Why PDU Session Establishment Matters

Every byte of user-plane data in 5G traverses a PDU session -- a logical tunnel between the UE and the Data Network (DN) anchored at the UPF. Without a successfully established PDU session, no internet browsing, video streaming, or IoT telemetry can occur, even if the UE is fully registered with the AMF. Understanding this procedure is essential for troubleshooting data connectivity failures, which account for approximately 35% of all 5G customer complaints according to Ericsson's 2025 Mobility Report.

3GPP defines PDU session establishment in TS 23.502 clause 4.3.2 (procedures for session management) and TS 24.501 clause 6.4 (NAS SM messages). The procedure involves coordinated signaling across the AMF, SMF, UPF, and PCF, with the RAN handling the radio bearer setup.

PDU Session Types and Concepts

A PDU session is characterized by its PDU session type (IPv4, IPv6, IPv4v6, Ethernet, or Unstructured), the S-NSSAI that maps it to a network slice, and the DNN (Data Network Name) that selects the target data network -- analogous to the APN in 4G.

PDU Session Parameters

ParameterDescriptionTypical Value3GPP Reference
PDU Session IDLocally unique identifier (1--15)1--5 per UETS 24.501 clause 9.4
PDU Session TypeIP version or EthernetIPv4v6 (most common)TS 23.501 clause 5.6.1
SSC ModeSession and Service Continuity modeSSC Mode 1 (anchor stays)TS 23.501 clause 5.6.9
DNNData Network Name"internet", "ims", "enterprise1"TS 23.501 clause 5.6.1
S-NSSAISingle Network Slice Selection Assistance InfoSST=1 (eMBB), SD=0x000001TS 23.501 clause 5.15.2
Request TypeInitial, existing, emergency, modificationInitial RequestTS 24.501 clause 9.11.3.47

Session and Service Continuity (SSC) Modes

SSC ModeBehaviorUse CaseAnchor Change
SSC Mode 1UPF anchor never changes during session lifetimeVoNR, enterprise VPNNo
SSC Mode 2Network releases old session and creates new oneBest-effort browsingYes (break-before-make)
SSC Mode 3Network creates new session before releasing oldStreaming, gamingYes (make-before-break)

T-Mobile US reported in their 2025 technical blog that 94% of consumer PDU sessions use SSC Mode 1, with SSC Mode 3 accounting for 5% primarily on low-latency gaming slices.

Complete Signaling Flow -- Step by Step

The PDU session establishment procedure involves 16 key signaling steps between the UE, gNB, AMF, SMF, UDM, PCF, and UPF. The following walkthrough covers an initial PDU session establishment for an IPv4v6 session on the default internet DNN.

Step-by-Step Message Sequence

StepDirectionMessage / OperationProtocolKey IEs
1UE -> AMFNAS: PDU Session Establishment RequestNAS-5G SMPDU Session ID, PTI, PDU Session Type, SSC Mode, DNN, S-NSSAI
2AMF -> SMFNsmf_PDUSession_CreateSMContext RequestHTTP/2 SBISUPI, DNN, S-NSSAI, PDU Session ID, AMF instance ID
3SMF -> UDMNudm_SDM_Get (SM subscription data)HTTP/2 SBISUPI, DNN, S-NSSAI
4UDM -> SMFSM Subscription Data responseHTTP/2 SBIAuthorized QoS, SSC Mode, DNN config
5SMF -> PCFNpcf_SMPolicyControl_CreateHTTP/2 SBISUPI, DNN, S-NSSAI, PDU Session Type
6PCF -> SMFPCC Rules, QoS DecisionHTTP/2 SBIPCC Rules, authorized QoS params, default 5QI
7SMF -> UPFPFCP Session Establishment RequestPFCP (N4)PDRs, FARs, QERs, URRs, F-TEID
8UPF -> SMFPFCP Session Establishment ResponsePFCP (N4)F-TEID (UPF side), UPF node ID
9SMF -> AMFNsmf_PDUSession_CreateSMContext ResponseHTTP/2 SBISM context created acknowledgment
10SMF -> AMFNamf_Communication_N1N2MessageTransferHTTP/2 SBINAS SM msg (PDU Session Establishment Accept), N2 SM Info
11AMF -> gNBNGAP: PDU Session Resource Setup RequestNGAPPDU Session ID, QoS Flow list, GTP-U UPF TEID, NAS PDU
12gNB -> UERRC Reconfiguration (adding DRB)RRCDRB config, QoS flow-to-DRB mapping, SDAP config
13UE -> gNBRRC Reconfiguration CompleteRRC--
14gNB -> AMFNGAP: PDU Session Resource Setup ResponseNGAPGTP-U gNB TEID, QoS Flow list
15AMF -> SMFN2 SM information (gNB tunnel info)HTTP/2 SBIgNB F-TEID for downlink GTP-U
16SMF -> UPFPFCP Session Modification RequestPFCP (N4)Updated FAR with gNB F-TEID (DL tunnel)

