Home | Reports | Technical Documents | Tech-Blog | One-Shot Gallery | Korea ICT News | Korea Communication Market Data | List of Contributors | Become a Contributor |    
Section 5G 4G LTE C-RAN/Fronthaul Gigabit Internet IPTV/Video Streaming IoT SDN/NFV Wi-Fi KT SK Telecom LG U+ Network Protocol Samsung   Korean Vendors
Real World Private 5G Cases   4 Deployment Models On-Premise Cases 5G Core Control Plane Sharing Cases

5G Core Sharing Cases

Private 5G Deployment   • Private 5G Frequency Allocation Status in Korea  South Korean government's regulations on private 5G and KT's strategy for entering the market
Cases in Korea   Private 5G Operators |   SK Networks Service (SI) Sejong Telecom (Wire-line Carrier) KT MOS (Affiliate of KT) • Newgens (SI) • NAVER Cloud more >>  
    Enterprise DIY |   Korea Hydro & Nuclear Power (Power Plant) Korea Electric Power Corporation (Energy) • Republic of Korea Navy more >>
CHANNELS     HFR Private 5G Solution (my5G)       my5G Solution Components       my5G Key Features        my5G Resources        my5G News          
EMM Procedure 6. Handover without TAU - Part 2. X2 Handover
March 21, 2014 | By Netmanias (tech@netmanias.com)
Online viewer:
Comments (10)
Page 2 of 5



Table of Contents  

1. Introduction
2. Concept of X2 Handover

2.1 X2 Protocol Stacks

2.2 X2AP Functions

2.3 X2 Messages Relating to Mobility Management Function

2.4 X2 Handover Procedure at a Glance

2.5 UE State and Connection Information Before and After X3 handover

3. Procedure of X2 Handover

4. EPS Entity Information: Before/After X2 Handover

4.1 Before X2 Handover

4.2 After X2 Handover

5. Closing



2. Concept of X2 Handover


2.1 X2 Protocol Stacks


X2 handover is performed between a source eNB and a target eNB through the X2 interface. In an LTE network, these two eNBs can directly communicate with each other via the X2 interface, which differentiates the network from its precedents (2G and 3G). In a 2G or 3G network, the only way an eNB could learn of the status of its neighboring eNB was through control by packet core nodes. However, now LTE networks allow eNBs to directly exchange status information with each other via the X2 interface, and to independently perform handovers without any intervention by EPC nodes. Figure 1 shows the protocol stacks over the X2 interface in control and user planes.



Figure 1. Protocol Stacks over X2 Interface


In the control plane, two eNBs provide multiple users with X2 Application Protocol (X2AP) signaling through a single Stream Control Transmission Protocol (SCTP) connection. In the X2AP layer, users are identified by eNB UE X2AP ID (Old eNB UE X2AP ID, New eNB UE X2AP ID)1. In the data plane, the two eNBs are connected through a GPRS Tunneling Protocol (GTP) tunnel, as in S1/S5 bearer. A unique GTP tunnel is generated for each user2, and each tunnel is identified by its allocated Tunnel Endpoint Identifiers (TEIDs).


2.2 X2AP Functions


Table 1 lists the functions that are performed through X2AP signaling, and the elementary procedures related to each function [2]. As seen below, X2AP signaling information can be roughly classified into two kinds, the one related to load/interference (i.e. Load Management function in the table) and the one related to handover (i.e. Mobility Management, Mobility Parameter Management, Mobility Robustness Optimization functions in the table).


Table 1. X2AP Functions and Elementary Procedures [2]


Compared to 2G/3G networks, broadband networks like LTE have less cell coverage but a lot more base stations to cover. Thus, conventional ways of configuring and managing networks used in 2G/3G networks are not efficient any more. To address this issue, now in LTE networks, X2AP protocol is defined, providing Self-Organizing Networks (SON) functionality. This allows an eNB to connect to its neighbor eNB(s), collect their status information, and use the collected information to automatically configure and optimize its parameters.3 Among the X2AP functions listed in Table 1, those related to SON are as follows:

  • Load Management: enhances the interception performance among cells by exchanging load and interference information between two eNBs
  • eNB Configuration Update: performs automatic eNB configuration
  • Mobility Parameters Management: negotiates on handover triggering setting information among peer eNBs and uses the information for handover optimization  
  • Mobility Robustness Optimization: provides information on a handover failure event
  • Energy Saving: help eNBs to consume less energy by exchanging information on cell activation/deactivation


2.3 X2 Messages Relating to Mobility Management Function


Table 2 shows messages used particularly in the Mobility Management function - among all the X2 functions listed in Table 1 above - relating to handovers to be discussed in Chapter III below [2]. We can see a response message from a target eNB is required during the handover preparation procedure.

