5G/NR - NAS                                           Home : www.sharetechnote.com

 

 

 

 

 

PDU Session Establishment

 

PDU Session Establishement is equivalent to PDN Establishment in LTE. Main purpose of this process is to assign UE IP and inform the UE of various the IP address of various corenetwork components (application layer component)

 

 

 

 

Signaling Sequence

 

According to 24.501 - 6.4.1.2 UE-requested PDU session establishment procedure initiation goes as follows.

 

 

< Case A > Normal PDU Establishment

 

Direction

Message

UE Timer

NW Timer

UE -> NW(SMF)

ULInformationTransfer + UL NAS Transport

  + PDU SESSION ESTABLISHMENT REQUEST

T3580 Start

 

UE <- NW(SMF)

DLInformationTransfer + DL NAS Transport

  + PDU SESSION ESTABLISHMENT ACCEPT

T3582 Stop

 

 

 

< Case B > No PDU Session Establishment Accept

 

Direction

Message

UE Timer

NW Timer

UE -> NW(SMF)

ULInformationTransfer + UL NAS Transport

  + PDU SESSION ESTABLISHMENT REQUEST

T3580 Start

 

UE <- NW(SMF)

No PDU SESSION ESTABLISMENT ACCEPT

T3582 Exire

 

 

 

< Case C > PDU SESSION ESTABLISHMENT REJECT

 

Direction

Message

UE Timer

NW Timer

UE -> NW(SMF)

ULInformationTransfer + UL NAS Transport

  + PDU SESSION ESTABLISHMENT REQUEST

T3580 Start

 

UE <- NW(SMF)

DLInformationTransfer + DL NAS Transport

  + PDU SESSION ESTABLISHMENT REJECT

T3582 Stop

 

 

Following is a table listing various reject cause and the expected UE behavior based on 24.501-6.4.1.4, 6.4.1.7 and 24.501-AnnexA. I put only high level and most critical (most critical to me) in the 'Expected UE behavior' column. There are much more futher details specified in the specification.

 

Reject Cause

Expected UE Behavior

#8 operator determined barring;

(24.501-6.4.1.4)

 

#26 insufficient resources

(24.501-6.4.1.4,6.4.1.7)

The SMF may include a Back-off timer value IE in the PDU SESSION ESTABLISHMENT REJECT message when the 5GSM cause value #26"insufficient resources" is included in the PDU SESSION ESTABLISHMENT REJECT message. If the 5GSM cause value is #26"insufficient resources" and the PDU SESSION ESTABLISHMENT REQUEST message was received from a UE configured for high priority access in selected PLMN or the request type is set to "initial emergency request" or "existing emergency PDU session", the network shall not include a Back-off timer value IE.

If the PDU session cannot be established due to resource unavailability in the UPF, the SMF shall include the 5GSM cause value #26 "insufficient resources" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message.

5G access network cannot forward the message:

If the SMF determines based on content of the n2SmInfo attribute specified in 3GPP TS 29.502 that the DL NAS TRANSPORT message carrying the PDU SESSION ESTABLISHMENT ACCEPT was not forwarded to the UE by the 5G access network, then the SMF shall reject the PDU session establishment procedure with the 5GSM cause set to #26 "insufficient resources" in the PDU SESSION ESTABLISHMENT REJECT message.

#27 missing or unknown DNN

(24.501-6.4.1.4)

 

#28 unknown PDU session type

(24.501-6.4.1.4)

If the PDU SESSION ESTABLISHMENT REQUEST message includes a PDU session type IE set to "IPv6", and the subscription, the SMF configuration, or both, support none of "IPv4" and "IPv6" PDU session types for the requested DNN, the SMF shall include the 5GSM cause value #28 "unknown PDU session type" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message.

If the PDU SESSION ESTABLISHMENT REQUEST message includes a PDU session type IE set to "IPv4", and the subscription, the SMF configuration, or both, support none of "IPv4" and "IPv6" PDU session types for the requested DNN, the SMF shall include the 5GSM cause value #28 "unknown PDU session type" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message.

