Open RAN  - free5gc

 

 

 

 

 

Run

 

As in the case of Installation, excution and test procedure was not complete. At least, GTP / SCTP setup worked and the initial connection with gNB worked OK, but handling NAS message (even the first NAS message) failed.

Nevertheless, I decided to write some note about this before I forget what I have done. It will be very appreciated if there is anybody who can help me with some problems that I faces. You may email me or send me message via my linkedIn.

 

 

 

Before you Run

 

Since 5GC is connected to RAN via gtp and sctp as explained in these notes (GTP, SCTP, NGAP), gtp5g and sctp driver should be properly installed and activated.

 

You can check if gtp5g driver is activated as follows. You would see this without running free5gc if the installation is properly done.

 

 

In the same way, you can check if sctp driver is activated.. but you would see this result only after you run free5gc.

 

 

 

TestSetup

 

The test setup that I used is as shown below. I used Amari callbox as gNB connecting to free5GC.

 

NOTE : At first I tried with a commercial mobile phone, but soon I noticed that free5gc support milenage authentication algorithm only (not supporting 3gpp XOR algorithm). Since I don't have any test USIM with milenage algorithm, I used Amarisoft UEsimulator where I can configure USIM parameters as I want.

 

 

Network Adaptor setting for the virtual box is set as follows.

 

 

route setting on Ubuntu Server in the virtual box is as follows.

 

 

 

 

Configuration

 

Since this is for testing the initial part of 5GC activity, I only set the configuration in AMF part (amfcfg.yaml) as shown below.

 

 

 

Following is the contents of amfcfg.yaml and the red part is what I have changed from the original configuration. It is import to get not only plmn but aslo tac to match between gNB(Amari Callbox) and amf(free5gc) configuration.

 

amfcfg.yaml

info:

  version: 1.0.2

  description: AMF initial local configuration

 

configuration:

  amfName: AMF # the name of this AMF

  ngapIpList:  # the IP list of N2 interfaces on this AMF

    - 10.0.0.230

  sbi: # Service-based interface information

    scheme: http # the protocol for sbi (http or https)

    registerIPv4: 10.0.0.230

     bindingIPv4: 10.0.0.230

    port: 8000

  serviceNameList: # the SBI services provided by this AMF, refer to TS 29.518

    - namf-comm # Namf_Communication service

    - namf-evts # Namf_EventExposure service

    - namf-mt   # Namf_MT service

    - namf-loc  # Namf_Location service

    - namf-oam  # OAM service

  servedGuamiList: # Guami (Globally Unique AMF ID) list supported by this AMF

    # <GUAMI> = <MCC><MNC><AMF ID>

    - plmnId: # Public Land Mobile Network ID, <PLMN ID> = <MCC><MNC>

        mcc: 001 # Mobile Country Code (3 digits string, digit: 0~9)

        mnc: 01 # Mobile Network Code (2 or 3 digits string, digit: 0~9)

      amfId: cafe00 # AMF identifier (3 bytes hex string, range: 000000~FFFFFF)

  supportTaiList:  # the TAI (Tracking Area Identifier) list supported by this AMF

    - plmnId: # Public Land Mobile Network ID, <PLMN ID> = <MCC><MNC>

        mcc: 001 # Mobile Country Code (3 digits string, digit: 0~9)

        mnc: 01 # Mobile Network Code (2 or 3 digits string, digit: 0~9)

        tac: 100 # Tracking Area Code (uinteger, range: 0~16777215)

  plmnSupportList: # the PLMNs (Public land mobile network) list supported by this AMF

    - plmnId: # Public Land Mobile Network ID, <PLMN ID> = <MCC><MNC>

        mcc: 001 # Mobile Country Code (3 digits string, digit: 0~9)

        mnc: 01 # Mobile Network Code (2 or 3 digits string, digit: 0~9)

      snssaiList: # the S-NSSAI (Single Network Slice Selection Assistance Information) list supported by this AMF

        - sst: 1 # Slice/Service Type (uinteger, range: 0~255)

          sd: 010203 # Slice Differentiator (3 bytes hex string, range: 000000~FFFFFF)

        - sst: 1 # Slice/Service Type (uinteger, range: 0~255)

          sd: 112233 # Slice Differentiator (3 bytes hex string, range: 000000~FFFFFF)

  supportDnnList:  # the DNN (Data Network Name) list supported by this AMF

    - internet

  nrfUri: http://127.0.0.10:8000 # a valid URI of NRF

  security:  # NAS security parameters

    integrityOrder: # the priority of integrity algorithms

      - NIA2

      # - NIA0

    cipheringOrder: # the priority of ciphering algorithms

      - NEA0

      # - NEA2

  networkName:  # the name of this core network

    full: free5GC

    short: free

  locality: area1 # Name of the location where a set of AMF, SMF and UPFs are located

  networkFeatureSupport5GS: # 5gs Network Feature Support IE, refer to TS 24.501

    enable: true # append this IE in Registration accept or not

    imsVoPS: 0 # IMS voice over PS session indicator (uinteger, range: 0~1)

    emc: 0 # Emergency service support indicator for 3GPP access (uinteger, range: 0~3)

    emf: 0 # Emergency service fallback indicator for 3GPP access (uinteger, range: 0~3)

    iwkN26: 0 # Interworking without N26 interface indicator (uinteger, range: 0~1)

    mpsi: 0 # MPS indicator (uinteger, range: 0~1)