The NAS PDU Session Establishment Accept message delivered in step 12 contains the allocated IP address, authorized QoS rules, the default QoS flow descriptor with 5QI, and the session AMBR. This is defined in TS 24.501 clause 8.3.2.

GTP-U Tunnel Architecture

Two GTP-U tunnels are established during the procedure:

  • Uplink tunnel: gNB -> UPF, using the F-TEID provided by the UPF in step 8.
  • Downlink tunnel: UPF -> gNB, using the F-TEID provided by the gNB in step 14.

Each tunnel is identified by a Tunnel Endpoint Identifier (TEID) -- a 32-bit value -- and the transport-layer IP address. The TEID is locally significant at the receiving node. The SMF orchestrates the tunnel binding by relaying TEIDs between the UPF and gNB via the AMF.

Worked Example 1 -- GTP-U Throughput Calculation

A UE establishes a PDU session with a session AMBR of 300 Mbps downlink. The GTP-U tunnel uses UDP/IP encapsulation with the following overhead:

  • GTP-U header: 8 bytes (mandatory) + 4 bytes extension header = 12 bytes
  • UDP header: 8 bytes
  • IP header (outer): 20 bytes (IPv4)
  • Total GTP-U overhead per packet: 12 + 8 + 20 = 40 bytes

For a 1500-byte MTU (inner packet):

  • Total on-wire packet size: 1500 + 40 = 1540 bytes
  • Encapsulation efficiency: 1500 / 1540 = 97.4%
  • Effective user throughput at 300 Mbps session AMBR: 300 x 0.974 = 292.2 Mbps

For small 64-byte VoIP packets:

  • Total on-wire packet size: 64 + 40 = 104 bytes
  • Encapsulation efficiency: 64 / 104 = 61.5%
  • This is why VoNR uses header compression (ROHC) on the radio interface

SK Telecom reported in their 2024 network architecture white paper that GTP-U encapsulation overhead reduces aggregate backhaul throughput by 3--5% for typical traffic mixes, rising to 8% during peak VoNR hours with many small packets.

Worked Example 2 -- PDU Session Establishment Latency Budget

The total time from UE request to data path ready depends on processing at each node. Based on measurements from Deutsche Telekom's 2025 5G SA network:

SegmentProcessing + TransportTypical Latency
UE NAS encoding + RRC ULUE processing + air interface5--8 ms
gNB -> AMF (NGAP)N2 transport1--2 ms
AMF -> SMF (SBI)Service mesh routing2--4 ms
SMF -> UDM + PCF (SBI)Policy and subscription fetch5--12 ms
SMF -> UPF (PFCP N4)Session establishment2--5 ms
Return path AMF -> gNB -> UEN2 + RRC reconfig6--12 ms
Total end-to-end21--43 ms

Deutsche Telekom measured a median PDU session setup time of 28 ms on their 5G SA core (Ericsson dual-site), with the 95th percentile at 52 ms. NTT DOCOMO reported a similar median of 31 ms using a cloud-native core from Nokia.

PFCP on the N4 Interface

The SMF controls the UPF through the Packet Forwarding Control Protocol (PFCP), defined in TS 29.244. The PFCP Session Establishment Request in step 7 carries four critical rule types:

  • PDR (Packet Detection Rule): Matches incoming packets by source interface, IP filter, TEID, or SDF template.
  • FAR (Forwarding Action Rule): Specifies the action -- forward, drop, buffer, or duplicate. Contains the destination TEID and IP for forwarding.
  • QER (QoS Enforcement Rule): Enforces MBR, GBR, and gate status per QoS flow.
  • URR (Usage Reporting Rule): Triggers usage reports for charging (volume, time, or event thresholds).

