LTE Redirection to NR SA

This tutorial is about how to configure for redirection from LTE to NR SA and how to verify it.

Cell Redirection a mechanism where UE can change the cell in Idle mode. The idle mode cell change happens in several different situations as listed below.  

• UE changes cell to another cell which has higher cell power with the same PLMN as the current cell. This is called Cell Reselection.
• UE changes cell to another cell which has higher priorities. This priorities may be configured in SIB or RRC Release message. This is called Cell Reselection.
• UE lost signal from the current cell and change to another cell with selectable cell. Strictly speaking this is more like a cell selection, but it can be considered as a type of reselection.
• UE first attached to a visiting PLMN and changes to another cell with Home PLMN and vice versa. . Strictly speaking this is called Roaming.
• UE attached to a cell and Network (eNB) explcitely direct UE to change to another cell via RRCConnectionRelease message. This is called Cell Redirection.

We suppot a few different use cases with a little bit different configurations as summarized below.

• case 1:  rrc_redirect. this is used when triggering a manual RRC release' using the rrc_cnx_release remote API or when the core network triggers a redirection procedure for emergency fallback
• case 2:  meas_config_desc: { nr_redirect:{} or eutra_redirect:{} }.  Redirection is triggered when the UE sends the event based measurement report
• case 3: meas_config_desc: { nr_redirect:{} or eutra_redirect:{} } + eps_fallback_fast_return_preferred_method: "redirection". This is applied when the eNB is aware of the source NR cell during the EPS fallback (thanks to NGAP/S1AP singalling) and the source NR cell is in the EUTRA neighbor cell list, then the RRC release message is automatically populated with the redirection to NR

Table of Contents

• LTE Redirection to NR SA
• Introduction
• Summary of the Tutorial
• Test Setup
• Key Configuration Parameters
• Configuration
• Perform the Test
• Log Analysis
• RRC / NAS Signaling
• RrcConnectionRelease

Introduction

Cellular network technologies such as Long Term Evolution (LTE) and New Radio Standalone (NR SA) form the backbone of modern mobile communications, enabling high-speed data transfer, low-latency connectivity, and seamless mobility for users. As the industry transitions from LTE to 5G NR SA, efficient mechanisms for inter-system mobility become essential to maintain service continuity and optimize user experience. One such critical mechanism is cell redirection, which allows a User Equipment (UE) operating in idle mode to transition from an LTE cell to an NR SA cell based on network-driven conditions, such as signal strength, cell priorities, or explicit commands from the network. Architecturally, this process relies on coordination between the evolved NodeB (eNB) in LTE and the gNodeB (gNB) in NR SA, utilizing signaling protocols and configuration parameters defined by 3GPP standards. The cell redirection procedure leverages both broadcast system information (e.g., System Information Blocks) and unicast signaling (e.g., RRC release) to guide the UE toward the target network. This capability is significant in the broader ecosystem as it underpins advanced features like service continuity, load balancing, emergency fallback, and roaming between operators or radio access technologies. By ensuring that UEs can be efficiently redirected to the most suitable cell, operators can maximize spectral efficiency and deliver robust, uninterrupted services as users move within and across coverage areas.

• Context of the Technology
  •   Cell redirection is a fundamental mobility management feature within the LTE and 5G NR architecture, supporting seamless transitions between access technologies.
  •   It is particularly relevant in heterogeneous network deployments where both LTE and NR SA cells coexist, enabling the network to optimize resource allocation and mobility strategies.
  •   The process leverages both network-side (eNB, gNB) and UE-side procedures, orchestrated through standardized signaling and configuration.
• Relevance and Importance of the Tutorial Topic
  •   As 5G NR deployments expand, understanding and configuring LTE-to-NR SA redirection is crucial for network engineers, integrators, and operators.
  •   Effective redirection ensures minimal service disruption, optimized use of network resources, and support for mission-critical applications such as emergency fallback and roaming.
  •   The tutorial addresses real-world scenarios, including manual and automatic redirection triggers as well as advanced cases like EPS fallback with fast return to NR.
• Learning Outcomes
  •   Gain a comprehensive understanding of the mechanisms and configurations involved in LTE to NR SA cell redirection.
  •   Learn how to verify and validate redirection procedures in a live or simulated environment.
  •   Become familiar with key concepts such as idle mode mobility, cell reselection versus redirection, measurement-based and signaling-based triggers, and integration with roaming and fallback procedures.
• Prerequisite Knowledge and Skills
  •   Familiarity with 3GPP LTE and 5G NR concepts, including network architecture and mobility management principles.
  •   Understanding of RRC procedures, system information configuration, and basic signaling flows between UE and network elements.
  •   Experience with radio network configuration, testing tools, and basic troubleshooting in cellular environments is recommended for practical exercises.