    emcN3: 0 # Emergency service support indicator for Non-3GPP access (uinteger, range: 0~1)

    mcsi: 0 # MCS indicator (uinteger, range: 0~1)

  t3502Value: 720  # timer value (seconds) at UE side

  t3512Value: 3600 # timer value (seconds) at UE side

  non3gppDeregistrationTimerValue: 3240 # timer value (seconds) at UE side

  # retransmission timer for paging message

  t3513:

    enable: true     # true or false

    expireTime: 6s   # default is 6 seconds

    maxRetryTimes: 4 # the max number of retransmission

  # retransmission timer for NAS Deregistration Request message

  t3522:

    enable: true     # true or false

    expireTime: 6s   # default is 6 seconds

    maxRetryTimes: 4 # the max number of retransmission

  # retransmission timer for NAS Registration Accept message

  t3550:

    enable: true     # true or false

    expireTime: 6s   # default is 6 seconds

    maxRetryTimes: 4 # the max number of retransmission

  # retransmission timer for NAS Authentication Request/Security Mode Command message

  t3560:

    enable: true     # true or false

    expireTime: 6s   # default is 6 seconds

    maxRetryTimes: 4 # the max number of retransmission

  # retransmission timer for NAS Notification message

  t3565:

    enable: true     # true or false

    expireTime: 6s   # default is 6 seconds

    maxRetryTimes: 4 # the max number of retransmission

  # retransmission timer for NAS Identity Request message

  t3570:

    enable: true     # true or false

    expireTime: 6s   # default is 6 seconds

    maxRetryTimes: 4 # the max number of retransmission

 

 

In the hope of resolving the problem that I am facing, I changed ausfcfg.yaml as below, but still no luck.

 

ausfcfg.yaml

info:

  version: 1.0.0

  description: AUSF initial local configuration

 

configuration:

  sbi: # Service-based interface information

    scheme: http # the protocol for sbi (http or https)

    registerIPv4: 127.0.0.9 # IP used to register to NRF

    bindingIPv4: 127.0.0.9  # IP used to bind the service

    port: 8000 # Port used to bind the service

  serviceNameList: # the SBI services provided by this AUSF, refer to TS 29.509

    - nausf-auth # Nausf_UEAuthentication service

  nrfUri: http://127.0.0.10:8000 # a valid URI of NRF

  plmnSupportList: # the PLMNs (Public Land Mobile Network) list supported by this AUSF

    - mcc: 001 # Mobile Country Code (3 digits string, digit: 0~9)

      mnc: 01  # Mobile Network Code (2 or 3 digits string, digit: 0~9)

    - mcc: 123 # Mobile Country Code (3 digits string, digit: 0~9)

      mnc: 45  # Mobile Network Code (2 or 3 digits string, digit: 0~9)

  groupId: ausfGroup001 # ID for the group of the AUSF

  eapAkaSupiImsiPrefix: false # including "imsi-" prefix or not when using the SUPI to do EAP-AKA' authentication

 

 

 

Run Script

 

To run the free5gc, I used the run.sh which run multiple components of the core simultaneously.

 

 

 

Following is the contents of run.sh. You may edit to parameter NF_LIST to specify which components you want to run.

 

run.sh

#!/usr/bin/env bash

 

PID_LIST=()

 

sudo -E ./NFs/upf/build/bin/free5gc-upfd -c ./config/upfcfg.yaml -l ./log/nf/upf.log -g ./log/free5gc.log &

PID_LIST+=($!)

 

sleep 1

 

NF_LIST="nrf amf smf udr pcf udm nssf ausf"

export GIN_MODE=release

 

for NF in ${NF_LIST}; do

    ./bin/${NF} &

    PID_LIST+=($!)

    sleep 0.1

done

 

sudo ./bin/n3iwf &

SUDO_N3IWF_PID=$!

sleep 1

N3IWF_PID=$(pgrep -P $SUDO_N3IWF_PID)

PID_LIST+=($SUDO_N3IWF_PID $N3IWF_PID)

 

function terminate()

{

    sudo kill -SIGTERM ${PID_LIST[${#PID_LIST[@]}-2]} ${PID_LIST[${#PID_LIST[@]}-1]}

    sleep 2

}

 

trap terminate SIGINT

wait ${PID_LIST}

 

 

 

Run

 

Run the 5G Core with the script as shown below.

 

 

 

Initial AMF Activation

 

Initial part (AMF activation) goes without any problem as shown below.

 

From this point, I am getting several pages of error message something like below. I don't know exactly what is the root cause of the problem. (NOTE : I don't see this error any more after the mongodb installation problem was fixed)

 

 

NG Setup

 

When I activate gNB and gNB get connected to AMF in 5GC, I get prints as shown below. Actually pretty complicated process should proceed in the background for this. Refer to these notes (GTP, SCTP, NGAP) if you are interested in further details.

 

 

Handle Registration Request

 

When I power on UE and UE send RegistrationRequest, I see following prints but getting problems at this point as shown below.

 

 

 

Following is the logs that I am getting from Amari Callbox. Line (1),(2),(3),(4) is the initial connection process between gNB and 5GC as explained in these notes (GTP, SCTP, NGAP). I see UE send RegistrationRequest at (5), but this has not been processed by 5GC.

