EPS ↔ 5GS Interworking (N26) in 5G NR

Introduction

5GS ↔ EPS interworking is how a phone moves between a 5G Standalone core and a 4G core without dropping its session or changing its IP address. It is not a niche feature: for the whole multi-year period where 5G coverage is a patchwork inside mature LTE, a UE crosses the boundary constantly, and — because many early SA networks do not carry voice on NR everywhere — nearly every voice call triggers a move to LTE via EPS fallback. Interworking is therefore one of the most exercised mobility procedures in a real deployment.

The mechanism has two halves that must both be present. The N26 interface (AMF↔MME) carries the UE's mobility-management context across the system boundary, and a shared user-plane anchor (combined SMF+PGW-C / UPF+PGW-U) holds the session and IP address still while the access changes underneath. Neither alone gives seamless continuity.

This page walks the connected-mode 5GS→EPS handover with N26 message by message, then covers idle-mode mobility both ways and the everyday EPS-fallback-for-voice case. It is grounded in TS 23.501/23.502 (5GS) and TS 23.401 (EPS).

Call Flow — 5GS → EPS Connected-Mode Handover with N26

Read the flow in three beats. First the source NR side decides to move: the UE reports an E-UTRAN neighbour and the gNB asks the AMF to relocate. Second the two cores talk over N26: the AMF hands the context to the MME with Forward Relocation Request, the MME prepares the target eNB, and the answer comes back. Third the UE is commanded across to E-UTRA, does RACH on the target, and the completion is signalled back up the chain while the session is switched at the shared anchor.

Notice the pattern is deliberately the inter-MME handover shape, extended across the system boundary. Handover Required and Handover Command are the NGAP messages on the NR side; Handover Request / Handover Request Acknowledge are the S1AP messages the MME uses to prepare the target eNB; and the three Forward Relocation messages over N26 are what tie the two together, just as they would tie two MMEs together over S10 inside EPS. The UE itself is commanded off NR by MobilityFromNRCommand (which carries the target E-UTRA configuration), synchronises to the eNB with RACH, and confirms with RRCConnectionReconfigurationComplete. The final Forward Relocation Complete lets the AMF release the NR-side resources.

Message-by-message breakdown

A cross-system handover fails in one of three places: the source NR decision, the N26 context transfer, or the target E-UTRA execution. Walk the messages in order and the first one missing tells you which core to look in.

Steps 1–2 — Measurement report and Handover Required

The UE reports an E-UTRAN neighbour (a configured inter-RAT B2/B1 event); the gNB decides to relocate and sends the NGAP Handover Required to the AMF, naming the target eNB/TAI and the source-to-target transparent container.

Steps 3–6 — N26 context transfer and target preparation

The AMF maps the 5GS context to an EPS MM context and sends Forward Relocation Request over N26 to the MME. The MME prepares the target eNB with S1AP Handover Request, gets Handover Request Acknowledge, and returns Forward Relocation Response to the AMF.

Steps 7–9 — Command the UE across and RACH on the target

The AMF sends NGAP Handover Command to the gNB, which sends the RRC MobilityFromNRCommand to the UE with the target E-UTRA configuration. The UE tunes to the eNB, performs RACH, and confirms with RRCConnectionReconfigurationComplete.

Steps 10–11 — Completion and session switch at the anchor

The eNB sends Handover Notify to the MME; the MME sends Forward Relocation Complete to the AMF (which releases NR resources). The shared SMF+PGW-C / UPF+PGW-U switches the session's DL path to the EPS side, preserving the IP address.

Representative core trace (5GS→EPS handover over N26) — illustrative, values vary by vendor/build:

Why 5GS ― EPS Interworking Is Needed

Two forces make interworking mandatory rather than optional. First, coverage: 5G NR — especially mid-band and mmWave — has smaller cells and patchier reach than mature LTE, so a UE constantly crosses the boundary. Second, voice: many early 5G SA deployments do not carry voice on NR everywhere, so an IMS voice call set up on 5G is often pushed down to LTE as VoLTE — the mechanism known as EPS fallback. In both cases the goal is the same: move the UE between systems while preserving session continuity and the IP address, so applications never notice.

The N26 Interface and the Shared Anchors

The N26 interface runs directly between the AMF (5GS) and the MME (EPS). It is the inter-system analogue of the S10 interface that connects two MMEs inside EPS, and it uses the same GTP-C based Forward Relocation family of messages. Its job is to move the UE's mobility-management context — identities, security context, the list of active sessions/bearers and their QoS — from the source system's control node to the target's, so the target can bring the UE up without re-authenticating from scratch or losing session state.

