControl with an account that can view the Mobile Asset under test.
    • A host on the enterprise LAN that can ping the UE.
  • Procedures executed first

Procedure

# Where Action Expected result
1 — Execute EXP-SES-001 — UE-initiated attach as a prerequisite procedure. As defined in EXP-SES-001.
2 — Execute EXP-SES-004 — UE idle mode as a prerequisite procedure. As defined in EXP-SES-004.
3 UE While idle, move the UE into the coverage of the second radio. The UE reselects the second radio and stays registered.
4 Capture Inspect the signalling capture. The messages match the sequence under Expected signalling; there is no Attach Request or Registration Request.
5 xControl Open the Mobile Asset. The status is unchanged and the IP address is the same.
6 Test host Ping the UE's address from the LAN host. The UE is paged in the new area and answers, as in EXP-SES-006.

Expected signalling

Capture points: S1-MME / N2 (point 1).

4G (EPS) sequence

  1. Tracking Area Update Request from the second eNodeB, update type TA updating
  2. Tracking Area Update Accept with the new tracking area list
  3. Tracking Area Update Complete, when a new GUTI was allocated

5G (5GS) sequence

  1. Registration Request, registration type mobility registration updating
  2. Registration Accept with the new registration area
  3. Registration Complete, when a new 5G-GUTI was allocated

Pass criteria

  • The update is accepted; the UE stays registered with its session and address.
  • Paging in the new area succeeds.

Evidence collected: 3GPP signalling capture (pcap); xControl session event log.
References: 3GPP TS 23.401 §5.3.3.2 (E-UTRAN Tracking Area Update without Serving GW change); 3GPP TS 23.502 §4.2.2.2.2 (General Registration (mobility registration update)).

EXP-MOB-004 — Roaming between two private Sites through a Shared System⚓︎

Attribute Value
Status Accepted
Category Functional
Components xCore, xControl
Applies to 4G, 5G · Local radio · Single node, HA cluster, Geo-redundant
Duration About 1 h
Prerequisite procedures EXP-SES-001 — UE-initiated attach

Objective. A Mobile Asset on a System assigned to two Sites (a Shared System) obtains service at either Site. Arriving at the second Site, the UE registers with that Site's xCore, receives an address from the System's range, and reaches the enterprise network; the first Site's session is closed.

Preconditions

  • Platform
    • Two Sites, A and B, of the same Customer, each an operational xCore with a connected radio.
    • One System is assigned to both Sites (Systems, Edit, Sites), with a System Profile available at both.
  • Mobile Asset
    • The Mobile Asset is on the Shared System and connected at Site A.
  • Tooling and access
    • Log in to xControl with an account that holds the ADMIN role.
    • A signalling capture at Site B (capture point 1).
    • Access to the CLI of both Sites.
  • Procedures executed first

Procedure

# Where Action Expected result
1 — Execute EXP-SES-001 — UE-initiated attach as a prerequisite procedure. As defined in EXP-SES-001.
2 UE Move the UE from Site A's coverage into Site B's coverage (or attenuate Site A and power on at Site B). Note the time. The UE registers at Site B and shows a data connection.
3 Capture Inspect the capture at Site B. The UE's first message at Site B is a tracking area update or registration update that Site B cannot serve, followed by identification, authentication and a full attach or registration (see Expected signalling).
4 xControl Open the Mobile Asset and its Event Log. The status is Connected; the new session record names Site B; the IP address is inside the System's range.
5 UE Ping a host on the enterprise network reachable from Site B. The ping is answered.
6 xControl Watch the Site A session record. The Site A record closes no later than Site A's implicit detach time (the sum of its periodic, mobile reachable and implicit detach timers, show timer at Site A) plus 60 seconds after the move.
7 CLI At Site A, run read mme -f imsi=<imsi> (or read amf <imsi>) after the Site A record has closed. No context remains at Site A.

Expected signalling

Capture points: S1-MME / N2 at Site B (point 1).