 

 

 

 

[3] NG Setup Request

 

Message: 10.0.0.230:38412 NG setup request

 

Data:

initiatingMessage: {

  procedureCode id-NGSetup,

  criticality reject,

  value {

    protocolIEs {

      {

        id id-GlobalRANNodeID,

        criticality reject,

        value globalGNB-ID: {

          pLMNIdentity '00F110'H,

          gNB-ID gNB-ID: '0012345'H

        }

      },

      {

        id id-RANNodeName,

        criticality ignore,

        value "gnb0012345"

      },

      {

        id id-SupportedTAList,

        criticality reject,

        value {

          {

            tAC '000064'H,

            broadcastPLMNList {

              {

                pLMNIdentity '00F110'H,

                tAISliceSupportList {

                  {

                    s-NSSAI {

                      sST '01'H

                    }

                  }

                }

              }

            }

          }

        }

      },

      {

        id id-DefaultPagingDRX,

        criticality ignore,

        value v128

      }

    }

  }

}

 

 

[4] NG Setup Response

 

Message: 10.0.0.230:38412 NG setup response

 

Data:

successfulOutcome: {

  procedureCode id-NGSetup,

  criticality reject,

  value {

    protocolIEs {

      {

        id id-AMFName,

        criticality reject,

        value "AMF"

      },

      {

        id id-ServedGUAMIList,

        criticality reject,

        value {

          {

            gUAMI {

              pLMNIdentity '00F110'H,

              aMFRegionID 'CA'H,

              aMFSetID '1111111000'B,

              aMFPointer '000000'B

            }

          }

        }

      },

      {

        id id-RelativeAMFCapacity,

        criticality ignore,

        value 255

      },

      {

        id id-PLMNSupportList,

        criticality reject,

        value {

          {

            pLMNIdentity '00F110'H,

            sliceSupportList {

              {

                s-NSSAI {

                  sST '01'H,

                  sD '010203'H

                }

              },

              {

                s-NSSAI {

                  sST '01'H,

                  sD '112233'H

                }

              }

            }

          }

        }

      }

    }

  }

}

 

 

<  1 st Troubleshoot >

 

After mongdodb installation problem is fixed, the procedure went a few step further but the registration request got rejected as follows.

 

 

 

 

 

[5] Registration Request

 

Protocol discriminator = 0x7e (5GS Mobility Management)

Security header = 0x1 (Integrity protected)

Auth code = 0xf4365440

Sequence number = 0x0d

Protocol discriminator = 0x7e (5GS Mobility Management)

Security header = 0x0 (Plain 5GS NAS message, not security protected)

Message type = 0x41 (Registration request)

5GS registration type:

  Follow-on request bit = 1

  Value = 1 (initial registration)

ngKSI:

  TSC = 0

  NAS key set identifier = 0

5GS mobile identity:

  5G-GUTI

    MCC = 001

    MNC = 01

    AMF Region ID = 128

    AMF Set ID = 4

    AMF Pointer = 1

    5G-TMSI = 0xee2ceef7

UE security capability:

  0xf0 (5G-EA0=1, 128-5G-EA1=1, 128-5G-EA2=1, 128-5G-EA3=1, 5G-EA4=0, 5G-EA5=0, 5G-EA6=0, 5G-EA7=0)

  0x70 (5G-IA0=0, 128-5G-IA1=1, 128-5G-IA2=1, 128-5G-IA3=1, 5G-IA4=0, 5G-IA5=0, 5G-IA6=0, 5G-IA7=0)

  0xf0 (EEA0=1, 128-EEA1=1, 128-EEA2=1, 128-EEA3=1, EEA4=0, EEA5=0, EEA6=0, EEA7=0)

  0x70 (EIA0=0, 128-EIA1=1, 128-EIA2=1, 128-EIA3=1, EIA4=0, EIA5=0, EIA6=0, EIA7=0)

NAS message container:

  Protocol discriminator = 0x7e (5GS Mobility Management)

  Security header = 0x0 (Plain 5GS NAS message, not security protected)

  Message type = 0x41 (Registration request)

  5GS registration type:

    Follow-on request bit = 1

    Value = 1 (initial registration)

  ngKSI:

    TSC = 0

    NAS key set identifier = 0

  5GS mobile identity:

    5G-GUTI

      MCC = 001

      MNC = 01

      AMF Region ID = 128

      AMF Set ID = 4

      AMF Pointer = 1

      5G-TMSI = 0xee2ceef7

  5GMM capability:

    0x03 (SGC=0, 5G-IPHC-CP CIoT=0, N3 data=0, 5G-CP CIoT=0, RestrictEC=0, LPP=0, HO attach=1, S1 mode=1)

  UE security capability:

    0xf0 (5G-EA0=1, 128-5G-EA1=1, 128-5G-EA2=1, 128-5G-EA3=1, 5G-EA4=0, 5G-EA5=0, 5G-EA6=0, 5G-EA7=0)

    0x70 (5G-IA0=0, 128-5G-IA1=1, 128-5G-IA2=1, 128-5G-IA3=1, 5G-IA4=0, 5G-IA5=0, 5G-IA6=0, 5G-IA7=0)

    0xf0 (EEA0=1, 128-EEA1=1, 128-EEA2=1, 128-EEA3=1, EEA4=0, EEA5=0, EEA6=0, EEA7=0)

    0x70 (EIA0=0, 128-EIA1=1, 128-EIA2=1, 128-EIA3=1, EIA4=0, EIA5=0, EIA6=0, EIA7=0)