Summary of the Tutorial

This tutorial demonstrates the configuration and testing of LTE-to-NR idle mode redirection, focusing on low-layer procedures using Amarisoft equipment. It outlines the setup, configuration, test execution, and verification steps required to successfully redirect a UE from an LTE cell to a 5G NR cell based on measurement criteria.

• Test Setup:
  • The test uses a basic setup with a SIM card provided with the system and does not require complex IP configuration.
  • Ensure the SIM card is properly inserted and the UE is ready for LTE attachment.
• Key Configuration Parameters:
  • Essential parameters include ncell_list for neighbor cell setup, meas_config_desc for measurement events (such as a1, a2, a3, nr_b1), and meas_gap_config.
  • For NR redirection, nr_cell_redirect must be properly configured with the required thresholds and timers.
• Configuration Procedure:
  •   Use the enb-redir-sa.cfg file, based on gnb-nsa.cfg, as the primary configuration.
    • Set ALLOW_SA = 1 to permit NR idle mode operations like redirection.
    • Add an NR cell as a neighbor in the LTE cell configuration using ncell_list (e.g., {rat: "nr", cell_id: 2,}).
    • NR cell configuration is standard; for this test, FDD mode with band n5 is used.
    • Adjust inactivity_timer to prolong the RRC connection during power adjustments.
    • Include nr_cell_redirect in meas_config_desc to enable LTE-to-NR redirection when measurement criteria are met.
• Test Execution Steps:
  • Verify cell configurations to ensure correct setup.
  • Power on the UE and attach it to the LTE cell.
  • Adjust cell power as needed to satisfy redirection measurement conditions.
  • Observe the UE redirecting from LTE to the NR cell once the criteria are met, confirming the redirection in logs rather than direct CLI output.
• Log Analysis and Verification:
  • Check that both LTE and NR cells are broadcasting SIBs, confirming readiness for idle mode operation.
  • Review SIB1 from the NR cell for critical configuration parameters (e.g., ssb-PositionsInBurst, ssb-PeriodicityServingCell).
  • Ensure the eNB configures measurement objects and reports for NR cell detection in the RRC Connection Reconfiguration process.
  • Validate that measurement reporting (e.g., for eventB1-NR) is correctly triggered and that measGapConfig is enabled.
  • Once an appropriate measurement report is generated, confirm the eNB sends a connection release with NR redirection info and the UE begins RRC setup towards the NR cell.
  • Check that the UE initiates registration to the target NR cell's core network, including Tracking Area Update and subsequent registration steps.

Summary: The tutorial details a controlled method to configure, execute, and verify LTE-to-NR idle mode redirection. Key steps involve preparing the configuration files, ensuring correct neighbor and measurement settings, executing the test by manipulating cell power, and confirming success through log analysis. The process ensures that the UE is properly redirected to the NR cell based on defined measurement events and completes network registration procedures on the target cell.

Test Setup

Test setup for this tutorial is as shown below.  This is just for low layer testing, you may not need any complicated IP layer setup.

• SIM Card used in this tutorial is the one delivered with the system as it is.
• If you want to change the configuration, The tutorial Configuration Guide would help

Key Configuration Parameters

Followings are important configuration parameters for this tutorial. You may click on the items for the descriptions from Amarisoft documents.

• ncell_list : In this link, you would get the descriptions for all the items listed below
• rat
• cell_id
• meas_config_desc : In this link, you would get the descriptions for all the items listed below
• a1_report_type
• a1_rsrp
• a1_hysteresis
• a1_time_to_trigger
• a2_report_type
• a2_hysteresis
• a2_time_to_trigger
• a3_report_type
• a3_offset
• a3_hysteresis
• a3_time_to_trigger
• rsrp_filter_foeff
• nr_b1_report_type
• nr_b1_rsrp
• nr_b1_hysteresis
• nr_b1_time_to_trigger
• nr_rsrp_filter_coeff
• nr_cell_redirect : In this link, you would get the descriptions for all the items listed below
• b1_threshold_rsrp
• hysteresis
• time_to_trigger
• meas_gap_config

Configuration

I have used enb-redir-sa.cfg which is copied and modified from gnb-nsa.cfg.

