Fading Coder

One Final Commit for the Last Sprint

Home > Tech > Content

5GC PDU Session Establishment Flow with NRF/PCF/UPF Interactions

Tech 2

5G transports user traffic between the UE and external data networks as packet data units (PDUs). A PDU can be IP, Ethernet, or Unstructured, and the target data network is identified by a DNN (Data Network Name), analogous to the APN concept in EPC. The logical path that exchanges PDUs between a UE and a DNN is a PDU Session.

In 5GC, the PDU Connectviity Service is delivered via PDU Sessions created at UE request. Session management and QoS enforcement are coordinated across SMF, PCF, and UPF, using subscriber data from UDM. Typical responsibilities include:

  • UDM: subscription data (e.g., default 5QI/QFI, ARP, Session-AMBR, UE-AMBR, SSC mode, EPS interworking indication)
  • PCF: policy decisions and QoS rules (default and dedicated flows)
  • SMF: PDU sesion lifecycle, IP allocation, SSC mode selection, policy control enforcement, QoS rule distribution to RAN/UPF/UE
  • UPF: user-plane enforcement and QoS mapping

Unlike EPC, a PDU session is not established during registration. The UE exclusively initiates PDU sessions when it has traffic demand. For downlink-initiated communication, the network pages the UE; upon response, the UE starts a Service Request and then triggers PDU session establishment as needed.

The baseline procedure (TS 23.502, 4.3.2) below focuses on a non-roaming or local breakout scenario with UE, RAN (gNB), AMF, SMF, PCF, UPF, UDM, and the DN.

1) UE → AMF: NAS PDU Session Establishment Request

The UE sends a NAS message indicating an initial request to create a PDU Session. The message includes a UE-unique PDU Session ID and the DNN. Example for an IMS registration session (DNN = "ims") and IPv6 PDU type:

PDU Session Establishment Request
- PDU Session ID: 7
- Procedure Transaction ID: 0x3A
- DNN: "ims"
- Requested PDU Session Type: IPv6
- SSC Mode: 1
- Extended PCO: …
- Integrity protection data rate: uplink=full, downlink=full

The request may also include requested S-NSSAI, SSC mode, and other capabilities.

2) AMF → NRF: SMF Discovery and Selection

AMF locates an SMF that serves the UE’s S-NSSAI and DNN. If no local mapping applies, AMF queries NRF for an SMF offering nsmf-pdusession.

Example query (simplified JSON body):

{
  "targetNfType": "SMF",
  "requesterNfType": "AMF",
  "serviceNames": ["nsmf-pdusession"],
  "targetPlmns": [{"mcc": "001", "mnc": "01"}],
  "requesterPlmns": [{"mcc": "001", "mnc": "01"}],
  "snssais": [{"sst": 1, "sd": "1A2B3C"}],
  "dnn": "ims",
  "supi": "imsi-001010000000001"
}

Example NRF response:

{
  "nfInstances": [
    {
      "nfInstanceId": "e2bb8f9b-0c96-4d4e-a7d0-2b9c5c2281f1",
      "nfServices": [
        {
          "serviceName": "nsmf-pdusession",
          "serviceInstanceId": "svc-01",
          "versions": [{"apiVersionInUri": "v1", "apiFullVersion": "1.0.0"}],
          "scheme": "http",
          "apiPrefix": "http://smf1.core.example:30080"
        }
      ]
    }
  ]
}

3) AMF → SMF: Create SM Context (Nsmf_SmContextCreate)

AMF provides UE identifiers, access type, serving PLMN, requested S-NSSAI/DNN, and the N1 SM container to SMF.