  Requested NSSAI:

    S-NSSAI

      Length of S-NSSAI contents = 1 (SST)

      SST = 0x01

  Last visited registered TAI:

    MCC = 001

    MNC = 01

    TAC = 0x000064

  S1 UE network capability:

    0xf0 (EEA0=1, 128-EEA1=1, 128-EEA2=1, 128-EEA3=1, EEA4=0, EEA5=0, EEA6=0, EEA7=0)

    0x70 (EIA0=0, 128-EIA1=1, 128-EIA2=1, 128-EIA3=1, EIA4=0, EIA5=0, EIA6=0, EIA7=0)

    0xc0 (UEA0=1, UEA1=1, UEA2=0, UEA3=0, UEA4=0, UEA5=0, UEA6=0, UEA7=0)

    0x40 (UCS2=0, UIA1=1, UIA2=0, UIA3=0, UIA4=0, UIA5=0, UIA6=0, UIA7=0)

    0x19 (ProSe-dd=0, ProSe=0, H.245-ASH=0, ACC-CSFB=1, LPP=1, LCS=0, 1xSRVCC=0, NF=1)

    0x80 (ePCO=1, HC-CP CIoT=0, ERw/oPDN=0, S1-U data=0, UP CIoT=0, CP CIoT=0, ProSe-relay=0, ProSe-dc=0)

    0xb0 (15 bearers=1, SGC=0, N1mode=1, DCNR=1, CP backoff=0, RestrictEC=0, V2X PC5=0, multipleDRB=0)

  UE's usage setting = 0x01 (Data centric)

  LADN indication:

    Length = 0

    Data =

  Network slicing indication = 0x00 (DCNI=0, NSSCI=0)

  5GS update type = 0x01 (EPS-PNB-CIoT=no additional information, 5GS-PNB-CIoT=no additional information, NG-RAN-RCU=0, SMS requested=1)

 

 

[6] Initial UE Messages

 

Message: 10.0.0.230:38412 Initial UE message

 

initiatingMessage: {

  procedureCode id-InitialUEMessage,

  criticality ignore,

  value {

    protocolIEs {

      {

        id id-RAN-UE-NGAP-ID,

        criticality reject,

        value 1

      },

      {

        id id-NAS-PDU,

        criticality reject,

        value '7E01F43654400D7E004109000BF200F.....'H

      },

      {

        id id-UserLocationInformation,

        criticality reject,

        value userLocationInformationNR: {

          nR-CGI {

            pLMNIdentity '00F110'H,

            nRCellIdentity '001234501'H

          },

          tAI {

            pLMNIdentity '00F110'H,

            tAC '000064'H

          }

        }

      },

      {

        id id-RRCEstablishmentCause,

        criticality ignore,

        value mo-Signalling

      },

      {

        id id-UEContextRequest,

        criticality ignore,

        value requested

      }

    }

  }

}

 

 

[7] Downlink NAS Transport

 

Message: 10.0.0.230:38412 Downlink NAS transport

 

Data:

initiatingMessage: {

  procedureCode id-DownlinkNASTransport,

  criticality ignore,

  value {

    protocolIEs {

      {

        id id-AMF-UE-NGAP-ID,

        criticality reject,

        value 1

      },

      {

        id id-RAN-UE-NGAP-ID,

        criticality reject,

        value 1

      },

      {

        id id-NAS-PDU,

        criticality reject,

        value '7E004409'H

      }

    }

  }

}

 

 

[8] Registration Reject

 

Message: Registration reject

 

Protocol discriminator = 0x7e (5GS Mobility Management)

Security header = 0x0 (Plain 5GS NAS message, not security protected)

Message type = 0x44 (Registration reject)

5GMM cause = 0x09 (UE identity cannot be derived by the network)

 

 

< 2nd Troubleshooting >

 

Again with the help of Chlosta, Merlin, I learned that free5gc does not allow the registration with TMSI. 

==> This behavior of free5gc does not seems to be correct. Chlosta raised a PR for this on Feb 24 2022.

The UE that I used(OnePLUS) was trying to register with TMSI and I didn't know how to get the UE to register with IMSI. So I used Amari UEsim as a DUT. It registered with IMSI and free5gc didn't rejected the initial Registration Request, but it reached another point of error as shown below.

 

 

 

< 3rd Trougleshooting >

 

It looks obvious that this error comes from the missing UE information (SIM parameter etc) and I didn't know how to add UE information to free5gc. Again, with the help of Chlosta, Merlin, I learned that I should add UE information with webconsole.

 

First added the Subcribers to free5gc in webconsole as shown below. I put only those parameters as shown below and all the others remain as default without any change. The goal at this step is only to pass authentication step and did not focus much on the steps afterwards. Of course, you need to configure same settings on UE side SIM (In my case, I configured the same in Amari UEsim configuration file).

 

 

 

Then tested again and it reaches to following point. Obviously it passed authentication and you would see some DNN / Network slice related problems which will be described in next setion. The full log from free5gc is here.

 

 

 

I collected the log from Amari Callbox (gNB) as shown below.

