Interworking with N26

N26 interface is an inter-CN(Core Network) interface between the MME and 5GS AMF in order to enable interworking between EPC and the NG core. Support of N26 interface in the network is optional for interworking.

That second sentence is the one worth pausing on. Most interfaces in an architecture diagram are not optional. Remove N2 or N4 and the system simply stops working. N26 can be left out entirely and the network still runs. That raises the obvious question. What exactly do you lose by leaving it out ?

It helps to notice how different this is from an ordinary handover. Moving a UE between two gNBs is a move inside one system. Moving it between 5G and 4G is a move between two complete core networks, specified independently of each other. The NAS protocols are different. The identities are different. The security contexts are different. Something has to carry the subscriber across that gap.

3GPP allows two answers, and the choice between them is really what this page is about. Either the two cores talk to each other directly, which is what N26 is for. Or they do not, and the UE takes the job on itself by registering with both of them. The first is faster. The second needs no cooperation between the cores at all.

This was never an academic question, least of all in the early years of 5G. A network with patchy 5G coverage moves devices back and forth constantly. How smooth that feels is a large part of what people mean when they say a network feels good or bad. A move that takes tens of milliseconds passes unnoticed. One that takes a few seconds does not, particularly in the middle of a call.

One warning before the detail. The bit that tells a UE whether N26 exists is named for its absence rather than its presence. So a value of zero means the interface is there. That inversion catches almost everybody once, and it is covered in its own section below.

Features of N26 Interface
What actually crosses N26
With N26 and without N26
How to figure out N26 is supported ?
Single Registration Mode vs. Dual Registration Mode
How registration mode and N26 fit together
N26 Architectures

Features of N26 Interface

The short version first. N26 is a control plane interface between two core networks that were designed separately, several years apart. Its job is to let one of them hand a subscriber to the other without the subscriber noticing that anything happened.

Imporant features of N26 can be listed as below.

The N26 interface is an inter-Core Network interface between the 4G LTE's MME and the 5G core's 5GS AMF.
It facilitates interworking between 4G's EPC and 5G's NG core, especially for mobility between LTE-EPC and 5G-NR-5GS.
The interface ensures seamless continuity of voice services during inter-RAT handovers between LTE and 5G.
While optional, the presence of the N26 interface can reduce latency during Inter-RAT procedures.
The UE can operate in either Single Registration mode (one active MM state) or Dual Registration mode (independent registrations for 5GC and EPC).

What actually crosses N26

N26 is usually described as the interworking interface, which is true but leaves the interesting part out. The precise version is short. N26 carries the mobility management context between an MME and an AMF, and that is all it carries.

It runs GTPv2-C, and it reuses the procedures already defined for S10, the interface between two MMEs. From the MME's point of view an AMF on N26 behaves very much like another MME. That reuse was deliberate. It meant 3GPP could lean on a procedure the industry already had working, rather than inventing a new one for the occasion.

What N26 does not carry is the session. That is the part worth sitting with, because it explains how interworking can possibly work at all when N26 is absent.

Look at any of the three architecture figures further down this page and the same pattern appears in all of them. SMF and PGW-C are drawn in one box. UPF and PGW-U are drawn in one box. HSS and UDM are drawn in one box. Those are not two functions politely sharing a rectangle. Each is a single node presenting a 4G face and a 5G face.

So when a UE moves between the two systems, the anchor does not move with it. The PDU session and the IP address are already held by a node that both cores can talk to. Nothing about the session needs transferring, because nothing about the session is going anywhere.

That leaves the mobility context as the only thing that genuinely has to change hands. Which is exactly what N26 is for.

With N26 and without N26

If the session survives either way, it is fair to ask what N26 actually buys. The answer is speed.

	With N26	Without N26
The procedure	A handover. The two cores hand the UE between them.	A redirection. The UE is pointed at the other system and starts again.
Mobility context	Transferred over N26 before the UE arrives.	Not transferred. The UE registers on the target from scratch.
Security	Keys are derived from the transferred context, so there is no re-authentication.	Full authentication on the target.
IP address	Preserved, and the UE does not have to do anything to keep it.	Preserved, but only if the UE asks correctly. It has to request a session against the same anchor, with a handover indication.
Interruption	Tens to low hundreds of milliseconds.	Seconds.

Two things follow from that table, and they are worth stating plainly.

N26 is a continuity feature, not a connectivity feature : a network without it still moves UEs between 4G and 5G perfectly well. What it gives up is smoothness. That is why the interface is optional, and why plenty of networks have run without it.
Voice is where the difference is heard : a data session can absorb a second of interruption without anyone noticing. A voice call cannot. When a 5G network moves a call down to LTE, the speed of the move matters. It is the difference between a handover nobody notices and an audible gap.