Multipart example (fields reordered and values changed for illustration):

POST /nsmf-pdusession/v1/sm-contexts HTTP/2
Host: smf1.core.example:30080
Content-Type: multipart/related; boundary=--X

--X
Content-Type: application/json

{
  "supi": "imsi-001010000000001",
  "gpsi": "msisdn-15550000001",
  "pduSessionId": 7,
  "dnn": "ims",
  "sNssai": {"sst": 1, "sd": "1A2B3C"},
  "servingNfId": "amf-6f5c9b93",
  "guami": {"plmnId": {"mcc": "001", "mnc": "01"}, "amfId": "0000A1"},
  "servingNetwork": {"mcc": "001", "mnc": "01"},
  "requestType": "INITIAL_REQUEST",
  "n1SmMsg": {"contentId": "n1"},
  "anType": "3GPP_ACCESS",
  "ratType": "NR",
  "ueLocation": {
    "nrLocation": {
      "tai": {"plmnId": {"mcc": "001", "mnc": "01"}, "tac": "00ABCD"},
      "ncgi": {"plmnId": {"mcc": "001", "mnc": "01"}, "nrCellId": "000000ABC"}
    }
  },
  "ueTimeZone": "+02:00",
  "smContextStatusUri": "http://amf1.core.example:30090/nsmf-pdusession/smcontextstatus/v1/sm-contexts/2e1500aa",
  "selMode": "VERIFIED",
  "epsInterworkingInd": "WITH_N26"
}

--X
Content-Type: application/vnd.3gpp.5gnas
Content-Id: n1

pdu_session_est_req(...hex...)  
# PDU type: IPv6, SSC mode: 1, DNN: ims
--X--

Example response:

HTTP/2 201 Created
Location: http://smf1.core.example:30080/nsmf-pdusession/v1/sm-contexts/42

{}

4) SMF ↔ UDM: Registration and Session-Management Subscription Data

SMF registers the PDU session with UDM (UECM) and then retrieves SM subscription data (SDM).

Registration example:

PUT /nudm-uecm/v1/imsi-001010000000001/registrations/smf-registrations/7 HTTP/2
Host: udm.core.example:30800
Content-Type: application/json

{
  "smfInstanceId": "e2bb8f9b-0c96-4d4e-a7d0-2b9c5c2281f1",
  "pduSessionId": 7,
  "singleNssai": {"sst": 1, "sd": "1A2B3C"},
  "dnn": "ims",
  "plmnId": {"mcc": "001", "mnc": "01"},
  "pgwFqdn": "smf1.core.example"
}

UDM response:

HTTP/2 201 Created
Location: /nudm-uecm/v1/imsi-001010000000001/registrations/smf-registrations

{"pduSessionId":7}

Subscription data request:

GET /nudm-sdm/v1/imsi-001010000000001/sm-data?single-nssai={"sst":1,"sd":"1A2B3C"}&dnn=ims HTTP/2
Host: udm.core.example:30800

Example subscription payload:

[
  {
    "singleNssai": {"sst": 1, "sd": "1A2B3C"},
    "dnnConfigurations": {
      "ims": {
        "pduSessionTypes": {
          "defaultSessionType": "IPV6",
          "allowedSessionTypes": ["IPV4", "IPV6", "IPV4V6"]
        },
        "sscModes": {
          "defaultSscMode": "SSC_MODE_1",
          "allowedSscModes": ["SSC_MODE_2", "SSC_MODE_3"]
        },
        "iwkEpsInd": true,
        "5gQosProfile": {
          "5qi": 9,
          "arp": {"priorityLevel": 1, "preemptCap": "NOT_PREEMPT", "preemptVuln": "NOT_PREEMPTABLE"},
          "priorityLevel": 1
        },
        "sessionAmbr": {"uplink": "1 Gbps", "downlink": "1 Gbps"},
        "3gppChargingCharacteristics": "0000",
        "upSecurity": {"upIntegr": "NOT_NEEDED", "upConfid": "NOT_NEEDED"}
      }
    }
  }
]

5) SMF → AMF: Confirm SM Context Creation

SMF acknowledges context creation; AMF retains the SM context URI for future updates.