I am using the default mme, ims config as shown below.

Following is the configuration in enb-redir-sa.cfg.  

In this configuration, the key setting is ALLOW_SA. It is set to 1, which allows SA NR operation in addition to NSA NR. This is important for LTE redirection to NR SA because the UE is first connected or camping on LTE, and then LTE releases the UE with redirection information toward an NR SA cell. For this to work, the NR cell must be allowed to operate in standalone mode and must be available for idle mode operation after the UE leaves LTE.

Other parameters define the basic NR cell configuration. NR_TDD is set to 1, so the NR cell uses TDD. FR2 is set to 0, so the NR cell is configured for FR1. NR_TDD_CONFIG is set to 2, which selects the FR1 TDD pattern compatible with the LTE TDD configuration. N_RB_DL is set to 100, which corresponds to 20 MHz LTE bandwidth in this configuration reference. N_ANTENNA_DL is set to 2, so the downlink uses 2x2 MIMO. TRX_MAX_BANDWIDTH is set to 100, allowing up to 100 MHz RF bandwidth when the SDR hardware supports it. NR_BANDWIDTH is set to 20, so the NR cell bandwidth is 20 MHz. NR_LONG_PUCCH_FORMAT is set to 2, and USE_SRS is set to 0, so periodic SRS is not enabled.

The most important point for this test is that ALLOW_SA = 1 enables the NR cell to be used as an SA target after LTE redirection. The other RF and PHY parameters, such as antenna count, bandwidth, and TDD configuration, can be adjusted depending on the test requirement and SDR capability.

In this part, the LTE cell is configured with an NR cell as a neighbour cell. This is done by adding ncell_list inside the LTE cell_list. In this example, the LTE cell has cell_id 0x01 and tac 0x0001. Under this LTE cell configuration, ncell_list includes one neighbour cell with rat set to nr and cell_id set to 2. This tells the LTE cell that there is an NR neighbour cell available, and this NR cell is the target cell for LTE-to-NR SA redirection.

The important point is that the NR cell is not configured as another LTE neighbour. It is explicitly defined with rat: nr. This allows the LTE cell to treat the neighbour as an NR cell and use it when sending redirection information to the UE. When the UE is released from LTE, the LTE cell can point the UE toward this NR cell. Then the UE can leave LTE idle mode operation and try to camp on the NR SA cell identified by cell_id 2.

In this test, ncell_list works as the link between the LTE serving cell and the NR SA target cell. Without this neighbour cell definition, the LTE cell would not know which NR cell should be used for redirection.

For the NR cell, no special redirection-specific configuration is required. You can configure it like a normal NR SA cell. In this test, the NR cell is defined under nr_cell_list with rf_port set to 1 and cell_id set to 0x02. This cell_id matches the NR neighbour cell_id 2 that was added in the LTE ncell_list, so the LTE cell can redirect the UE to this NR cell.

The PLMN is configured as 00101 with TAC 100, and reserved is set to false. This means the NR cell is available for normal UE camping. Since ALLOW_SA is enabled, this NR cell can operate as an SA cell and can be used after the UE is released from LTE with NR redirection information.

In this example, the active NR configuration is FDD band 5. The NR downlink ARFCN is set to 176300, which corresponds to 881.5 MHz. The subcarrier spacing is set to 30 kHz, and ssb_pos_bitmap is set to 1000. These values define the basic NR cell frequency and SSB transmission condition. The important point is that the NR cell only needs to be a valid SA-capable NR cell. The actual band, bandwidth, antenna configuration, and SSB setting can be changed depending on the test requirement and available SDR hardware.

In this part, inactivity_timer is increased to 180000 ms. This is not the mandatory setting for LTE to NR SA redirection itself, but it is useful for the test. With this large value, the eNB keeps the RRC connection for a long time even when there is no user traffic. This gives enough time to adjust LTE or NR cell power and observe the measurement behavior without the UE being released too early by normal inactivity.

The important configuration for this test is nr_cell_redirect inside meas_config_desc. This setting defines the measurement condition that can trigger redirection from the LTE cell to the NR cell. In this example, dl_threshold_rsrp is set to -120, hysteresis is set to 0, and time_to_trigger is set to 100. These values make the condition very relaxed, so the UE can satisfy the NR measurement condition easily and send the measurement report without requiring a strong NR signal condition.