 

 

[5]  Registration request

 

Protocol discriminator = 0x7e (5GS Mobility Management)

Security header = 0x0 (Plain 5GS NAS message, not security protected)

Message type = 0x41 (Registration request)

5GS registration type:

  Follow-on request bit = 1

  Value = 1 (initial registration)

ngKSI:

  TSC = 0

  NAS key set identifier = 7

5GS mobile identity:

  SUCI

    SUPI format = 0 (IMSI)

    MCC = 001

    MNC = 01

    Routing indicator = 0

    Protection sheme id = 0 (Null scheme)

    Home network public key identifier = 0

    MSIN = 0000000001

UE security capability:

  0xe0 (5G-EA0=1, 128-5G-EA1=1, 128-5G-EA2=1, 128-5G-EA3=0, 5G-EA4=0, 5G-EA5=0, 5G-EA6=0, 5G-EA7=0)

  0xe0 (5G-IA0=1, 128-5G-IA1=1, 128-5G-IA2=1, 128-5G-IA3=0, 5G-IA4=0, 5G-IA5=0, 5G-IA6=0, 5G-IA7=0)

 

 

[6] Initial UE message

 

initiatingMessage: {

  procedureCode id-InitialUEMessage,

  criticality ignore,

  value {

    protocolIEs {

      {

        id id-RAN-UE-NGAP-ID,

        criticality reject,

        value 1

      },

      {

        id id-NAS-PDU,

        criticality reject,

        value '7E004179000D0100F110F0FF000000000000102E02E0E0'H

      },

      {

        id id-UserLocationInformation,

        criticality reject,

        value userLocationInformationNR: {

          nR-CGI {

            pLMNIdentity '00F110'H,

            nRCellIdentity '001234501'H

          },

          tAI {

            pLMNIdentity '00F110'H,

            tAC '000064'H

          }

        }

      },

      {

        id id-RRCEstablishmentCause,

        criticality ignore,

        value mo-Signalling

      },

      {

        id id-UEContextRequest,

        criticality ignore,

        value requested

      }

    }

  }

}  

 

 

[7] Downlink NAS transport

 

initiatingMessage: {

  procedureCode id-DownlinkNASTransport,

  criticality ignore,

  value {

    protocolIEs {

      {

        id id-AMF-UE-NGAP-ID,

        criticality reject,

        value 1

      },

      {

        id id-RAN-UE-NGAP-ID,

        criticality reject,

        value 1

      },

      {

        id id-NAS-PDU,

        criticality reject,

        value '7E005600020000217080C76C04D9B6BD7134BC81F67DF.....'H

      }

    }

  }

}

 

 

[8] Authentication request

 

Protocol discriminator = 0x7e (5GS Mobility Management)

Security header = 0x0 (Plain 5GS NAS message, not security protected)

Message type = 0x56 (Authentication request)

ngKSI:

  TSC = 0

  NAS key set identifier = 0

ABBA:

  Length = 2

  Data = 00 00

Authentication parameter RAND:

  Data = 70 80 c7 6c 04 d9 b6 bd 71 34 bc 81 f6 7d f5 6e

Authentication parameter AUTN:

  Length = 16

  Data = 1d d0 86 ca 6d eb 80 00 fd af d9 b0 31 57 9f 54

 

 

[9] Authentication response

 

Protocol discriminator = 0x7e (5GS Mobility Management)

Security header = 0x0 (Plain 5GS NAS message, not security protected)

Message type = 0x57 (Authentication response)

Authentication response parameter:

  Length = 16

  Data = 0e 17 9d 79 f8 da 44 93 f1 4f 02 a8 f7 b6 77 82

 

 

[10] Uplink NAS transport

 

initiatingMessage: {

  procedureCode id-UplinkNASTransport,

  criticality ignore,

  value {

    protocolIEs {

      {

        id id-AMF-UE-NGAP-ID,

        criticality reject,

        value 1

      },

      {

        id id-RAN-UE-NGAP-ID,

        criticality reject,

        value 1

      },

      {

        id id-NAS-PDU,

        criticality reject,

        value '7E00572D100E179D79F8DA4493F14F02A8F7B67782'H

      },

      {

        id id-UserLocationInformation,

        criticality ignore,

        value userLocationInformationNR: {

          nR-CGI {

            pLMNIdentity '00F110'H,

            nRCellIdentity '001234501'H

          },

          tAI {

            pLMNIdentity '00F110'H,

            tAC '000064'H

          }

        }

      }

    }

  }

}

 

 

[11] Downlink NAS transport

 

initiatingMessage: {

  procedureCode id-DownlinkNASTransport,

  criticality ignore,

  value {

    protocolIEs {

      {

        id id-AMF-UE-NGAP-ID,

        criticality reject,

        value 1

      },

      {

        id id-RAN-UE-NGAP-ID,

        criticality reject,

        value 1

      },

      {

        id id-NAS-PDU,

        criticality reject,

        value '7E036BC9DC66007E005D020002E0E0E1360100'H

      }

    }

  }

}

 

 

[12]  Security mode command

 

Protocol discriminator = 0x7e (5GS Mobility Management)

Security header = 0x3 (Integrity protected with new 5G NAS security context)

Auth code = 0x6bc9dc66

Sequence number = 0x00

Protocol discriminator = 0x7e (5GS Mobility Management)

Security header = 0x0 (Plain 5GS NAS message, not security protected)

Message type = 0x5d (Security mode command)

Selected NAS security algorithms = 0x02 (5G-EA0, 5G-IA2)

ngKSI:

  TSC = 0

  NAS key set identifier = 0

Replayed UE security capabilities:

