Why PDU Session Establishment Matters
Every byte of user-plane data in 5G traverses a PDU session -- a logical tunnel between the UE and the Data Network (DN) anchored at the UPF. Without a successfully established PDU session, no internet browsing, video streaming, or IoT telemetry can occur, even if the UE is fully registered with the AMF. Understanding this procedure is essential for troubleshooting data connectivity failures, which account for approximately 35% of all 5G customer complaints according to Ericsson's 2025 Mobility Report.
3GPP defines PDU session establishment in TS 23.502 clause 4.3.2 (procedures for session management) and TS 24.501 clause 6.4 (NAS SM messages). The procedure involves coordinated signaling across the AMF, SMF, UPF, and PCF, with the RAN handling the radio bearer setup.
PDU Session Types and Concepts
A PDU session is characterized by its PDU session type (IPv4, IPv6, IPv4v6, Ethernet, or Unstructured), the S-NSSAI that maps it to a network slice, and the DNN (Data Network Name) that selects the target data network -- analogous to the APN in 4G.
PDU Session Parameters
| Parameter | Description | Typical Value | 3GPP Reference |
|---|---|---|---|
| PDU Session ID | Locally unique identifier (1--15) | 1--5 per UE | TS 24.501 clause 9.4 |
| PDU Session Type | IP version or Ethernet | IPv4v6 (most common) | TS 23.501 clause 5.6.1 |
| SSC Mode | Session and Service Continuity mode | SSC Mode 1 (anchor stays) | TS 23.501 clause 5.6.9 |
| DNN | Data Network Name | "internet", "ims", "enterprise1" | TS 23.501 clause 5.6.1 |
| S-NSSAI | Single Network Slice Selection Assistance Info | SST=1 (eMBB), SD=0x000001 | TS 23.501 clause 5.15.2 |
| Request Type | Initial, existing, emergency, modification | Initial Request | TS 24.501 clause 9.11.3.47 |
Session and Service Continuity (SSC) Modes
| SSC Mode | Behavior | Use Case | Anchor Change |
|---|---|---|---|
| SSC Mode 1 | UPF anchor never changes during session lifetime | VoNR, enterprise VPN | No |
| SSC Mode 2 | Network releases old session and creates new one | Best-effort browsing | Yes (break-before-make) |
| SSC Mode 3 | Network creates new session before releasing old | Streaming, gaming | Yes (make-before-break) |
T-Mobile US reported in their 2025 technical blog that 94% of consumer PDU sessions use SSC Mode 1, with SSC Mode 3 accounting for 5% primarily on low-latency gaming slices.
Complete Signaling Flow -- Step by Step
The PDU session establishment procedure involves 16 key signaling steps between the UE, gNB, AMF, SMF, UDM, PCF, and UPF. The following walkthrough covers an initial PDU session establishment for an IPv4v6 session on the default internet DNN.
Step-by-Step Message Sequence
| Step | Direction | Message / Operation | Protocol | Key IEs |
|---|---|---|---|---|
| 1 | UE -> AMF | NAS: PDU Session Establishment Request | NAS-5G SM | PDU Session ID, PTI, PDU Session Type, SSC Mode, DNN, S-NSSAI |
| 2 | AMF -> SMF | Nsmf_PDUSession_CreateSMContext Request | HTTP/2 SBI | SUPI, DNN, S-NSSAI, PDU Session ID, AMF instance ID |
| 3 | SMF -> UDM | Nudm_SDM_Get (SM subscription data) | HTTP/2 SBI | SUPI, DNN, S-NSSAI |
| 4 | UDM -> SMF | SM Subscription Data response | HTTP/2 SBI | Authorized QoS, SSC Mode, DNN config |
| 5 | SMF -> PCF | Npcf_SMPolicyControl_Create | HTTP/2 SBI | SUPI, DNN, S-NSSAI, PDU Session Type |
| 6 | PCF -> SMF | PCC Rules, QoS Decision | HTTP/2 SBI | PCC Rules, authorized QoS params, default 5QI |
| 7 | SMF -> UPF | PFCP Session Establishment Request | PFCP (N4) | PDRs, FARs, QERs, URRs, F-TEID |