The rest of meas_config_desc defines the general LTE and NR measurement behavior. A1, A2, and A3 parameters are configured for LTE measurement events, and nr_b1 parameters are configured for NR B1 measurement reporting. rsrp_filter_coeff and nr_rsrp_filter_coeff are both set to 3, so RSRP filtering is applied before evaluation. meas_gap_config is set to gp0, which allows the UE to measure inter-RAT NR cells while it is connected to LTE.

In this test, nr_cell_redirect is the key part that connects the LTE measurement result to the redirection action. Once the UE reports that the NR cell satisfies the configured threshold condition, the LTE cell can release the UE with redirection information toward the configured NR SA neighbour cell.

Perform the Test

Perform the test and first check whether both LTE and NR cells are configured as intended. In this example, the cell phy command shows two active cells. Cell 0x001 is the LTE cell on band 1 with 20 MHz bandwidth, DL ARFCN 300, 2 DL antennas, 15 kHz subcarrier spacing, and 256QAM enabled. This is the serving LTE cell where the UE initially connects.

Cell 0x002 is the NR cell on band n78 with 20 MHz bandwidth, DL ARFCN 632628, 2 DL antennas, 30 kHz subcarrier spacing, and 256QAM enabled. The SSB ARFCN is shown as 632544 with 30 kHz SCS. This confirms that the NR cell is running and broadcasting SSB properly.

The important point is that the LTE cell and NR cell are both present in the same system. The LTE cell is the source cell for redirection, and the NR cell is the SA target cell. Before starting the UE test, this output should be checked to confirm that the LTE source cell and NR target cell match the configuration values used in cell_list, ncell_list, and nr_cell_list.

Power on the UE and let it attach to the LTE cell first. In the trace output, the first PRACH appears on cell 0x001 with seq 8, ta 2, and snr 16.7 dB. After that, the UE is shown under cell 001 with RNTI 003d. This means the UE is initially connected to the LTE cell as expected.

After the redirection condition is met, another PRACH appears on cell 0x002 with seq 2, ta 5, and snr 16.1 dB. Then the UE appears under cell 002 with RNTI 4601. This indicates that the UE has moved from the LTE cell to the NR cell and is now connected on the NR side. In this test, cell 001 is the LTE source cell and cell 002 is the NR SA target cell, so this confirms the overall redirection result at a high level.

However, the t command only shows the final radio activity and current cell association. It does not show the detailed RRC procedure, such as LTE MeasurementReport, RRCConnectionRelease with redirectedCarrierInfo, NR cell search, NR RRCSetup, and NR registration procedure. So this screen is useful to confirm that the UE started from LTE and later appeared on NR, but the exact LTE-to-NR redirection signaling should be verified from the captured log.

Log Analysis

In log analysis, first confirm that both LTE and NR cells are broadcasting SIBs. In this capture, SIB1 and SIB messages are seen from cell 1 and cell 2. Cell 1 is the LTE cell, and cell 2 is the NR cell. This confirms that both cells are active and broadcasting the required system information.

This check is important because LTE-to-NR SA redirection is an idle mode based movement after LTE release. The UE must be able to read the target NR cell system information after it leaves LTE. If the NR cell is not broadcasting SIB properly, the UE may receive the redirection command from LTE, but it may fail to camp on the NR cell afterward.

In this log, the LTE cell first broadcasts its SIBs, and the NR cell also broadcasts SIB1 on BCCH-NR. This means the source LTE cell is ready to serve the UE, and the target NR SA cell is also ready for camping. After this confirmation, the next part of the log can be used to check the UE attach on LTE, the LTE measurement configuration, the measurement report, and the final RRC release with NR redirection information.

Check SIB1 of the NR cell and confirm that the important broadcast parameters are configured as intended. In this log, the selected message is SIB1 from cell 2 on BCCH-NR, which means this is the SIB1 of the NR target cell. This is important because after LTE releases the UE with NR redirection information, the UE must read NR SIB1 to confirm whether the NR cell is suitable for camping and further registration.

In this SIB1, ssb-PositionsInBurst is shown with inOneGroup set to 80. This indicates the configured SSB position bitmap for the NR cell. ssb-PeriodicityServingCell is set to ms20, so the NR cell transmits SSB with a 20 ms periodicity. This should match the intended NR cell configuration and the UE expectation during NR cell search.