HTTP/2 201 Created
Location: http://smf1.core.example:30080/nsmf-pdusession/v1/sm-contexts/42

{}

6) PDU Session Authentication/Authorization

If configured, SMF/PCF may perform policy and charging authorization using subscription and operator policy; result integrates with the policy association formed next.

7) SMF ↔ PCF: SM Policy Association

7.1 SMF → NRF: PCF Discovery

SMF finds a PCF that supports smpolicycontrol for the given slice/DNN.

{
  "targetNfType": "PCF",
  "requesterNfType": "SMF",
  "serviceNames": ["npcf-smpolicycontrol"],
  "targetPlmns": [{"mcc": "001", "mnc": "01"}],
  "requesterPlmns": [{"mcc": "001", "mnc": "01"}],
  "snssais": [{"sst": 1, "sd": "1A2B3C"}],
  "dnn": "ims",
  "supi": "imsi-001010000000001"
}

Example response:

{
  "nfInstances": [
    {
      "nfInstanceId": "af2c91c9-3139-4e4d-bb76-4a44d8b0fb15",
      "nfServices": [
        {
          "serviceName": "npcf-smpolicycontrol",
          "serviceInstanceId": "pcf-svc-02",
          "versions": [{"apiVersionInUri": "v1", "apiFullVersion": "1.0.0"}],
          "scheme": "http",
          "apiPrefix": "http://pcf1.core.example:30500"
        }
      ],
      "pcfInfo": {"dnnList": ["ims", "internet"]}
    }
  ]
}

7.2 SMF → PCF: Create Policy Association

POST /npcf-smpolicycontrol/v1/sm-policies HTTP/2
Host: pcf1.core.example:30500
Content-Type: application/json

{
  "supi": "imsi-001010000000001",
  "gpsi": "msisdn-15550000001",
  "pduSessionId": 7,
  "pduSessionType": "IPV6",
  "dnn": "ims",
  "accessType": "3GPP_ACCESS",
  "ratType": "NR",
  "servingNetwork": {"mcc": "001", "mnc": "01"},
  "userLocationInfo": {
    "nrLocation": {
      "tai": {"plmnId": {"mcc": "001", "mnc": "01"}, "tac": "00ABCD"},
      "ncgi": {"plmnId": {"mcc": "001", "mnc": "01"}, "nrCellId": "000000ABC"}
    }
  },
  "ueTimeZone": "+02:00",
  "subsSessAmbr": {"uplink": "1000000000 bps", "downlink": "1000000000 bps"},
  "subsDefQos": {"5qi": 9, "arp": {"priorityLevel": 1, "preemptCap": "NOT_PREEMPT", "preemptVuln": "NOT_PREEMPTABLE"}},
  "sliceInfo": {"sst": 1, "sd": "1A2B3C"},
  "qosFlowUsage": "IMS_SIG",
  "notificationUri": "http://smf1.core.example:30080/pcf-notify/sm-policies/42",
  "servNfId": {"servNfInstId": "amf-6f5c9b93"},
  "smfId": "e2bb8f9b-0c96-4d4e-a7d0-2b9c5c2281f1"
}

Example PCF response with PCC/QoS decisions:

HTTP/2 201 Created
Location: /npcf-smpolicycontrol/v1/sm-policies/9f4c53e6
Content-Type: application/json

{
  "pccRules": {
    "r-10": {
      "pccRuleId": "r-10",
      "precedence": 65000,
      "flowInfos": [{"flowDirection": "BIDIRECTIONAL", "flowDescription": "permit out ip from any to any"}],
      "refQosData": ["q-ims-sig"],
      "refTcData": ["tc-1"]
    }
  },
  "qosDecs": {
    "q-ims-sig": {
      "qosId": "q-ims-sig",
      "5qi": 5,
      "arp": {"priorityLevel": 2, "preemptCap": "NOT_PREEMPT", "preemptVuln": "PREEMPTABLE"},
      "maxbrDl": "1000000000 bps",
      "maxbrUl": "1000000000 bps",
      "defQosFlowIndication": true
    }
  },
  "sessRules": {
    "s-1": {
      "sessRuleId": "s-1",
      "authDefQos": {"5qi": 5, "arp": {"priorityLevel": 2, "preemptCap": "NOT_PREEMPT", "preemptVuln": "PREEMPTABLE"}},
      "authSessAmbr": {"uplink": "1000000000 bps", "downlink": "1000000000 bps"}
    }
  },
  "traffContDecs": {"tc-1": {"tcId": "tc-1", "flowStatus": "ENABLED"}},
  "qosFlowUsage": "IMS_SIG"
}