If the PDU SESSION ESTABLISHMENT REQUEST message includes a PDU session type IE set to "IPv4v6", and the subscription, the SMF configuration, or both, support none of "IPv4v6", "IPv4" and "IPv6" PDU session types for the requested DNN, the SMF shall include the 5GSM cause value #28 "unknown PDU session type" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message.

If the PDU SESSION ESTABLISHMENT REQUEST message includes a PDU session type IE set to "Unstructured" or "Ethernet", and the subscription, the SMF configuration, or both, do not support the PDU session type for the requested DNN, the SMF shall include the 5GSM cause value #28 "unknown PDU session type" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message.

#29 user authentication or authorization failed

(24.501-6.4.1.4,6.4.1.7)

If the DN authentication of the UE was performed and completed unsuccessfully, the SMF shall include the 5GSM cause value #29 "user authentication or authorization failed" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message and shall set the EAP message IE of the PDU SESSION ESTABLISHMENT REJECT message to an EAP-failure message as specified in IETF RFC 3748, provided by the DN.

The information for the PDU session authentication and authorization by the external DN in PDU DN request container is not compliant with local policy and user's subscription data If the PDU session being established is a non-emergency PDU session, the PDU session authentication and authorization by the external DN is required due to local policy and user's subscription data and the information for the PDU session authentication and authorization by the external DN in PDU DN request container is not compliant with local policy and user's subscription data, the SMF shall reject the PDU session establishment request including the 5GSM cause #29 "user authentication or authorization failed", in the PDU SESSION ESTABLISHMENT REJECT message.

#31 request rejected, unspecified

(24.501-6.4.1.7)

If the received request type is "initial emergency request" and there is already another emergency PDU session for the UE, the SMF shall reject the PDU SESSION ESTABLISHMENT REQUEST message with 5GSM cause #31 "request rejected, unspecified" or release locally the existing emergency PDU session and proceed the new PDU SESSION ESTABLISHMENT REQUEST message

#32 service option not supported

(24.501-6.4.1.4)

 

#33 requested service option not subscribed

(24.501-6.4.1.4)

 

#35 PTI already in use

(24.501-6.4.1.4)

 

#38 network failure

(24.501-6.4.1.4)

 

#46 out of LADN service area

(24.501-6.4.1.4)

If the UE requests a PDU session establishment for an LADN when the UE is located outside of the LADN service area, the SMF shall include the 5GSM cause value #46 "out of LADN service area" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message.

#50 PDU session type IPv4 only allowed

(24.501-6.4.1.4)

If the PDU SESSION ESTABLISHMENT REQUEST message includes a PDU session type IE set to "IPv6", and the subscription, the SMF configuration, or both, are limited to IPv4 only for the requested DNN, the SMF shall include the 5GSM cause value #50 "PDU session type IPv4 only allowed" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message.

#51 PDU session type IPv6 only allowed

(24.501-6.4.1.4)

If the PDU SESSION ESTABLISHMENT REQUEST message includes a PDU session type IE set to "IPv4", and the subscription, the SMF configuration, or both, are limited to IPv6 only for the requested DNN, the SMF shall include the 5GSM cause value #51 "PDU session type IPv6 only allowed" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message.

#54 PDU session does not exist

(24.501-6.4.1.7)

UE-requested PDU session establishment with request type "existing PDU session" or "existing emergency PDU session" for a PDU session that does not exist:

If the SMF receives a PDU SESSION ESTABLISHMENT REQUEST message with request type set to "existing PDU session" or "existing emergency PDU session", and the SMF does not have any information about that PDU session, then the SMF shall reject the PDU session establishment procedure with the 5GSM cause set to #54 "PDU session does not exist" in the PDU SESSION ESTABLISHMENT REJECT message.