How to figure out N26 is supported ?

A UE cannot guess this, and it matters to the UE because it changes how a move will feel. So the network has to say. And since the UE may be sitting on either side when it needs to know, the network has to say it twice, once in each system.

As mentioned above, the support of N26 is optional (not mandatory). So there might be some mechanism for Network to inform UE on whether it support N26 or not. In addition, N26 is related both to LTE core (MME) and NR Core (AMF) meaning that there should be such a notification mechanism on both LTE and NR signaling procedure.

In NR, this notification is done by Registration Accept message and in LTE it is done by Attach Accept message as indicated by following IE (Information Element)

NR : Registration Accept -> 5GS network feature support

Interworking without N26 interface indicator (IWK N26) (octet 3, bit 7)

This bit indicates whether interworking without N26 interface is supported

Bit 7

0 ---> Interworking without N26 interface not supported : N26 is supported

1 ---> Interworking without N26 interface supported : N26 is not supported

< Example >

Protocol discriminator = 0x7e (5GS Mobility Management)
Security header = 0x2 (Integrity protected and ciphered)
Auth code = 0xc93c7d52
Sequence number = 0x02
Protocol discriminator = 0x7e (5GS Mobility Management)
Security header = 0x0 (Plain 5GS NAS message, not security protected)
Message type = 0x42 (Registration accept)
5GS registration result = 0x09 (Emergency registered=0, NSSAA to be performed=0, SMS allowed=1, 3GPP access)
...
5GS network feature support:
  0x03 (MPSI=0, IWK N26=0, EMF=not supported, EMC=not supported, IMS-VoPS-N3GPP=1, IMS-VoPS-3GPP=1)
  0x00 (5G-UP CIoT=0, 5G-IPHC-CP CIoT=0, N3 data=0, 5G-CP CIoT=0,
          RestrictEC=both CE mode A and CE mode B are not restricted, MCSI=0, EMCN3=0)
...

LTE : Attach Accept -> EPS network feature support

Interworking without N26 interface indicator (IWK N26) (octet 4, bit 7)

This bit indicates whether the network supports interworking procedure without N26 interface.

Bit 7

0 ---> Interworking without N26 not supported : N26 is supported

1 ---> Interworking without N26 supported : N26 is not supported

< Example >

Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x2 (Integrity protected and ciphered)
Auth code = 0xa585b8bd
Sequence number = 0x01
Protocol discriminator = 0x7 (EPS Mobility Management)
Security header = 0x0 (Plain NAS message, not security protected)
Message type = 0x42 (Attach accept)
EPS attach result = 1 (EPS only)
....
EPS network feature support:
  0x01 (CP CIoT=0, ERw/oPDN=0, ESRPS=0, CS-LCS=0, EPC-LCS=0, EMC BS=0, IMS VoPS=1)
  0x08 (15 bearers=0, IWK N26=0, RestrictDCNR=0, RestrictEC=0, ePCO=1, HC-CP CIoT=0, S1-U data=0,
          UP CIoT=0)

Single Registration Mode vs. Dual Registration Mode

This is the other half of the interworking story, and it belongs to the UE rather than to the network. N26 decides whether the two cores are able to cooperate. Registration mode decides whether the UE needs them to.

Registration Mode refers to how a User Equipment (UE) manages its registration with the network. The registration mode determines the UE's ability to register with one or both of the 4G and 5G core networks simultaneously.

There are two primary registration modes:

Single Registration Mode:

The name describes the UE mobility state, not its radio. There is exactly one of them at a time, which is the way a phone naturally behaves anyway. This is also the mode that actually needs N26. When the UE arrives on the other side, its context has to come from somewhere. In single registration mode the UE is not the one carrying it. The cores are.

In this mode, the UE maintains only one active Mobility Management (MM) state at a time
The UE can be registered to either the 5G Core (5GC) or the 4G Evolved Packet Core (EPC), but not both simultaneously(there is only one active mobility state at any given time)
UE can be either in 5GC NAS mode or EPC NAS mode.
UE maps EPC-GUTI to 5G-GUTI during mobility between EPC and 5GC.
UE keeps 5G context for re-use when moving from 5GC to EPC
This means that if the UE is registered in the 5GC, it must deregister from the EPC, and vice versa.
It simplifies the registration process but may involve more steps when transitioning between 4G and 5G coverage areas.

Dual Registration Mode:

Here the UE stops waiting for the two cores to coordinate and does the job itself. It holds two complete contexts at once, one per core, and keeps them alive independently. This is the mode that makes N26 irrelevant, because nothing has to be handed over when the UE is already registered on both sides. The price is paid by the device. It is running two lots of mobility management, and at times keeping two radio connections up. Neither of those is free in power or complexity.