8) SMF: UPF Selection

SMF selects a UPF that supports the requested DNN and PDU session type for the given S-NSSAI. This selection is often internal (policy- and topology-driven). Result includes reachable N4 association to a UPF instance and capabilities for DNN="ims" with IP/Ethernet/Unstructured support.

9) SMF ↔ UPF (PFCP/N4): Session Establishment

SMF establishes an N4 (PFCP) session and installs PDR/FAR/QER. For IP PDU sessions (TS 23.501, 5.8.2.4.2), PDRs typically include TEID/outer header info, QFI, network instance (DNN), and packet filters. Example structure (illustrative):

PFCP Session Establishment Request
- Node: UPF@upf1.core.example (IPv4 10.0.1.10)
- SEID (CP): 0xAABBCCDD
- Create PDR (UL):
  - PDR ID: 10, Precedence: 65534
  - Source Interface: Access (N3)
  - F-TEID (UL from gNB): teid=0x01020304, ipv4=10.10.0.2
  - SDF Filter: match all (permit out ip from any to any)
  - Network Instance: ims
  - QFI: 1
  - Outer Header Removal: GTP-U/UDP/IPv4
  - FAR-ID: 1001, QER-IDs: [2001]
- Create PDR (DL):
  - PDR ID: 11, Precedence: 65534
  - Destination Interface: Access (N3)
  - UE IP Addr (IPv6): ::/0 (assigned later), match QFI=1
  - FAR-ID: 1002, QER-IDs: [2001]
- Create FAR (1001): Forward to Core (N6)
  - Apply BAR/QoS as per policy
- Create FAR (1002): Forward to Access (N3)
  - Outer Header Creation: GTP-U/UDP/IPv4 teid=<to-gnb>, ipv4=<gnb-uplink-ip>
- Create QER (2001): QFI=1, GBR/MBR per policy, gate=OPEN

UPF answers with an Acceptance including allocated SEID (UP) and any derived TEIDs.

10) SMF → AMF: Namf_Communication_N1N2MessageTransfer

SMF provides the N1 (NAS) and N2 (NGAP) messages for RAN resource setup via AMF.

POST /namf-comm/v1/ue-contexts/imsi-001010000000001/n1-n2-messages HTTP/2
Host: amf1.core.example:30090
Content-Type: multipart/related; boundary=--Z

--Z
Content-Type: application/json

{
  "pduSessionId": 7,
  "n1MessageContainer": {"n1MessageClass": "SM", "n1MessageContent": {"contentId": "n1"}},
  "n2InfoContainer": {
    "n2InformationClass": "SM",
    "smInfo": {
      "pduSessionId": 7,
      "n2InfoContent": {"ngapMessageType": 47, "ngapIeType": "PDU_RES_SETUP_REQ", "ngapData": {"contentId": "n2"}}
    }
  }
}

--Z
Content-Type: application/vnd.3gpp.5gnas
Content-Id: n1

pdu_session_est_accept(...hex...)

--Z
Content-Type: application/vnd.3gpp.ngap
Content-Id: n2

ngap: PDUSessionResourceSetupRequest(...hex...)
--Z--

11) AMF → RAN: NGAP PDUSessionResourceSetupRequest

AMF requests RAN to allocate radio and N3 user-plane resources for the PDU Session. The message carries AMF-UE-NGAP-ID, RAN-UE-NGAP-ID, PDU Session ID, S-NSSAI, and transport layer information templates.