#67 insufficient resources for specific slice and DNN

(24.501-6.4.1.4)

The SMF may include a Back-off timer value IE in the PDU SESSION ESTABLISHMENT REJECT message when the 5GSM cause value #67 "insufficient resources for specific slice and DNN" is included in the PDU SESSION ESTABLISHMENT REJECT message. If the 5GSM cause value is #67 "insufficient resources for specific slice and DNN" and the PDU SESSION ESTABLISHMENT REQUEST message was received from a UE configured for high priority access in selected PLMN or the request type is "initial emergency request" or "existing emergency PDU session", the network shall not include a Back-off timer value IE.

#68 not supported SSC mode

(24.501-6.4.1.4)

If the PDU SESSION ESTABLISHMENT REQUEST message contains the SSC mode IE indicating an SSC mode not supported by the subscription, the SMF configuration, or both of them, and the SMF decides to rejects the PDU session establishment, the SMF shall include the 5GSM cause value #68 "not supported SSC mode" in the 5GSM cause IE and the SSC modes allowed by SMF in the Allowed SSC mode IE of the PDU SESSION ESTABLISHMENT REJECT message.

#69 insufficient resources for specific slice

(24.501-6.4.1.4)

The SMF may include a Back-off timer value IE in the PDU SESSION ESTABLISHMENT REJECT message when the 5GSM cause #69 "insufficient resources for specific slice" is included in the PDU SESSION ESTABLISHMENT REJECT message. If the 5GSM cause value is #69 "insufficient resources for specific slice" and the PDU SESSION ESTABLISHMENT REQUEST message was received from a UE configured for high priority access in selected PLMN or the request type is "initial emergency request" or "existing emergency PDU session", the network shall not include a Back-off timer value IE.

#70 missing or unknown DNN in a slice

(24.501-6.4.1.4)

 

#82 maximum data rate per UE for user-plane integrity protection is too low

(24.501-6.4.1.4)

In 3GPP access, if the operator's configuration requires user-plane integrity protection for the PDU session and, the maximum data rate per UE for user-plane integrity protection supported by the UE for uplink or the maximum data rate per UE for user-plane integrity protection supported by the UE for downlink, or both, are lower than required by the operator's configuration, the SMF shall include the 5GSM cause value #82 "maximum data rate per UE for user-plane integrity protection is too low" in the 5GSM cause IE of the PDU SESSION ESTABLISHMENT REJECT message.

#95 111 protocol errors

 

 

 

 

Message Structure

 

 

PDU Session Establishment Request

 

 

 

Example 01 >

 

This is a sample message from the log provided by Amarisoft.

 

{
  message c1: ulInformationTransfer: {
    criticalExtensions ulInformationTransfer: {
      dedicatedNAS-Message '7E02FF096300027E006701001E2E0509C1FFFF93A17B001380000A00000
                                      200000100000C00000300000D00120581250403696D73'H
    }
  }
}

 


    Message: UL NAS transport

    Data:

    Protocol discriminator = 0x7e (5GS Mobility Management)
    Security header = 0x2 (Integrity protected and ciphered)
    Auth code = 0xff096300
    Sequence number = 0x02
    Protocol discriminator = 0x7e (5GS Mobility Management)
    Security header = 0x0 (Plain 5GS NAS message, not security protected)
    Message type = 0x67 (UL NAS transport)
    Payload container type = 1 (N1 SM information)
    Payload container:
      Protocol discriminator = 0x2e (5GS Session Management)
      PDU session identity = 5
      Procedure transaction identity = 9
      Message type = 0xc1 (PDU session establishment request)
      Integrity protection maximum data data:
        Maximum data rate per UE for user-plane integrity protection 
                                         for uplink = 0xff (Full data rate)
        Maximum data rate per UE for user-plane integrity protection 
                                         for downlink = 0xff (Full data rate)
      PDU session type = 0x3 (IPv4v6)
      SSC mode = 0x1 (1)
      Extended protocol configuration options:
        Ext = 1
        Configuration protocol = 0
        Protocol ID = 0x000a (IP address allocation via NAS signalling)
        Data =
        Protocol ID = 0x0002 (IM CN Subsystem Signaling Flag)
        Data =
        Protocol ID = 0x0001 (P-CSCF IPv6 Address Request)
        Data =
        Protocol ID = 0x000c (P-CSCF IPv4 Address Request)
        Data =
        Protocol ID = 0x0003 (DNS Server IPv6 Address Request)
        Data =
        Protocol ID = 0x000d (DNS Server IPv4 Address Request)
        Data =
    PDU session ID = 5
    Request type = 0x1 (initial request)
    DNN = "ims"