The TDD-UL-DL-ConfigurationCommon is also shown in SIB1. It uses referenceSubcarrierSpacing kHz30 and pattern1 with dl-UL-TransmissionPeriodicity ms5. It also shows nrofDownlinkSlots 7, nrofDownlinkSymbols 6, nrofUplinkSlots 2, and nrofUplinkSymbols 4. These values define the NR TDD common slot pattern broadcast to the UE. Even though this test is focused on LTE-to-NR SA redirection, the NR cell still has to broadcast a valid SIB1 so the UE can camp on it after redirection.

This step confirms that the NR target cell is not only running, but also broadcasting the expected SIB1 parameters. If the UE receives LTE redirection but fails to camp on NR, this SIB1 check is one of the first places to verify, especially SSB position, SSB periodicity, subcarrier spacing, and common UL/DL configuration.

Make sure the eNB sends measurement configuration in RRC Connection Reconfiguration so that the UE can detect the target NR cell while it is still connected to LTE. In this log, the selected message is RRC connection reconfiguration on LTE DCCH. This message includes measConfig, which tells the UE what cell to measure, how to measure it, and what event should trigger a measurement report.

In measObjectToAddModList, measObjectId 1 is configured as measObjectEUTRA. This is for LTE measurement. It shows carrierFreq 300, allowedMeasBandwidth mbw100, presenceAntennaPort1 TRUE, and neighCellConfig 01. This part is for LTE neighbour measurement and is not the main target of LTE-to-NR SA redirection.

The important part is measObjectId 2, which is configured as measObjectNR. This tells the UE that it also needs to measure an NR cell. In this example, carrierFreq-r15 is set to 632544, which is the NR SSB ARFCN of the target NR cell. rs-ConfigSSB-r15 is configured with measTimingConfig, including periodicityAndOffset-r15 sf20-r15 0 and ssb-Duration-r15 sf1. subcarrierSpacingSSB-r15 is set to kHz30. quantityConfigSet-r15 is set to 1, and bandNR-r15 is set to 78.

This confirms that the LTE eNB is giving the UE the correct NR measurement object. The UE now knows that it should search for the NR SSB on ARFCN 632544, using 30 kHz SSB subcarrier spacing, on NR band n78. This is the key preparation step before the UE can report NR measurement and before LTE can release the UE with NR redirection information.

Then check reportConfigToAddModList and confirm that the measurement report events are configured as intended. In this RRC Connection Reconfiguration, reportConfigId 1 and reportConfigId 2 are configured for EUTRA measurement events. reportConfigId 1 uses eventA1 with a1-Threshold threshold-RSRP 20, hysteresis 10, and timeToTrigger ms320. reportConfigId 2 uses eventA2 with a2-Threshold threshold-RSRP 90, hysteresis 0, and timeToTrigger ms640. These LTE events are part of the general LTE measurement configuration.

The important part for LTE to NR SA redirection is reportConfigId 3. This is configured as reportConfigInterRAT, and the triggerType is eventB1-NR-r15. This means the UE should generate a measurement report when the detected NR cell becomes better than the configured B1 threshold. In this example, b1-ThresholdNR-r15 is configured with nr-RSRP-r15 36, hysteresis is 0, and timeToTrigger is ms100. reportOnLeave is set to FALSE, so the UE reports when the entering condition is met, not when leaving the condition.

This configuration makes the UE monitor the NR target cell and report it to LTE when the NR RSRP condition is satisfied. maxReportCells is set to 8, reportInterval is ms120, and reportAmount is r1. reportQuantityCellNR-r15 includes ss-rsrp TRUE, ss-rsrq TRUE, and ss-sinr TRUE, so the UE can include NR SS-based RSRP, RSRQ, and SINR measurement results in the report.

This step confirms that the LTE eNB is not only telling the UE which NR frequency to measure, but also defining the exact reporting condition. For this test, eventB1-NR is the key event. Once the UE detects the NR cell and the B1 condition is met, it can send a Measurement Report to LTE. Then the eNB can proceed with LTE RRC release and redirect the UE to the NR SA cell.

Lastly, check measIdToAddModList and confirm that the NR measurement object and NR report configuration are actually linked together. In this log, measId 2 links measObjectId 1 with reportConfigId 1. This is for LTE measurement. The important part is measId 3, which links measObjectId 2 with reportConfigId 3.