| 8 | UPF -> SMF | PFCP Session Establishment Response | PFCP (N4) | F-TEID (UPF side), UPF node ID |
| 9 | SMF -> AMF | Nsmf_PDUSession_CreateSMContext Response | HTTP/2 SBI | SM context created acknowledgment |
| 10 | SMF -> AMF | Namf_Communication_N1N2MessageTransfer | HTTP/2 SBI | NAS SM msg (PDU Session Establishment Accept), N2 SM Info |
| 11 | AMF -> gNB | NGAP: PDU Session Resource Setup Request | NGAP | PDU Session ID, QoS Flow list, GTP-U UPF TEID, NAS PDU |
| 12 | gNB -> UE | RRC Reconfiguration (adding DRB) | RRC | DRB config, QoS flow-to-DRB mapping, SDAP config |
| 13 | UE -> gNB | RRC Reconfiguration Complete | RRC | -- |
| 14 | gNB -> AMF | NGAP: PDU Session Resource Setup Response | NGAP | GTP-U gNB TEID, QoS Flow list |
| 15 | AMF -> SMF | N2 SM information (gNB tunnel info) | HTTP/2 SBI | gNB F-TEID for downlink GTP-U |
| 16 | SMF -> UPF | PFCP Session Modification Request | PFCP (N4) | Updated FAR with gNB F-TEID (DL tunnel) |
The NAS PDU Session Establishment Accept message delivered in step 12 contains the allocated IP address, authorized QoS rules, the default QoS flow descriptor with 5QI, and the session AMBR. This is defined in TS 24.501 clause 8.3.2.
GTP-U Tunnel Architecture
Two GTP-U tunnels are established during the procedure:
- Uplink tunnel: gNB -> UPF, using the F-TEID provided by the UPF in step 8.
- Downlink tunnel: UPF -> gNB, using the F-TEID provided by the gNB in step 14.
Each tunnel is identified by a Tunnel Endpoint Identifier (TEID) -- a 32-bit value -- and the transport-layer IP address. The TEID is locally significant at the receiving node. The SMF orchestrates the tunnel binding by relaying TEIDs between the UPF and gNB via the AMF.
Worked Example 1 -- GTP-U Throughput Calculation
A UE establishes a PDU session with a session AMBR of 300 Mbps downlink. The GTP-U tunnel uses UDP/IP encapsulation with the following overhead:
- GTP-U header: 8 bytes (mandatory) + 4 bytes extension header = 12 bytes
- UDP header: 8 bytes
- IP header (outer): 20 bytes (IPv4)
- Total GTP-U overhead per packet: 12 + 8 + 20 = 40 bytes
For a 1500-byte MTU (inner packet):
- Total on-wire packet size: 1500 + 40 = 1540 bytes
- Encapsulation efficiency: 1500 / 1540 = 97.4%
- Effective user throughput at 300 Mbps session AMBR: 300 x 0.974 = 292.2 Mbps
For small 64-byte VoIP packets:
- Total on-wire packet size: 64 + 40 = 104 bytes
- Encapsulation efficiency: 64 / 104 = 61.5%
- This is why VoNR uses header compression (ROHC) on the radio interface
SK Telecom reported in their 2024 network architecture white paper that GTP-U encapsulation overhead reduces aggregate backhaul throughput by 3--5% for typical traffic mixes, rising to 8% during peak VoNR hours with many small packets.
Worked Example 2 -- PDU Session Establishment Latency Budget
The total time from UE request to data path ready depends on processing at each node. Based on measurements from Deutsche Telekom's 2025 5G SA network:
| Segment | Processing + Transport | Typical Latency |
|---|---|---|
| UE NAS encoding + RRC UL | UE processing + air interface | 5--8 ms |
| gNB -> AMF (NGAP) | N2 transport | 1--2 ms |
| AMF -> SMF (SBI) | Service mesh routing | 2--4 ms |
| SMF -> UDM + PCF (SBI) | Policy and subscription fetch | 5--12 ms |
| SMF -> UPF (PFCP N4) | Session establishment | 2--5 ms |
| Return path AMF -> gNB -> UE | N2 + RRC reconfig | 6--12 ms |
| Total end-to-end | 21--43 ms |
Deutsche Telekom measured a median PDU session setup time of 28 ms on their 5G SA core (Ericsson dual-site), with the 95th percentile at 52 ms. NTT DOCOMO reported a similar median of 31 ms using a cloud-native core from Nokia.