 

 

 

PDU Session Establishment Accept

 

 

 

Example 01 >

 

This is a sample message from the log provided by Amarisoft.

 

{
  message c1: dlInformationTransfer: {
    rrc-TransactionIdentifier 0,
    criticalExtensions dlInformationTransfer: {
      dedicatedNAS-Message '7E0206FC019B027E0054431081C176589E9EBFCD7490B34CBFBFE56
                            B450981C176589E9EBFCD7446404791118261539040490100'H
    }
  }
}

 

    Protocol discriminator = 0x7e (5GS Mobility Management)
    Security header = 0x2 (Integrity protected and ciphered)
    Auth code = 0x66f143b0
    Sequence number = 0x03
    Protocol discriminator = 0x7e (5GS Mobility Management)
    Security header = 0x0 (Plain 5GS NAS message, not security protected)
    Message type = 0x68 (DL NAS transport)
    Payload container type = 1 (N1 SM information)
    Payload container:
      Protocol discriminator = 0x2e (5GS Session Management)
      PDU session identity = 5
      Procedure transaction identity = 9
      Message type = 0xc2 (PDU session establishment accept)
      Selected PDU session type = 0x3 (IPv4v6)
      Selected SSC mode = 0x1 (1)
      Authorized QoS rules:
        QoS rule 1:
          QoS rule identifier = 1
          Rule operation code = 1 (create new QoS rule)
          DQR = 1 (the QoS rule is the default QoS rule)
          Number of packet filters = 1
          Packet filter identifier = 15
            Packet filter direction = 3 (bidirectional)
            Match-all
          QoS rule precedence = 255
          QFI = 1
      Session AMBR:
        Session-AMBR for downlink = 3000000 kbps
        Session-AMBR for uplink = 1000000 kbps
      PDU address:
        PDU session type = 3 (IPv4v6)
        IPv6 = ::2001:468:3000:1
        IPv4 = 192.168.4.2
      Authorized QoS flow descriptions:
        QoS flow description 1:
          QFI = 1
          Operation code = 1 (create new QoS flow description)
          E = 1 (parameters list is included)
          Number of parameters = 1
          5QI = 5
      Extended protocol configuration options:
        Ext = 1
        Configuration protocol = 0
        Protocol ID = 0x000d (DNS Server IPv4 Address)
        Data = 8.8.8.8
        Protocol ID = 0x0003 (DNS Server IPv6 Address)
        Data = 2001:4860:4860:0:0:0:0:8888
        Protocol ID = 0x000c (P-CSCF IPv4 Address)
        Data = 192.168.4.1
        Protocol ID = 0x0001 (P-CSCF IPv6 Address)
        Data = 2001:468:3000:1:0:0:0:0
        Protocol ID = 0x0002 (IM CN Subsystem Signaling Flag)
        Data =
      DNN = "ims.mnc001.mcc001.gprs"
      PDU session ID = 5

 

 

 

5GSM capability

 

    RqoS

      0 Reflective QoS not supported

      1 Reflective QoS supported

    Multi-homed IPv6 PDU session (MH6-PDU)

      0 Multi-homed IPv6 PDU session not supported

      1 Multi-homed IPv6 PDU session supported

 

 

 

5GSM cause

 

 