  0xe0 (5G-EA0=1, 128-5G-EA1=1, 128-5G-EA2=1, 128-5G-EA3=0, 5G-EA4=0, 5G-EA5=0, 5G-EA6=0, 5G-EA7=0)

  0xe0 (5G-IA0=1, 128-5G-IA1=1, 128-5G-IA2=1, 128-5G-IA3=0, 5G-IA4=0, 5G-IA5=0, 5G-IA6=0, 5G-IA7=0)

IMEISV request = 1

Additional 5G security information = 0x00 (RINMR=0, HDP=0)

 

 

[13] Security mode complete

 

Protocol discriminator = 0x7e (5GS Mobility Management)

Security header = 0x4 (Integrity protected and ciphered with new 5G NAS security context)

Auth code = 0x34006c9a

Sequence number = 0x00

Protocol discriminator = 0x7e (5GS Mobility Management)

Security header = 0x0 (Plain 5GS NAS message, not security protected)

Message type = 0x5e (Security mode complete)

IMEISV:

  IMEISV = 0123456700000101

NAS message container:

  Protocol discriminator = 0x7e (5GS Mobility Management)

  Security header = 0x0 (Plain 5GS NAS message, not security protected)

  Message type = 0x41 (Registration request)

  5GS registration type:

    Follow-on request bit = 1

    Value = 1 (initial registration)

  ngKSI:

    TSC = 0

    NAS key set identifier = 7

  5GS mobile identity:

    SUCI

      SUPI format = 0 (IMSI)

      MCC = 001

      MNC = 01

      Routing indicator = 0

      Protection sheme id = 0 (Null scheme)

      Home network public key identifier = 0

      MSIN = 0000000001

  5GMM capability:

    0x00 (SGC=0, 5G-IPHC-CP CIoT=0, N3 data=0, 5G-CP CIoT=0, RestrictEC=0, LPP=0, HO attach=0, S1 mode=0)

  UE security capability:

    0xe0 (5G-EA0=1, 128-5G-EA1=1, 128-5G-EA2=1, 128-5G-EA3=0, 5G-EA4=0, 5G-EA5=0, 5G-EA6=0, 5G-EA7=0)

    0xe0 (5G-IA0=1, 128-5G-IA1=1, 128-5G-IA2=1, 128-5G-IA3=0, 5G-IA4=0, 5G-IA5=0, 5G-IA6=0, 5G-IA7=0)

  UE's usage setting = 0x01 (Data centric)

  5GS update type = 0x01 (EPS-PNB-CIoT=no additional information, 5GS-PNB-CIoT=no additional information,

                                    NG-RAN-RCU=0, SMS requested=1)

 

 

[14] Uplink NAS transport

 

initiatingMessage: {

  procedureCode id-UplinkNASTransport,

  criticality ignore,

  value {

    protocolIEs {

      {

        id id-AMF-UE-NGAP-ID,

        criticality reject,

        value 1

      },

      {

        id id-RAN-UE-NGAP-ID,

        criticality reject,

        value 1

      },

      {

        id id-NAS-PDU,

        criticality reject,

        value '7E0434006C9A007E005E770009052143650700000...'H

      },

      {

        id id-UserLocationInformation,

        criticality ignore,

        value userLocationInformationNR: {

          nR-CGI {

            pLMNIdentity '00F110'H,

            nRCellIdentity '001234501'H

          },

          tAI {

            pLMNIdentity '00F110'H,

            tAC '000064'H

          }

        }

      }

    }

  }

}

 

 

[15] Initial context setup request

 

initiatingMessage: {

  procedureCode id-InitialContextSetup,

  criticality reject,

  value {

    protocolIEs {

      {

        id id-AMF-UE-NGAP-ID,

        criticality reject,

        value 1

      },

      {

        id id-RAN-UE-NGAP-ID,

        criticality reject,

        value 1

      },

      {

        id id-GUAMI,

        criticality reject,

        value {

          pLMNIdentity '00F110'H,

          aMFRegionID 'CA'H,

          aMFSetID '1111111000'B,

          aMFPointer '000000'B

        }

      },

      {

        id id-AllowedNSSAI,

        criticality reject,

        value {

          {

            s-NSSAI {

              sST '01'H,

              sD '010203'H

            }

          },

          {

            s-NSSAI {

              sST '01'H,

              sD '010203'H

            }

          }

        }

      },

      {

        id id-UESecurityCapabilities,

        criticality reject,

        value {

          nRencryptionAlgorithms 'C000'H,

          nRintegrityProtectionAlgorithms 'C000'H,

          eUTRAencryptionAlgorithms '0000'H,

          eUTRAintegrityProtectionAlgorithms '0000'H

        }

      },

      {

        id id-SecurityKey,

        criticality reject,

        value 'CB40645A12BACB4867C0615B9A7380FFCACBF4CB750F01239163EBF51409BEDE'H

      },

      {

        id id-MobilityRestrictionList,

        criticality ignore,

        value {

          servingPLMN '00F110'H

        }

      },

      {

        id id-MaskedIMEISV,

        criticality ignore,

        value '0123456700FFFF01'H

      },

      {

        id id-NAS-PDU,

        criticality ignore,

        value '7E0226230C3C017E0042010177000BF200F110CA....'H

      }

    }

  }

}

 

 

[16] unsupported allowed S-NSSAI, reject request

 

 