Deploying N26 is what enables single-registration mode: the UE maintains exactly one active MM registration at a time (either 5GS or EPS), and the network guarantees continuity across the switch. This is the mode that delivers true seamless handover, IP-address preservation and low interruption.

The second half of the trick is on the user plane. For interworking, the session is anchored at nodes that belong to both worlds simultaneously:

• Combined SMF+PGW-C — a single control-plane function that acts as the SMF toward 5GS and as the PGW-C toward EPS. Because one function owns the session in both roles, it keeps the session context, the assigned IP address and the policy/charging state consistent as the UE moves.
• Combined UPF+PGW-U — the matching user-plane anchor. It is the IP point of presence for the PDU session (5GS) and the PDN connection (EPS) at once. Because the anchor does not move during interworking, the IP address is preserved and downlink packets keep arriving at the same node, which simply re-points them at the new access.

With N26 vs Without N26

Interworking can be supported without N26, but the experience is different. Without the interface there is no context transfer between cores, so the UE runs in dual-registration mode: it registers independently in each system and manages the move itself, re-establishing sessions on the target side. With N26 it runs in single-registration mode and the network handles continuity.

The presence of N26 is signalled to the UE via the interworking indication so it knows whether to operate in single- or dual-registration mode. Whether this counts as SA or an NSA-style arrangement is a separate question — interworking is about moving between two independent cores, not about dual connectivity within one.

Idle-Mode Mobility Both Ways

In idle mode there is no connection to hand over, so the move happens by cell reselection and is finalised by an update procedure in the target system, which pulls the context over N26.

• 5GS → EPS (idle). The idle UE reselects an E-UTRAN cell and performs a Tracking Area Update in EPS. The MME reads the mapped identity, recognises the UE came from 5GS, and pulls the UE's context from the AMF over N26 (a Context Request / Context Response style exchange). The PDN connections are re-created toward the shared SMF+PGW-C, and the UE keeps its IP address.
• EPS → 5GS (idle). The idle UE reselects an NR cell and performs a Mobility Registration Update in 5GS. The AMF pulls the UE's context from the MME over N26, maps the EPS bearers to 5GS QoS flows/PDU sessions at the shared anchor, and the UE resumes on NR with the same IP address.

EPS Fallback for Voice

The most common everyday use of interworking is not data mobility at all — it is voice. In 5G SA an IMS voice call is normally carried as VoNR over NR. But when the UE is in NR coverage that the operator has not enabled for voice (or where voice quality on NR is judged inadequate), the network chooses EPS fallback: at the moment the IMS session is being set up, the gNB triggers a handover or an RRC redirection of the UE to E-UTRAN, and the call is completed as VoLTE in EPS.

When the IMS signalling indicates a voice media resource is being established, the gNB either performs an inter-system handover to LTE (the connected-mode flow above) or redirects the UE to E-UTRAN, after which the call proceeds over the LTE dedicated bearer. Because the session is anchored at the shared SMF+PGW-C / UPF+PGW-U, the IMS session and its IP address survive the move, so from the user's point of view the call simply connects — on LTE.

Summary

Two things must be true for a UE to cross between 5GS and EPS without noticing: the context has to move and the session has to stay put. N26 moves the MM context (AMF↔MME, via Forward Relocation) so the target core adopts the UE without a full re-attach; the shared SMF+PGW-C / UPF+PGW-U anchor keeps the IP address and DL path anchored while the access changes. With both you get single-registration mode and seamless, connected-mode handover; without N26 you fall back to dual-registration, reselection/redirection, and higher interruption.

When debugging, split the flow into three zones and find the first that breaks: the source NR decision (inter-RAT measurement + Handover Required), the N26 transfer and target prep (Forward Relocation + S1AP Handover Request, plus QoS-flow→EPS-bearer mapping), and the target execution (MobilityFromNRCommand, RACH on the eNB, completion). Remember the classic silent failure: a handover that "succeeds" on signalling but drops user data usually means the session was not switched at a genuinely shared anchor, so the IP path never followed the UE. And keep the everyday case in mind — most real interworking events are EPS fallback for voice, decided during IMS setup, not a data-driven move.

Quick Q&A