    5GSM cause IEI

    Cause value

      Operator determined barring

      Insufficient resources

      Missing or unknown DNN

      Unknown PDU session type

      User authentication or authorization failed

      Request rejected, unspecified

      Service option not supported

      Requested service option not subscribed

      Service option temporarily out of order

      PTI already in use

      Regular deactivation

      Network failure

      Reactivation requested

      Invalid PDU session identity

      Semantic errors in packet filter(s)

      Syntactical error in packet filter(s)

      Out of LADN service area

      PTI mismatch

      PDU session type IPv4 only allowed

      PDU session type IPv6 only allowed

      PDU session does not exist

      Insufficient resources for specific slice and DNN

      Not supported SSC mode

      Insufficient resources for specific slice

      Missing or unknown DNN in a slice

      Invalid PTI value

      Maximum data rate per UE for user-plane integrity protection is too low

      Semantic error in the QoS operation

      Syntactical error in the QoS operation

      Invalid mapped EPS bearer identity

      Semantically incorrect message

      Invalid mandatory information

      Message type non-existent or not implemented

      Message type not compatible with the protocol state

      Information element non-existent or not implemented

      Conditional IE error

      Message not compatible with the protocol state

      Protocol error, unspecified

 

 

 

Always-on PDU session indication

    Always-on PDU session not allowed

    Always-on PDU session required

 

 

 

Always-on PDU session requested

 

    0 Always-on PDU session not requested

    1 Always-on PDU session requested

 

 

 

EAP message

 

This is defined in RFC 3784.

 

 

 

Extended protocol configuration options

 

    Length of extended protocol configuration options contents

    Extended protocol configuration options contents (24.008-10.5.6.3)

     

    < 24.008-Figure 10.5.136: Protocol configuration options information element >

 

 

 

GPRS Timer

 

    GPRS Timer IEI

    Timer Value

    Unit

      value is incremented in multiples of 2 seconds

      value is incremented in multiples of 1 minute

      value is incremented in multiples of decihours

      value indicates that the timer is deactivated.

 

 

 

Mapped EPS bearer contexts

 

    Length of Mapped EPS bearer contexts contents

    Mapped EPS bearer context 1

      EPS bearer identity

      Length of Mapped EPS bearer context

      Number of EPS parameters

      Ebit

      Operation code

      EPS parameters list

      EPS parmeter identifier 1

      Length of EPS parameter contents 1

      EPS parameter contents 1

      EPS parmeter identifier 2

      Length of EPS parameter contents 2

      EPS parameter contents 2

      ...

      EPS parmeter identifier n

      Length of EPS parameter contents n

      EPS parameter contents n

    Mapped EPS bearer context 2

      EPS bearer identity

      Length of Mapped EPS bearer context

      Number of EPS parameters

      Ebit

      Operation code

      EPS parameters list

      EPS parmeter identifier 1

      Length of EPS parameter contents 1

      EPS parameter contents 1

      EPS parmeter identifier 2

      Length of EPS parameter contents 2

      EPS parameter contents 2

      ...

      EPS parmeter identifier n

      Length of EPS parameter contents n

      EPS parameter contents n

    ...

    Mapped EPS bearer context N

      EPS bearer identity

      Length of Mapped EPS bearer context

      Number of EPS parameters

      Ebit

      Operation code

      EPS parameters list

      EPS parmeter identifier 1

      Length of EPS parameter contents 1

      EPS parameter contents 1

      EPS parmeter identifier 2

      Length of EPS parameter contents 2

      EPS parameter contents 2

      ...

      EPS parmeter identifier n

      Length of EPS parameter contents n

      EPS parameter contents n

 

 

 

PDU address (24.501 - 9.11.4.10)

 

    PDU address IEI

    PDU session type value

      IPv4

      IPv6

      IPv4v6

    PDU address information

      IPv4 Address (4 Byte)

      IPv6 Address (8 Byte)

      IPv4v6 Address (12 Byte)

 

 

 

PDU session type

    IPv4

    IPv6

    IPv4v6

    Unstructured

    Ethernet

    reserved

 

 

 

QoS rules

 

    QoS rule 1

      QoS rule identifier

      Length of QoS rule

      Number of packet filters

      DQR bit

        0 the QoS rule is not the default QoS rule.