This means the UE should use measObjectId 2 as the NR measurement object and reportConfigId 3 as the NR reporting rule. In the previous configuration, measObjectId 2 defined the NR target frequency, band, SSB ARFCN, and SSB subcarrier spacing. reportConfigId 3 defined the inter-RAT eventB1-NR condition. By linking them with measId 3, the eNB tells the UE to measure the configured NR cell and send a Measurement Report when the B1-NR condition is satisfied.

This step is important because measObject and reportConfig alone are not enough. The UE needs measIdToAddModList to know which measurement object should use which reporting condition. In this test, measId 3 confirms that the LTE eNB has correctly connected the NR target cell measurement with the eventB1-NR reporting trigger. After this, the UE can detect the NR cell, evaluate the B1-NR threshold, and send the NR measurement report back to LTE.

Make sure that measGapConfig is enabled in the RRC Connection Reconfiguration. This is important because the UE is connected to LTE, but it needs time gaps to measure the inter-RAT NR cell. Without a measurement gap, the UE may not be able to properly search the NR SSB while maintaining LTE connection.

In this log, measGapConfig is configured as setup, and gapOffset is set to gp0 with value 16. This confirms that the LTE eNB explicitly enabled measurement gap for the UE. With this setting, the UE is allowed to temporarily stop LTE transmission or reception during the configured gap timing and perform NR measurement on the target NR frequency.

This step is especially important for LTE-to-NR SA redirection because the UE must detect the NR cell before the LTE eNB can receive the NR measurement report. The NR measurement object and eventB1-NR reporting rule define what to measure and when to report, but measGapConfig gives the UE the actual measurement opportunity. So this confirms that the UE has enough measurement gap support to detect the NR cell and trigger the NR measurement report.

If the measurement configuration is correct and the NR cell power is within the expected range, the UE should send a Measurement Report for the NR cell. In this log, the UE sends Measurement report on LTE DCCH before the RRC connection release. This confirms that the UE detected the target NR cell while it was still connected to LTE.

Inside the Measurement Report, measId is 3. This matches the earlier measIdToAddModList configuration where measId 3 links the NR measurement object with the eventB1-NR report configuration. This means the report is for the NR measurement condition, not just normal LTE measurement.

The serving LTE cell measurement is shown under measResultPCell. In this example, the LTE serving cell has rsrpResult 56 and rsrqResult 27. The NR neighbour measurement is shown under measResultNeighCells using measResultNeighCellListNR-r15. The reported NR cell has pci-r15 500, rsrpResult-r15 75, rsrqResult-r15 65, and rs-sinr-Result-r15 93. This confirms that the UE successfully measured the NR target cell and reported SS-RSRP, SS-RSRQ, and SS-SINR to the LTE eNB.

This is a key checkpoint in the LTE-to-NR SA redirection test. If this Measurement Report is not seen, the redirection procedure may not continue. In that case, first check whether measObjectNR, eventB1-NR, measId mapping, and measGapConfig are correctly configured. Then adjust the LTE and NR cell power so that the UE can detect the NR SSB and satisfy the B1-NR threshold condition. Once this report is received, the eNB can proceed with RRC connection release and redirect the UE toward the NR SA cell.

Once the expected NR measurement report is received, the eNB sends RRCConnectionRelease to release the UE from LTE and redirect it toward the NR SA cell. In this log, RRC connection release is sent on LTE DCCH after the Measurement report. This confirms that the LTE eNB accepted the NR measurement result and decided to release the LTE RRC connection with redirection information.

The important IE is redirectedCarrierInfo. In this example, redirectedCarrierInfo is set to nr-r15, so this is not LTE-to-LTE redirection. It is LTE-to-NR redirection. The target NR frequency is given by carrierFreq-r15 632544. This matches the NR SSB ARFCN configured in the NR measurement object and also matches the SSB ARFCN of the target NR cell. subcarrierSpacingSSB-r15 is set to kHz30, so the UE knows that it should search the NR SSB using 30 kHz SSB subcarrier spacing.

The smtc-r15 information is also included. periodicityAndOffset-r15 is sf20-r15 0, and ssb-Duration-r15 is sf1. This gives the UE the timing information for searching the target NR SSB after leaving LTE. With these parameters, the UE can quickly search the NR cell instead of doing a blind search over a wide range.