[17] Initial context setup failure

 

unsuccessfulOutcome: {

  procedureCode id-InitialContextSetup,

  criticality reject,

  value {

    protocolIEs {

      {

        id id-AMF-UE-NGAP-ID,

        criticality ignore,

        value 1

      },

      {

        id id-RAN-UE-NGAP-ID,

        criticality ignore,

        value 1

      },

      {

        id id-Cause,

        criticality ignore,

        value radioNetwork: slice-not-supported

      }

    }

  }

}

 

 

[18] Downlink NAS transport

                                            ,

initiatingMessage: {

  procedureCode id-DownlinkNASTransport,

  criticality ignore,

  value {

    protocolIEs {

      {

        id id-AMF-UE-NGAP-ID,

        criticality reject,

        value 1

      },

      {

        id id-RAN-UE-NGAP-ID,

        criticality reject,

        value 1

      },

      {

        id id-NAS-PDU,

        criticality reject,

        value '7E0226230C3C017E0042010177000BF200F110CAFE0....'H

      }

    }

  }

}

 

 

[19] Registration accept

 

Protocol discriminator = 0x7e (5GS Mobility Management)

Security header = 0x2 (Integrity protected and ciphered)

Auth code = 0x26230c3c

Sequence number = 0x01

Protocol discriminator = 0x7e (5GS Mobility Management)

Security header = 0x0 (Plain 5GS NAS message, not security protected)

Message type = 0x42 (Registration accept)

5GS registration result = 0x01 (Emergency registered=0, NSSAA to be performed=0, SMS allowed=0, 3GPP access)

5G-GUTI:

  5G-GUTI

    MCC = 001

    MNC = 01

    AMF Region ID = 202

    AMF Set ID = 1016

    AMF Pointer = 0

    5G-TMSI = 0x00000001

TAI list:

  Length = 7

  Data = 00 00 f1 10 00 00 64

Allowed NSSAI:

  S-NSSAI

    Length of S-NSSAI contents = 4 (SST and SD)

    SST = 0x01

    SD = 0x010203

  S-NSSAI

    Length of S-NSSAI contents = 4 (SST and SD)

    SST = 0x01

    SD = 0x010203

5GS network feature support:

  0x00 (MPSI=0, IWK N26=0, EMF=not supported, EMC=not supported, IMS-VoPS-N3GPP=0, IMS-VoPS-3GPP=0)

  0x00 (5G-UP CIoT=0, 5G-IPHC-CP CIoT=0, N3 data=0, 5G-CP CIoT=0,

          RestrictEC=both CE mode A and CE mode B are not restricted, MCSI=0, EMCN3=0)

T3512 value:

  Value = 6

  Unit = 0 (10 minutes)

T3502 value:

  Value = 12

  Unit = 1 (1 minute)  

 

 

[20] Registration complete

 

Protocol discriminator = 0x7e (5GS Mobility Management)

Security header = 0x2 (Integrity protected and ciphered)

Auth code = 0x52279dc3

Sequence number = 0x01

Protocol discriminator = 0x7e (5GS Mobility Management)

Security header = 0x0 (Plain 5GS NAS message, not security protected)

Message type = 0x43 (Registration complete)

 

 

[21] Uplink NAS transport

 

initiatingMessage: {

  procedureCode id-UplinkNASTransport,

  criticality ignore,

  value {

    protocolIEs {

      {

        id id-AMF-UE-NGAP-ID,

        criticality reject,

        value 1

      },

      {

        id id-RAN-UE-NGAP-ID,

        criticality reject,

        value 1

      },

      {

        id id-NAS-PDU,

        criticality reject,

        value '7E0252279DC3017E0043'H

      },

      {

        id id-UserLocationInformation,

        criticality ignore,

        value userLocationInformationNR: {

          nR-CGI {

            pLMNIdentity '00F110'H,

            nRCellIdentity '001234501'H

          },

          tAI {

            pLMNIdentity '00F110'H,

            tAC '000064'H

          }

        }

      }

    }

  }

}  

 

 

[23] UL NAS transport

 

Protocol discriminator = 0x7e (5GS Mobility Management)

Security header = 0x2 (Integrity protected and ciphered)

Auth code = 0x09371cdb

Sequence number = 0x02

Protocol discriminator = 0x7e (5GS Mobility Management)

Security header = 0x0 (Plain 5GS NAS message, not security protected)

Message type = 0x67 (UL NAS transport)

Payload container type = 1 (N1 SM information)

Payload container:

  Protocol discriminator = 0x2e (5GS Session Management)

  PDU session identity = 1

  Procedure transaction identity = 1

  Message type = 0xc1 (PDU session establishment request)

  Integrity protection maximum data data:

    Maximum data rate per UE for user-plane integrity protection for uplink = 0xff (Full data rate)

    Maximum data rate per UE for user-plane integrity protection for downlink = 0xff (Full data rate)

  PDU session type = 0x3 (IPv4v6)

  Always-on PDU session requested = 1

  Extended protocol configuration options:

    Ext = 1

    Configuration protocol = 0

    Protocol ID = 0x8021 (IPCP)

    Data = 01 00 00 10 81 06 00 00 00 00 83 06 00 00 00 00

    Protocol ID = 0x0001 (P-CSCF IPv6 Address Request)

    Data =

    Protocol ID = 0x0003 (DNS Server IPv6 Address Request)

    Data =

    Protocol ID = 0x000a (IP address allocation via NAS signalling)