Here, the UE can handle independent registrations for both the 5GC and the EPC.
This allows the UE to be simultaneously registered to both the 5GC and the EPC (UE keeps independent registration for 5GC and EPC)
UE maintains 5G-GUTI and EPC-GUTI independently.
UE can perform 5GC or EPC re-registration/TAU using corresponding GUTIs.
The UE manages these registrations using separate Radio Resource Control (RRC) connections.
This mode facilitates smoother transitions between 4G and 5G networks, especially in areas where both network types are available.

How registration mode and N26 fit together

The two ideas above are usually explained separately, which hides the fact that they interact. Registration mode is a UE choice. N26 is a network property. Because they are decided by different parties, all four combinations exist.

UE registration mode	Network has N26	What happens on a move between 4G and 5G
Single registration	Yes	A handover style move, with the context carried across. This is the seamless case, and it is what most deployments are aiming at.
Single registration	No	The UE still moves, but it registers again on the target. Slower, and the UE has to ask for its IP address back. It works.
Dual registration	Yes	The UE holds both registrations and does not lean on N26. The interface is there, but this UE is not using it for its own mobility.
Dual registration	No	Exactly the same as the row above. Dual registration was designed for this case in the first place.

The bottom two rows are the interesting ones. A UE that holds both registrations does not need the two cores to talk to each other, because it is doing the coordination itself. It keeps two contexts, two GUTIs, and at times two RRC connections, and it pays for that in complexity and battery. What it gets in return is independence from whatever the operator did or did not deploy.

This is also why the IWK N26 bit matters to a UE. It is not idle information. A single registration UE reads that bit and learns whether a move will be a handover or a fresh start.

N26 Architectures

3GPP draws this architecture three times, once for each roaming case. They are worth reading as a set rather than one at a time. Most of what the three figures show is identical, and the differences between them are small and specific. Each one has a description above it, and a comparison of all three follows at the end.

< 23.501 - Figure 4.3.1-1: Non-roaming architecture for interworking between 5GS and EPC/E-UTRAN >

This is the baseline case, with everything inside one network. The 4G side runs down the left, with UE, E-UTRAN, MME and SGW. The 5G side runs down the right, with UE, NG-RAN and AMF. N26 is the horizontal line across the middle joining MME to AMF. It is the only line in the whole figure that connects the two cores directly to each other.

The rest of what matters is at the top. SMF and PGW-C share one rectangle. UPF and PGW-U share another. HSS and UDM share a third. Those three boxes are what the two halves of the picture have in common. They are the reason a session can survive a move between the halves.

< 23.501 - Figure 4.3.2-1: Local breakout roaming architecture for interworking between 5GS and EPC/E-UTRAN >

The same architecture, now with a roaming boundary drawn through it. The dashed line separates the home network above from the visited network below. In local breakout almost everything sits in the visited network, including SMF with PGW-C and UPF with PGW-U. Only HSS with UDM and the home PCF stay at home, with N24 joining the two PCFs across the boundary.

Now look at where N26 is. Both the MME and the AMF are below the dashed line, so N26 sits entirely inside the visited network. It does not cross the boundary, and it never does.

< 23.501 - Figure 4.3.2-2: Home-routed roaming architecture for interworking between 5GS and EPC/E-UTRAN >

The third case moves the anchor home. SMF with PGW-C and UPF with PGW-U are now above the dashed line, in the home network. The visited network gets its own v-SMF and v-UPF instead. The user plane reaches home over S8 on the 4G side and over N9 on the 5G side, with N16 joining the two SMFs.

This is the busiest of the three figures, but N26 has not moved at all. It is still one line between an MME and an AMF, and both of them are still in the visited network.

Those three figures are the same architecture drawn under three roaming assumptions. The most useful way to read them is to look for what does not change.

The combined nodes appear in all three : SMF with PGW-C, UPF with PGW-U, HSS with UDM. This is the mechanism described further up, and it is present whether the UE is at home or roaming.
N26 always sits between an MME and an AMF in the same PLMN : look at both roaming figures. Both ends sit inside the VPLMN. N26 never crosses the boundary between the visited and home networks. Interworking is a local matter between two cores, and roaming is dealt with separately, by where the anchor is placed.
What does change is where the anchor lives : local breakout keeps SMF and PGW-C in the visited network. Home routed moves them to the home network instead. It also adds a v-SMF and a v-UPF in the visited one. S8 then carries the 4G side, and N9 and N16 carry the 5G side.

The consequence is worth spelling out. Even in home routed roaming, the IP address survives a move between 4G and 5G. The anchor sitting in the home network is still one node with two faces. The path is longer and it crosses a PLMN boundary, but the principle is untouched.