N26 Interface: How 4G-to-5G Handover Stays Seamless

Two cores, one subscriber

Every operator migrating to 5G standalone lands in the same place. You no longer have one core — you have two. An EPC runs your LTE blanket, and a new 5GC lights up standalone islands inside it. But there is still one subscriber, one device, walking back and forth across that boundary all day.

SA does not arrive as a clean nationwide layer. It arrives as 5GS islands — NG-RAN plus 5GC — embedded inside your existing EPS coverage of E-UTRAN plus EPC. A connected UE crosses the edge of an island constantly, in both directions. Interworking is the set of rules that decides whether each crossing is a seamless move or a drop-and-reattach.

If you came up through LTE, you already have the right instinct: this is the same problem as inter-MME mobility, just stretched across two core generations. The whole thing hinges on one wire — the N26 interface — the two interworking modes built on top of it, and the mapping work underneath that makes any of it possible.

The wire between the cores

Picture the two cores side by side. On the EPC side, the MME holds the UE's mobility and session state. On the 5GC side, the AMF holds the equivalent. Between them sits N26, the interface between the AMF and the MME, defined in TS 23.501 §5.17.

Underneath, N26 runs GTP-C — the same control-plane family you already debug on S10 and S11 (TS 29.274). That is not a coincidence. Functionally, N26 is the S10 of the migration era: S10 connected two MMEs so a connected UE could move between them as a handover; N26 connects an AMF and an MME and does the same job across two core generations. If you have ever traced an S10 Forward Relocation Request, you already know the shape of what N26 carries.

It carries two things, and both are the point:

• MM and SM context — transferred directly between the AMF and the MME so the UE's mobility- and session-management state survives the move.
• Security context, mapped across the boundary — native on one side, derived-and-mapped on the other, so the UE does not have to fully re-authenticate just to keep the session it already had.

That is the entire reason N26 exists: continuity. Without it, there is no path for that context to cross, and the move starts from scratch on the far side. The split between EPC and 5GC is exactly what N26 reaches across.

Two ways to interwork

The spec gives you two interworking models, and the dividing line is whether N26 is deployed (TS 23.501 §5.17.2).

Interworking with N26 is the seamless model — formally, single-registration mode with N26. The networks coordinate directly: the UE keeps exactly one registration, and when it crosses the boundary the cores move its context over N26. Because that context transfer exists, you get both capabilities — idle-mode mobility (the UE moves and registers on the target, which fetches context) and connected-mode handover (a UE in an active session gets a true inter-system handover with session continuity). This is the mode operators deploy when they care about continuity, and it is the foundation EPS Fallback for voice leans on. Interworking without N26 is everything else, and it splits two ways:

• Single-registration without N26 — the UE still holds one registration, but with no core-to-core wire, the network leans on UE-provided information and re-establishment on the target side.
• Dual-registration mode — the UE registers independently in both systems, holding a 5G-GUTI and an EPS GUTI at the same time, and manages the move itself by re-registering as it crosses.

Either way there is no direct core-to-core context transfer, so both are slower and less seamless than the N26 path.

Put the capability split in a table, because this is the one you get quizzed on in design reviews.

Read the middle row carefully — it is where LTE intuition gets you into trouble. Idle-mode mobility works either way; an idle UE can always re-register on the target and the network sorts out context. The difference is connected mode. With N26, a busy UE gets a seamless inter-system handover. Without N26, there is no inter-system handover at all: the network releases the RRC connection and redirects the UE to a carrier on the other RAT, where it re-establishes. For background data that interruption is tolerable. For a live voice call, that gap is the difference between a seamless call and a dropped one.

The mapping work underneath

None of this is free. Interworking is hard — and is where most of the real engineering effort goes — because EPS and 5GS describe the same subscriber with different objects, and N26 only works if you can translate cleanly between them. Several mappings happen at once on every crossing.

The bearer model itself differs. EPS is bearer-based: a PDN connection carries one or more EPS bearers, each with a QCI and its own filters. 5GS is flow-based: a PDU session carries QoS flows, each marked with a 5QI. So the network maps a PDN connection onto a PDU session and back, and translates each EPS bearer / QCI into the equivalent QoS flow / 5QI and the reverse, so the data path keeps its treatment across the move. The standardized 5QI-to-QCI relationships exist precisely so this mapping is deterministic rather than guesswork.

Identities map too. The GUTI the UE held in EPS maps to a 5G-GUTI in 5GS, so the target core recognises the UE it is receiving rather than treating it as brand new. And the security context is mapped rather than re-derived: the spec's native-versus-mapped distinction (TS 24.501) is exactly this — a context that was native in one system arrives as a mapped context in the other, letting the UE keep its session without a full re-authentication.

This is the non-trivial part, and it is worth being honest about: most interworking trouble tickets are not "N26 is down." They are a QoS flow that did not map to the right bearer, or a 5QI with no agreed QCI counterpart — so the session technically survives the handover but the treatment does not. When you plan interworking, the mapping table is as load-bearing as the interface itself. If you want to build that mapping model hands-on, you can start a free 7-day trial — no credit card.

Idle versus connected — keep them separate

LTE engineers instinctively lump "mobility" together, but interworking forces a clean split, and the two cases use different machinery.

The idle case is mobility and registration. An idle UE reselects to the other system and performs a Tracking Area Update (entering EPS) or a Registration procedure (entering 5GS), carrying its mapped identities so the target core can pull or rebuild context (TS 23.502 §4.11). This works with or without N26 — with N26 the target fetches context over the wire; without it the UE supplies what it can and re-establishes. An idle UE has the luxury of time, so it can tolerate the extra signalling.

The connected case is a handover, and this is where N26 becomes non-negotiable. A UE with an active session can only be moved as a true inter-system handover if the cores can transfer its context in real time — exactly what N26 provides (TS 23.502 §4.11.1). Take the wire away and the connected case collapses into the idle machinery: release and redirect, then re-establish on the other side. Same UE, very different user experience.

That is the one-line tie-in to voice. When an SA cell cannot provide VoNR, the voice attempt triggers EPS Fallback — the UE is moved to LTE and the call completes as VoLTE — and the quality of that fallback rides directly on solid N26-based interworking underneath it.

The LTE-engineer gotcha

Here is the assumption to retire. In LTE, an inter-MME move for a connected UE is just a handover — you take it for granted because S10 has always been there. In the interworking world, that guarantee is conditional. Whether mobility "just works" between your LTE and 5G SA layers hinges on two things: is N26 actually deployed, and is the QoS and bearer mapping correct.

Get both right and a subscriber crossing the edge of an SA island gets a clean handover with their session intact. Get either wrong — no N26, or a mapping gap — and you do not get a handover. You get re-registration and, in the connected case, a redirect with a real interruption. For background data that is a hiccup. For a call, it is a drop.

The takeaway

N26 is the AMF-to-MME interface — the S10 of the 4G-to-5G era — carrying MM and SM context plus a mapped security context over GTP-C so a session can cross between EPC and 5GC. Deploy it (single-registration with N26) and you get both idle mobility and seamless connected-mode handover, the foundation EPS Fallback depends on. Skip it and you are left with idle mobility plus redirection, whether single-registration-without-N26 or dual-registration. And remember where the complexity really lives: the interface is half the job — the PDN-connection-to-PDU-session and bearer-to-QoS-flow mapping is the other half, and it decides whether the session that survived the move actually arrives intact.