4G (EPS) sequence

  1. Tracking Area Update Request with the GUTI issued by Site A, or Attach Request
  2. Identity Request / Identity Response (IMSI), because Site B does not hold the context
  3. Tracking Area Update Reject (implicitly detached), followed by Attach Request, when the UE started with a TAU
  4. The attach sequence of EXP-SES-001 at Site B

5G (5GS) sequence

  1. Registration Request (mobility registration updating) with the 5G-GUTI issued by Site A
  2. Identity Request / Identity Response (SUCI)
  3. Registration Reject or a full initial registration, then the registration and PDU session sequence of EXP-SES-001 at Site B

Pass criteria

  • The UE obtains service at Site B without any change in xControl.
  • The session record at Site B names Site B and carries an address from the System's range; a Mobile Asset with a static IP address keeps it, a dynamically addressed one may receive a different address.
  • The Site A session is closed no later than Site A's implicit detach time plus 60 seconds, and no context remains at Site A.

Evidence collected: 3GPP signalling capture (pcap); xControl session event log; CLI output.
References: 3GPP TS 23.401 §5.3.3.1 (Tracking Area Update procedure with Serving GW change (inter-MME)); 3GPP TS 24.301 §5.5.3.2.5 (Normal and periodic tracking area updating procedure not accepted by the network).

EXP-MOB-005 — Transition from the public radio network to the private radio⚓︎

Attribute Value
Status Accepted
Category Functional
Components xCore, xRouter, xControl
Applies to 4G, 5G · Local radio, Public radio · Single node, HA cluster, Geo-redundant
Duration About 1 h
Prerequisite procedures EXP-POL-002 — Enterprise access through the public radio network
EXP-SES-001 — UE-initiated attach

Objective. A UE served through the mobile operator's public radio network (EXP-POL-002) enters the coverage of the enterprise's private radio, selects the private network, registers with the private xCore and reaches the enterprise network there, while the public session ends. The same SIM and the same Mobile Asset are used throughout.

Preconditions

  • Platform
    • A public-configuration xCore with xRouter (the public Site) and a private-radio xCore (the private Site), both of the same Customer, and a System assigned to both Sites.
    • The UE is able to select the private network's PLMN (see Devices and SIMs in Test environment and tooling); record whether selection is automatic or manual in the results sheet.
  • Mobile Asset
    • The Mobile Asset is on the shared System and connected through the public network (EXP-POL-002).
  • Tooling and access
    • Log in to xControl with an account that holds the ADMIN role.
    • A signalling capture at the private Site (capture point 1) and at xRouter (capture point 4).
    • A host on the enterprise LAN that answers ping.
  • Procedures executed first

Procedure

# Where Action Expected result
1 — Execute EXP-POL-002 — Enterprise access through the public radio network as a prerequisite procedure. As defined in EXP-POL-002.
2 UE Start a continuous ping to the LAN host, then move the UE into the private radio's coverage and let it select the private network (or select it manually). Note the time. The UE registers on the private network; the ping resumes after the transition.
3 Capture Inspect the capture at the private Site. The UE performs a full attach or registration at the private xCore, including identification and authentication against the private Site's subscriber database (sequence of EXP-SES-001).
4 xControl Open the Mobile Asset and its Event Log. The status is Connected; the newest session record names the private Site; the earlier record names the xRouter site.
5 xControl Compare the IP addresses of the two sessions. The private session's address is inside the System's range; it equals the public session's address only when the Mobile Asset has a static address.
6 UE Stop the ping and count the lost replies. The interruption is recorded.
7 xControl Watch the public session record. The record closes when the operator's core releases the session (at the latest at the operator's implicit detach time); record after how long.
8 Capture Inspect the capture at xRouter after the public record has closed. The release of the public session is visible (Cancel Location, or the mobile operator core's Delete Session toward the GTP proxy).

Pass criteria

  • The UE obtains service on the private network with no change in xControl and the same SIM.
  • The private session is attributed to the private Site in xControl, and the service interruption is recorded.
  • The public session record is closed, and no session for the IMSI remains on the public xCore, no later than the operator's implicit detach time plus 60 seconds.

Postconditions

  • Leave the UE on the private network for EXP-MOB-006.

Evidence collected: 3GPP signalling capture (pcap); xControl session event log; UE connectivity check.
References: 3GPP TS 23.122 §4.4 (PLMN selection).