  • Handover Request message: This message is used during the handover preparation phase. It is delivered by a source eNB to a target eNB, and includes a user’s UE context.
  • Handover Request Acknowledge message: This message is used during the handover preparation phase. It is delivered by the target eNB to the source eNB if resource allocation is successfully completed by the target eNB.
  • Handover Preparation Failure message: This message is used during the handover preparation phase. It is delivered by the target eNB to the source eNB if resource allocation at the target eNB fails.
  • SN Status Transfer message: This message is used during the handover execution phase. The source eNB delivers it to the target eNB to indicate from which packet it should receive or send.
  • UE Context Release message: This message is used during the handover completion phase. The target eNB sends it to the source eNB, to request release of the UE context.
  • Handover Cancel message4: This message is used during the handover preparation phase. The source eNB sends it to the target eNB when it needs to cancel a handover in preparation.


Table 2. X2 Messages for Mobility Management Function [2]


2.4 X2 Handover Procedure at a Glance


As seen in the previous document [1], an X2 handover procedure consists of preparation, execution and completion phases. Before we go further into detail, we will briefly preview the X2 handover procedure. Figure 2 illustrates at a glance the procedures required before, during (preparation, execution and completion phases) and after X2 handover. For convenience’s sake, S-GW and P-GW are marked as SAE-GW, and source and target eNBs are marked as SeNB and TeNB, respectively.



Figure 2. Simplified Procedure of X2 Handover


Before X2 Handover

In the figure above, the UE is being served through eNB A (a serving cell in eNB A, to be more exact) that it has accessed to. When the UE detects a measurement event, it sends a Measurement Report message to eNB A.


X2 Handover Preparation

The source eNB (i.e. eNB A in the figure) chooses a target eNB (i.e. eNB B in the figure) to handover to, based on the neighbor cell list information it has kept and the information on the signal strength of the neighbor cells included in the Measurement Report message.5 Next, it prepares an X2 handover with the target eNB through X2 signaling. In the meantime, the target eNB allocates resources in advance so that the same services currently available to the user at the source eNB are readily available at the target eNB as well. Also, to ensure a fast handover, the target eNB sends all the information needed for the user to connect to the target cell (e.g. C-RNTI) to the source eNB, which then forward the same to the UE, initiating the handover execution phase. The target eNB allocates resources as follows:  

  • When the source eNB sends the target eNB a Handover Request message that includes the user’s UE context (),
  • The target eNB:

   obtains S1 bearer information (S1 S-GW TEID) to establish an UL S1 bearer through which to transport UL packets ().

   allocates TEID for the X2 transport bearer (GTP-U tunnel) through which to receive DL packets while UE attempts to access the target eNB.

   allocates DRB resources and C-RNTI to be used by UE in the target cell.

   sends a Handover Request Ack message to the source eNB ().

  • Upon receiving the message, the source eNB establishes an X2 transport bearer through which to send DL packets ().


X2 Handover Execution  

Once handover preparation between the two eNBs is completed, it is time to have the UE perform a handover.

  • The source eNB:

   instructs the UE to perform a handover to the target cell by sending it a Handover Command message that includes all the information needed to access the target cell ().

   informs from which UL/DL packet the target eNB should receive or send when communicating with the UE by sending the target eNB an SN Status Transfer message ().

   forwards the DL packets received from S-GW to the target eNB through the X2 transport bearer established between itself and the target eNB ().

  • The UE detaches from the source eNB and accesses to the target eNB ().
  • The target eNB becomes capable of sending and receiving packets once the UE has successfully accessed (). 


X2 Handover Completion  

As seen so far, all the procedures performed during the handover execution phase (i.e. after the source eNB decided to perform a handover, and until the UE finally was connected to the target eNB) were just between the two eNBs, and no information about the handover was reported to EPC (MME). Now that the handover is completed, the target eNB informs EPC as follows:

  • Once the UE has accessed, the target eNB informs EPC and sends a Path Switch Request message to MME so that the EPS bearer path can be modified accordingly ().
  • When receiving the message, the MME becomes aware of the UE’s new serving cell. Then, it requests S-GW for S1 bearer modification ().
  • Upon the request, the S-GW establishes a DL S1 bearer (S1 Target eNB TEID) that connects to the target eNB. Then it stops sending DL packets to the source eNB, and begins to send them to the target eNB through the newly established DL bearer ().
  • The MME informs the target eNB that the DL S1 bearer path has been modified ().
  • The target eNB sends the source eNB a UE Context Release message, allowing the source eNB to release the UE context ().


After X2 Handover

The UE is now being served through eNB B (the serving cell at eNB B, to be more exact) that it has accessed.


2.5 UE State and Connection Information Before and After X2 Handover


Figure 3 illustrates the connection establishments in the user/control planes, and the UE and MME states before, during and after the X2 handover.


        Before X2 Handover

The UE stays in EMM-Registered and ECM/RRC-Connected and keeps all the resources allocated by E-UTRAN and EPC.

        During X2 Handover

Even during the handover phase, the UE’s state in the NAS layer remains unchanged, and an X2 bearer6 and X2 signaling connection are established over the X2 interface. In Figure 3, Step 2) shows the connections and states while the handover is interrupted during the handover execution phase. During this period, no radio link connection is active, but the UE still remains Connected.  