        1 the QoS rule is the default QoS rule.

      Rule operation code

        Reserved

        Create new QoS rule

        Delete existing QoS rule

        Modify existing QoS rule and add packet filters

        Modify existing QoS rule and replace all packet filters

        Modify existing QoS rule and delete packet filters

        Modify existing QoS rule without modifying packet filters

        Reserved

      Packet filter list

      QoS rule precedence

      QoS flow identifier (QFI)

    QoS rule 2

      QoS rule identifier

      Length of QoS rule

      Number of packet filters

      DQR bit

        0 the QoS rule is not the default QoS rule.

        1 the QoS rule is the default QoS rule.

      Rule operation code

        Reserved

        Create new QoS rule

        Delete existing QoS rule

        Modify existing QoS rule and add packet filters

        Modify existing QoS rule and replace all packet filters

        Modify existing QoS rule and delete packet filters

        Modify existing QoS rule without modifying packet filters

        Reserved

      Packet filter list

      QoS rule precedence

      QoS flow identifier (QFI)

    ....

 

 

 

Request Type (24.501-9.11.3.47)

 

    Request type value

      initial request

      existing PDU session

      initial emergency request

      existing emergency PDU session

      modification request

      reserved

    Spare

    Request Type IEI

 

 

 

Session-AMBR (Aggregate Maximum Bit Rate) - (24.501-9.11.4.14)

 

    Session-AMBR IEI

      value is not used

      value is incremented in multiples of 1 Kbps

      value is incremented in multiples of 4 Kbps

      value is incremented in multiples of 16 Kbps

      value is incremented in multiples of 64 Kbps

      value is incremented in multiples of 256 kbps

      value is incremented in multiples of 1 Mbps

      value is incremented in multiples of 4 Mbps

      value is incremented in multiples of 16 Mbps

      value is incremented in multiples of 64 Mbps

      value is incremented in multiples of 256 Mbps

      value is incremented in multiples of 1 Gbps

      value is incremented in multiples of 4 Gbps

      value is incremented in multiples of 16 Gbps

      value is incremented in multiples of 64 Gbps

      value is incremented in multiples of 256 Gbps

      value is incremented in multiples of 1 Tbps

      value is incremented in multiples of 4 Tbps

      value is incremented in multiples of 16 Tbps

      value is incremented in multiples of 64 Tbps

      value is incremented in multiples of 256 Tbps

      value is incremented in multiples of 1 Pbps

      value is incremented in multiples of 4 Pbps

      value is incremented in multiples of 16 Pbps

      value is incremented in multiples of 64 Pbps

      value is incremented in multiples of 256 Pbps

    Length of Session-AMBR contents

    Unit for Session-AMBR for downlink

    Session-AMBR for downlink

    Unit for Session-AMBR for uplink

    Session-AMBR for uplink

 

 

 

SM PDU DN request container

 

    DN-specific identity : network access identifier (NAI) format according to IETF RFC 7542

 

 

 

S-NSSAI

 

    S-NSSAI IEI

    Length of S-NSSAI contents

      SST

      SST and mapped HPLMN SST

      SST and SD

      SST, SD and mapped HPLMN SST

      SST, SD, mapped HPLMN SST and mapped HPLMN SD

    SST(Slice/service type)

    SD(Slice differentiator)

    Mapped HPLMN SST

    Mapped HPLMN SD

 

 

 

SSC (Session and Service Continuity) mode

 

    SSC mode 1

    SSC mode 2

    SSC mode 3

    unused; shall be interpreted as "SSC mode 1", if received by the network

    unused; shall be interpreted as "SSC mode 2", if received by the network

    unused; shall be interpreted as "SSC mode 3", if received by the network

 

 

 

Reference

 

[1] 3GPP SA2 architecture and functions for 5G mobile communication system

[2] 5G beyond radio access: a flatter sliced network

[3] End to End Network Slicing