EXP-MOB-006 — Transition from the private radio to the public radio network⚓︎

Attribute Value
Status Accepted
Category Functional
Components xCore, xRouter, xControl
Applies to 4G, 5G · Local radio, Public radio · Single node, HA cluster, Geo-redundant
Duration About 1 h
Prerequisite procedures EXP-MOB-005 — Transition from the public radio network to the private radio

Objective. A UE served by the private radio leaves its coverage, selects the mobile operator's public network, is authenticated by xRouter and reaches the enterprise network through the public xCore, while the private session ends. The same SIM and Mobile Asset are used throughout.

Preconditions

  • Platform
    • As for EXP-MOB-005.
  • Mobile Asset
    • The Mobile Asset is connected at the private Site (end state of EXP-MOB-005 or EXP-SES-001).
  • Tooling and access
    • Log in to xControl with an account that holds the ADMIN role.
    • A signalling capture at the private Site (capture point 1) and at xRouter (capture point 4).
    • A host on the enterprise LAN that answers ping.
  • Procedures executed first

Procedure

# Where Action Expected result
1 UE Start a continuous ping to the LAN host, then move the UE out of the private radio's coverage (or attenuate the private radio) and let it select the public network. Note the time. The UE registers on the public network; the ping resumes after the transition.
2 Capture Inspect the capture at xRouter. The operator's core authenticates the UE against xRouter and sets up the session toward the GTP proxy (sequence of EXP-POL-002).
3 xControl Open the Mobile Asset and its Event Log. The status is Connected; the newest session record names the xRouter site; the earlier record names the private Site.
4 UE Stop the ping and count the lost replies. The interruption is recorded.
5 xControl Watch the private Site's session record. The record closes no later than the private Site's implicit detach time (show timer at the private Site) plus 60 seconds; record after how long.
6 CLI At the private Site, run read mme -f imsi=<imsi> (or read amf <imsi>) after the record has closed. No context remains.

Pass criteria

  • The UE obtains service on the public network with no change in xControl and the same SIM.
  • The public session is attributed to the xRouter site in xControl, and the service interruption is recorded.
  • The private session record is closed and no context remains at the private Site no later than its implicit detach time plus 60 seconds.

Evidence collected: 3GPP signalling capture (pcap); xControl session event log; UE connectivity check; CLI output.
References: 3GPP TS 23.122 §4.4 (PLMN selection).

EXP-MOB-007 — Repeated transitions between public and private radio⚓︎

Attribute Value
Status Accepted
Category Resilience
Components xCore, xRouter, xControl
Applies to 4G, 5G · Local radio, Public radio · Single node, HA cluster, Geo-redundant
Duration About 3 h
Prerequisite procedures EXP-MOB-005 — Transition from the public radio network to the private radio
EXP-MOB-006 — Transition from the private radio to the public radio network

Objective. A UE crosses the boundary between the public radio network and the private radio repeatedly. Every transition results in exactly one new session on the destination Site, every earlier session is closed, and no session or context accumulates on either Site.

Preconditions

Procedure

# Where Action Expected result
1 — Execute EXP-MOB-005 — Transition from the public radio network to the private radio as a prerequisite procedure. As defined in EXP-MOB-005.
2 — Execute EXP-MOB-006 — Transition from the private radio to the public radio network as a prerequisite procedure. As defined in EXP-MOB-006.
3 UE Repeat the two transitions four more times (ten transitions in total), waiting for Connected on the destination Site each time. Every transition ends with the UE Connected on the destination Site.
4 xControl Open the Event Log section and select Session after the last transition, and wait for the implicit detach times of both Sites to elapse. Exactly ten session records exist for the transitions, alternating between the two Sites, and only the last one is Open.
5 CLI At both Sites, run read mme -f imsi=<imsi> (or read amf <imsi>) and read pgw -f imsi=<imsi> (or read smf -f imsi=<imsi>). Exactly one context and one session exist, at the Site the UE is currently on.

Pass criteria

  • Ten of ten transitions end with service on the destination Site.
  • After the implicit detach times, exactly one session is open and exactly one context exists for the IMSI across both Sites.

Evidence collected: xControl session event log; CLI output.
References: 3GPP TS 23.122 §4.4 (PLMN selection).