        After X2 Handover

The UE remains in EMM-Registered and ECM/RRC-Connected states. The E-RAB (DRB + S1 bearer) path is switched to access to a new eNB in the user plane while a new RRC connection and S1 signaling connection (eNB(B) S1AP UE ID) are established in the control plane.  



Figure 3. Connections and States before/after X2 Handover


Page 2 of 5
knokej 2014-04-09 06:03:39
2 questions regarding AS security. The ordering of steps 15 and 16 make it appear as though buffered DL data can start flowing to the UE BEFORE AS security is in force. Could steps 15 and 16 be reversed?

In order for the UE to derive new keys, it must know the PCI and frequency of the target cell. Which message from the source eNB contains the indication of which cell is the target? (Probably it is the Handover command, but the target cell/eNB indication isn't shown as data in that message)
Netmanias 2014-04-12 10:11:16
Hi knokej,

Thank you for your comment.
- As you noted, step 15 and 16 should be switched. We've fixed it and posted the updated file.
- "MobilityControlInfo" filed in the Handover Command message (i.e., RRCConnectionReconfiguration message) contains the PCI and carrier frequency of the target cell.
Siraj 2016-08-04 17:54:17

Hi Team,

I wanted to know is it possible to have X2 link b\w two eNodeBs which are being controlled by two different MMEs.

Creation of X2 link is part of planning or it happens dynamically.


ABHISHEK RANJAN 2017-12-17 15:48:06

Hi Siraj,

Yes, it is possible to have x2 links between two eNB's which are connected to different MME's. 

It can be done by defining the X2 neighbor relation or by ANR.


Hope this helps.


Many Thanks,


himanshu g 2017-08-22 15:43:00

Hi ,

I have a query is it mandatory for source eNB to send "handover restriction list" IE in "handover request" message to target eNB in the case of inter PLMN X2 handover ?



Himanshu Gupta

ABHISHEK RANJAN 2017-12-17 17:26:13

Hi Himanshu,

 it is an optional parameter, from specs 36.4113:


The target eNB shall use the information in Handover Restriction List IE if present in the HANDOVER REQUEST message to

-    determine a target for subsequent mobility action for which the eNB provides information about the target of the mobility action towards the UE;

-    select a proper SCG during dual connectivity operation.

If the Handover Restriction List IE is not contained in the HANDOVER REQUEST message, the target eNB shall consider that no roaming and no access restriction apply to the UE.


In this case if HRL is not provided and HO fails because of this, then it may make a HO via S1.


Many Thanks,





Manuel Ortiz 2018-04-25 11:29:36

Is there more information in regards to what happens during a Handover Cancel message? Does this apply to a terminal when it moves back to the serving eNB before the handover is complete and serving eNB signal strentgh becomes stronger than the target eNB?

Thank you!

Ajeet Srivastava 2020-06-12 16:29:18

x2 handover failure invalid mme group why this error??

chandan dubey 2020-07-23 18:05:47

Great explanation for the X2 handover thanks Netmania for your efforts...

Ganesh 2020-10-12 20:23:31

ON Handover Preparation stage of X2 handover,

Under this sction: "5)   [Target eNB] Preparing X2 Handover"

I could see this notes as "If available, it establishes an UL S1 bearer connecting to S-GW, by using the UL S1 bearer information (S1 S-GW TEID) stored at the source eNB."

Anyone could you explain this process in detail that , How the target eNB knows and establishes the UL S1 bearer tunnel with the S-GW (which is receiving UL packets from Source EnodeB)

Thank you for visiting Netmanias! Please leave your comment if you have a question or suggestion.
Related Contents
Netmanias Blog
Netmanias Blog
Netmanias Blog
Netmanias Technical Documents
Netmanias Technical Documents
Netmanias Technical Documents
Netmanias Technical Documents
Netmanias Technical Documents

[HFR Private 5G: my5G]


Details >>







Subscribe FREE >>

Currently, 55,000+ subscribed to Netmanias.

  • You can get Netmanias Newsletter

  • You can view all netmanias' contents

  • You can download all netmanias'

    contents in pdf file







View All (181)
5G (9) 6G (1) Backbone (2) Backhaul (3) Blockchain (1) CDN (1) Carrier Ethernet (3) Charging (1) Cloud Native (1) Core (1) DHCP (4) ECM (2) EMM (16) EPS (2) Google (1) HLS (1) HTTP Adaptive Streaming (3) Handover (5) IPTV (4) Initial Attach (2) IoT (2) Korea (1) LTE (39) LTE Identification (2) LTE-A (1) MPLS (2) Mobility (2) NAT (7) Netflix (1) Network Architecture (3) Network Protocol (20) New Radio (1) OTT (1) PCRF (3) Private 5G (1) QoS (3) RCS (3) SDF (2) SDN/NFV (3) SK Telecom (2) Samsung (3) Security (5) Sk Telecom (1) Transparent Cache (1) Video Streaming (4) VoLTE (2) Wi-Fi (1) YouTube (2)
Password confirmation
Please enter your registered comment password.