For a default internet PDU session with a single QoS flow (5QI = 9), the SMF installs:

  • 2 PDRs (one for uplink matching on the N3 F-TEID, one for downlink matching on the UE IP)
  • 2 FARs (one for each direction)
  • 1 QER (session AMBR enforcement)
  • 1 URR (volume-based charging with threshold at 100 MB)

QoS Flow Binding

Each PDU session contains one or more QoS flows, each identified by a QoS Flow Identifier (QFI) -- a 6-bit value (0--63). The default QoS flow is always present and uses the 5QI negotiated during session establishment.

QoS FlowQFI5QITypeMBR/GBRTypical Use
Default19Non-GBRSession AMBR: 300/50 MbpsInternet browsing
Dedicated (voice)21GBRGBR: 56 kbps, MBR: 128 kbpsVoNR
Dedicated (gaming)380Non-GBRPer-flow MBR: 100 MbpsLow-latency gaming

The SDAP (Service Data Adaptation Protocol) layer at the gNB maps QoS flows to DRBs using the QFI in the SDAP header. This mapping is signaled to the UE in the RRC Reconfiguration message (step 12). 3GPP defines SDAP in TS 37.324.

Failure Scenarios and Troubleshooting

Common PDU session establishment failures and their 5GMM/5GSM cause codes:

FailureNAS Cause CodeRoot CauseResolution
Insufficient resources#26UPF pool exhausted or PFCP timeoutScale UPF instances, check N4 connectivity
Missing or unknown DNN#27DNN not provisioned in UDM subscriptionVerify subscriber DNN config in UDR
DNN not allowed#11S-NSSAI + DNN combination rejected by NSSF/AMFCheck NSSAI authorization, slice availability
PDU session type mismatch#28UE requested IPv6 but network only supports IPv4Align PDU session type in UDM subscription
Network failure#38SMF-UPF PFCP association downRestore N4 link, verify PFCP heartbeat

Vodafone Germany reported that DNN-related failures (#27 and #11) account for 41% of PDU session establishment rejects in their 5G SA network, primarily caused by SIM provisioning mismatches during 4G-to-5G migrations.

Operator Deployment Benchmarks

OperatorCore VendorMedian Setup TimeSuccess RatePeak Sessions/secDeployment
T-Mobile USNokia26 ms99.7%45,000Cloud-native, 3 regions
Deutsche TelekomEricsson28 ms99.5%38,000Dual-site active-standby
SK TelecomSamsung24 ms99.8%52,000Edge-distributed UPF
NTT DOCOMONokia31 ms99.4%35,000Multi-vendor (Nokia core + Fujitsu RAN)

SK Telecom's lower latency is attributed to their edge-distributed UPF architecture, where UPFs are deployed at metro edge sites reducing N4 round-trip time to under 1 ms.

UPF Selection and Multi-Homing

The SMF selects the UPF based on DNN, S-NSSAI, UE location (TAI), and local routing policies. In networks with UPF multi-homing or ULCL (Uplink Classifier) architectures, a single PDU session may involve multiple UPFs:

  • PSA UPF (PDU Session Anchor): Terminates the PDU session, allocates the UE IP address.
  • I-UPF (Intermediate UPF): Provides local breakout or branching point.
  • ULCL UPF: Classifies uplink traffic and routes matching flows to a local DN while forwarding the rest to the PSA UPF.

This is defined in TS 23.501 clause 5.6.4 and is essential for edge computing deployments where latency-sensitive traffic must be routed to a nearby MEC server while general internet traffic goes to the central DN.

Key Takeaways for Certification

The PDU session establishment procedure is one of the most frequently tested topics in 5G certification exams. Focus on understanding the N1/N2/N4 interface interactions, the role of PFCP rules at the UPF, the difference between SSC modes, and how QoS flows map to DRBs through SDAP. The signaling sequence -- UE to AMF (NAS), AMF to SMF (SBI), SMF to UPF (PFCP), and the return path through gNB (NGAP + RRC) -- must be committed to memory.

Key Takeaway: PDU session establishment is a multi-node orchestration that creates the end-to-end data path in 5G SA. The SMF acts as the central controller, fetching subscription data from UDM, policy rules from PCF, and programming the UPF via PFCP -- all within a typical 25--30 ms window. Understanding each step and the information exchanged is critical for both network troubleshooting and 5G certification preparation.