    Data =

    Protocol ID = 0x000c (P-CSCF IPv4 Address Request)

    Data =

    Protocol ID = 0x000d (DNS Server IPv4 Address Request)

    Data =

PDU session ID = 1

Request type = 0x1 (initial request)

 

 

[24] Uplink NAS transport

 

initiatingMessage: {

  procedureCode id-UplinkNASTransport,

  criticality ignore,

  value {

    protocolIEs {

      {

        id id-AMF-UE-NGAP-ID,

        criticality reject,

        value 1

      },

      {

        id id-RAN-UE-NGAP-ID,

        criticality reject,

        value 1

      },

      {

        id id-NAS-PDU,

        criticality reject,

        value '7E0209371CDB027E006701002E2E0101C1FFFF93...'H

      },

      {

        id id-UserLocationInformation,

        criticality ignore,

        value userLocationInformationNR: {

          nR-CGI {

            pLMNIdentity '00F110'H,

            nRCellIdentity '001234501'H

          },

          tAI {

            pLMNIdentity '00F110'H,

            tAC '000064'H

          }

        }

      }

    }

  }

}

 

 

[25] Downlink NAS transport

 

initiatingMessage: {

  procedureCode id-DownlinkNASTransport,

  criticality ignore,

  value {

    protocolIEs {

      {

        id id-AMF-UE-NGAP-ID,

        criticality reject,

        value 1

      },

      {

        id id-RAN-UE-NGAP-ID,

        criticality reject,

        value 1

      },

      {

        id id-NAS-PDU,

        criticality reject,

        value '7E02C0288170027E006801002E2E0101C1FFF...'H

      }

    }

  }

}

 

 

[26] DL NAS transport

 

Protocol discriminator = 0x7e (5GS Mobility Management)

Security header = 0x2 (Integrity protected and ciphered)

Auth code = 0xc0288170

Sequence number = 0x02

Protocol discriminator = 0x7e (5GS Mobility Management)

Security header = 0x0 (Plain 5GS NAS message, not security protected)

Message type = 0x68 (DL NAS transport)

Payload container type = 1 (N1 SM information)

Payload container:

  Protocol discriminator = 0x2e (5GS Session Management)

  PDU session identity = 1

  Procedure transaction identity = 1

  Message type = 0xc1 (PDU session establishment request)

  Integrity protection maximum data data:

    Maximum data rate per UE for user-plane integrity protection for uplink = 0xff (Full data rate)

    Maximum data rate per UE for user-plane integrity protection for downlink = 0xff (Full data rate)

  PDU session type = 0x3 (IPv4v6)

  Always-on PDU session requested = 1

  Extended protocol configuration options:

    Ext = 1

    Configuration protocol = 0

    Protocol ID = 0x8021 (IPCP)

    Data = 01 00 00 10 81 06 00 00 00 00 83 06 00 00 00 00

    Protocol ID = 0x0001 (P-CSCF IPv6 Address Request)

    Data =

    Protocol ID = 0x0003 (DNS Server IPv6 Address Request)

    Data =

    Protocol ID = 0x000a (IP address allocation via NAS signalling)

    Data =

    Protocol ID = 0x000c (P-CSCF IPv4 Address Request)

    Data =

    Protocol ID = 0x000d (DNS Server IPv4 Address Request)

    Data =

PDU session ID = 1

5GMM cause = 0x5b (DNN not supported or not subscribed in the slice)

 

 

 

PDU Session Establishment

 

From previous log, I spotted several points that I need to clarify. It can be summarized as follows.

  • [5]  UE send Registration request without Requested NSSAI
  • [13] UE send Registration request without Requested NSSAI
  • [15] CORE NETWORK send Initial Context Setup Request with AllowedNSSAI
  • [16]/[17] gNB sends Initial Context Setup Failure with the cause of slice-not-supported <== this is because the NSSAI configured in free5GC and configured in Amari gNB is different. This can be fixed easily later.
  • [23] gNB/UE send PDU Session Establishment without DNN Specified.
  • [26] Core Network sends gNB/UE send PDU Session Establishment with 5GMM Cause of DNN not supported or not subscribed in the slice ==> I think this is difference between free5GC and Amari Core. In Amarisoft core, [23] is accepted and the core send PDU Session Establishement with dnn=default, but free5GC does not.

I think [26] is related to following specification described in 24.501-5.4.5.3.2

In case e) in subclause 5.4.5.3.1, i.e. upon sending a single uplink 5GSM message which was not forwarded due to routing failure, the AMF shall:

    a) include the PDU session ID in the PDU session ID IE;

    b) set the Payload container type IE to "N1 SM information";

    c) set the Payload container IE to the 5GSM message which was not forwarded; and

    d) set the 5GMM cause IE to the 5GMM cause #90 "payload was not forwarded" or 5GMM cause #91 "DNN not supported or not subscribed in the slice".

The AMF sets the 5GMM cause IE to the 5GMM cause #91 "DNN not supported or not subscribed in the slice",

if the 5GSM message could not be forwarded since SMF selection fails because:

    1) the DNN is not supported in the slice identified by the S-NSSAI used by the AMF; or

    2) neither the DNN provided by the UE nor the wildcard DNN are in the subscribed DNN list of the UE for the S-NSSAI used by the AMF.

Otherwise, the AMF sets the 5GMM cause IE to the 5GMM cause #90 "payload was not forwarded".