12) RAN ↔ UE: NAS PDU Session Establishment Accept

RAN delivers the NAS PDU Session Establishment Accept to the UE, including assigned IPv6 prefix/address (if provided by SMF) and QoS rules (default QFI, mapping to DRB).

13) RAN → AMF: PDUSessionResourceSetupResponse

RAN confirms resource creation and provides transport parameters (e.g., N3 GTP-U TEID and gNB UP IP address).

14) AMF → SMF: Nsmf_PDUSessionUpdateSMContext (modify)

AMF forwards the N2 setup response to SMF to finalize user-plane anchoring.

POST /nsmf-pdusession/v1/sm-contexts/42/modify HTTP/2
Host: smf1.core.example:30080
Content-Type: multipart/related; boundary=--Y

--Y
Content-Type: application/json

{
  "anType": "3GPP_ACCESS",
  "guami": {"plmnId": {"mcc": "001", "mnc": "01"}, "amfId": "0000A1"},
  "servingNetwork": {"mcc": "001", "mnc": "01"},
  "ueLocation": {
    "nrLocation": {
      "tai": {"plmnId": {"mcc": "001", "mnc": "01"}, "tac": "00ABCD"},
      "ncgi": {"plmnId": {"mcc": "001", "mnc": "01"}, "nrCellId": "000000ABC"}
    }
  },
  "n2SmInfoType": "PDU_RES_SETUP_RSP",
  "n2SmInfo": {"contentId": "n2rsp"}
}

--Y
Content-Type: application/vnd.3gpp.ngap
Content-Id: n2rsp

ngap: PDUSessionResourceSetupResponse(...hex...)
--Y--

15) SMF ↔ UPF (PFCP/N4): Session Modification

SMF updates the UPF with final N3 tunnel parameters provided by the RAN.

Example modification:

PFCP Session Modification Request
- Update FAR (1002): Outer Header Creation teid=0x0A0B0C0D, ipv4=10.10.0.3 (gNB-U)
- Update PDR (DL, id=11): set forwarding to FAR 1002, keep QFI=1
- Optionally update UE IPv6 prefix on DL PDR

UPF replies with Acceptance, indicating N4 path readiness.

16) SMF → AMF: Nsmf_PDUSessionUpdateSMContext Response

SMF acknowledges the context modification.

HTTP/2 200 OK
Content-Type: application/json

{}

At this point, the UE, RAN, UPF, and DN have an active PDU Session. UL/DL packets are detected by PDRs, forwarded by FARs, and policed/shaped by QERs according to PCF-provided policy and UDM subscription data. QoS Flow mapping (QFI) is enforced downstream by UPF and upstream by UE/RAN per TS 23.501 5.7.4.

Tags: 5G
Back to List

Prev: PHP 7.4 Development Stack on macOS Catalina with Nginx, MySQL, and Redis (including phpredis)

Next: Qt Widget-Based Calculator: UI Validation, Infix Parsing, RPN Conversion, and Evaluation

Related Articles

Understanding Strong and Weak References in Java

Strong References Strong reference are the most prevalent type of object referencing in Java. When an object has a strong reference pointing to it, the garbage collector will not reclaim its memory. F...

Comprehensive Guide to SSTI Explained with Payload Bypass Techniques

Introduction Server-Side Template Injection (SSTI) is a vulnerability in web applications where user input is improper handled within the template engine and executed on the server. This exploit can r...

Implement Image Upload Functionality for Django Integrated TinyMCE Editor

Django’s Admin panel is highly user-friendly, and pairing it with TinyMCE, an effective rich text editor, simplifies content management significantly. Combining the two is particular useful for bloggi...

Leave a Comment

Anonymous

◎Feel free to join the discussion and share your thoughts.

Copyright © fadingcoder.top