This is the main redirection command in the LTE-to-NR SA procedure. The UE is not handed over directly to NR in connected mode. Instead, LTE releases the RRC connection and provides NR carrier information. After receiving this message, the UE leaves LTE, searches the indicated NR SSB on ARFCN 632544 with 30 kHz SCS, camps on the NR SA cell, and then starts the NR access procedure.

After the UE receives RRCConnectionRelease with NR redirectedCarrierInfo, check that the UE starts access on the target NR cell. In this log, the UE sends RRC setup request on CCCH-NR with cell 2. This confirms that the UE has left LTE, searched the redirected NR carrier, found the NR cell, and started the NR RRC connection procedure.

The selected message is RRC setup request, and the cell column shows 2. This is the target NR cell that was configured earlier as the LTE neighbour cell and also used in redirectedCarrierInfo. The message is carried on CCCH-NR, so this is clearly an NR-side RRC access attempt, not another LTE procedure.

Inside the RRC setup request, establishmentCause is set to mo-Signalling. This means the UE is initiating the NR RRC connection for signalling, typically to continue with 5G registration after camping on the NR SA cell. Right after this message, the log shows RRC setup, Registration request, RRC setup complete, authentication, and security procedure on the NR side. This confirms that the redirection did not stop at cell reselection only. The UE successfully proceeded into NR SA access and 5GC registration procedure.

This is the final confirmation point for LTE-to-NR SA redirection. The LTE part released the UE with NR carrier information, and the NR part shows that the UE triggered RRC setup request on the target NR cell.

After the UE triggers RRC setup on the target NR cell, it is expected that the UE starts 5G registration with the core network of the NR cell. In this log, Registration request is shown on 5GMM after the NR RRC setup request and RRC setup. This confirms that the UE is no longer just redirected at the radio level. It has started the NR SA registration procedure toward the 5GC.

The selected message is Registration request. The message type is 0x41, which indicates Registration request, and the 5GS registration type is mobility registration updating. This means the UE is trying to register on the 5G system after moving from LTE to the NR SA target cell. The log also shows 5G-GUTI and security capability information, which are normal parts of the NAS registration procedure.

This step confirms that the LTE-to-NR SA redirection has successfully progressed into NR SA core network registration. The LTE eNB released the UE with NR redirectedCarrierInfo, the UE accessed the NR cell with RRC setup request, and then the UE sent Registration request to the MME/5GC side for the target NR cell. After this, the expected next steps are authentication, security mode command, security mode complete, and completion of the 5G registration procedure.

After the UE starts the NR SA registration procedure, the UE may also include an EPS NAS message container inside the Registration request. In this log, the Registration request contains an EPS NAS message container, and inside that container the message type is Tracking area update request. This shows that the UE is also updating its EPS mobility context while moving from LTE toward the NR SA target cell.

The Tracking area update request is shown with EPS update type set to TA updating. The old GUTI information is also included, such as MCC 001, MNC 01, MME Group ID, MME Code, and M-TMSI. This is normal when the UE already has LTE/EPS context and then moves through LTE redirection into the NR SA side. The UE provides its previous EPS identity and mobility information so the network can continue the mobility and registration handling properly.

This step confirms that the redirection procedure has moved beyond the radio access stage. The UE already received LTE RRC release with NR redirectedCarrierInfo, accessed the NR target cell with RRC setup request, and sent the 5G Registration request. The embedded Tracking area update request then helps the network continue the remaining registration and mobility update procedure for the target cell. After this, the expected log flow continues with authentication, security mode command, security mode complete, and the rest of the registration completion process on the NR SA side.

RRC / NAS Signaling

RrcConnectionRelease

: This is the RrcConnectionRelease message sent by eNB  to trigger the redirection. (NOTE : You would see some IEs that has a specific assigned vale here, but consider it as just an example value. Those values should vary depending on test requirement)

{

  message c1: rrcConnectionRelease: {

    rrc-TransactionIdentifier 0,

    criticalExtensions c1: rrcConnectionRelease-r8: {

      releaseCause other,

      redirectedCarrierInfo nr-r15: {

        carrierFreq-r15  632544,

        subcarrierSpacingSSB-r15 kHz30,

        smtc-r15 {

           periodicityAndOffset-r15  sf20-r15: 0,

           ssb-Duration-r15 sf1

        }

    }

  }

}