PFCP on the N4 Interface
The SMF controls the UPF through the Packet Forwarding Control Protocol (PFCP), defined in TS 29.244. The PFCP Session Establishment Request in step 7 carries four critical rule types:
- PDR (Packet Detection Rule): Matches incoming packets by source interface, IP filter, TEID, or SDF template.
- FAR (Forwarding Action Rule): Specifies the action -- forward, drop, buffer, or duplicate. Contains the destination TEID and IP for forwarding.
- QER (QoS Enforcement Rule): Enforces MBR, GBR, and gate status per QoS flow.
- URR (Usage Reporting Rule): Triggers usage reports for charging (volume, time, or event thresholds).
For a default internet PDU session with a single QoS flow (5QI = 9), the SMF installs:
- 2 PDRs (one for uplink matching on the N3 F-TEID, one for downlink matching on the UE IP)
- 2 FARs (one for each direction)
- 1 QER (session AMBR enforcement)
- 1 URR (volume-based charging with threshold at 100 MB)
QoS Flow Binding
Each PDU session contains one or more QoS flows, each identified by a QoS Flow Identifier (QFI) -- a 6-bit value (0--63). The default QoS flow is always present and uses the 5QI negotiated during session establishment.
| QoS Flow | QFI | 5QI | Type | MBR/GBR | Typical Use |
|---|---|---|---|---|---|
| Default | 1 | 9 | Non-GBR | Session AMBR: 300/50 Mbps | Internet browsing |
| Dedicated (voice) | 2 | 1 | GBR | GBR: 56 kbps, MBR: 128 kbps | VoNR |
| Dedicated (gaming) | 3 | 80 | Non-GBR | Per-flow MBR: 100 Mbps | Low-latency gaming |
The SDAP (Service Data Adaptation Protocol) layer at the gNB maps QoS flows to DRBs using the QFI in the SDAP header. This mapping is signaled to the UE in the RRC Reconfiguration message (step 12). 3GPP defines SDAP in TS 37.324.
Failure Scenarios and Troubleshooting
Common PDU session establishment failures and their 5GMM/5GSM cause codes:
| Failure | NAS Cause Code | Root Cause | Resolution |
|---|---|---|---|
| Insufficient resources | #26 | UPF pool exhausted or PFCP timeout | Scale UPF instances, check N4 connectivity |
| Missing or unknown DNN | #27 | DNN not provisioned in UDM subscription | Verify subscriber DNN config in UDR |
| DNN not allowed | #11 | S-NSSAI + DNN combination rejected by NSSF/AMF | Check NSSAI authorization, slice availability |
| PDU session type mismatch | #28 | UE requested IPv6 but network only supports IPv4 | Align PDU session type in UDM subscription |
| Network failure | #38 | SMF-UPF PFCP association down | Restore N4 link, verify PFCP heartbeat |
Vodafone Germany reported that DNN-related failures (#27 and #11) account for 41% of PDU session establishment rejects in their 5G SA network, primarily caused by SIM provisioning mismatches during 4G-to-5G migrations.
Operator Deployment Benchmarks
| Operator | Core Vendor | Median Setup Time | Success Rate | Peak Sessions/sec | Deployment |
|---|---|---|---|---|---|
| T-Mobile US | Nokia | 26 ms | 99.7% | 45,000 | Cloud-native, 3 regions |
| Deutsche Telekom | Ericsson | 28 ms | 99.5% | 38,000 | Dual-site active-standby |
| SK Telecom | Samsung | 24 ms | 99.8% | 52,000 | Edge-distributed UPF |
| NTT DOCOMO | Nokia | 31 ms | 99.4% | 35,000 | Multi-vendor (Nokia core + Fujitsu RAN) |
SK Telecom's lower latency is attributed to their edge-distributed UPF architecture, where UPFs are deployed at metro edge sites reducing N4 round-trip time to under 1 ms.
UPF Selection and Multi-Homing
The SMF selects the UPF based on DNN, S-NSSAI, UE location (TAI), and local routing policies. In networks with UPF multi-homing or ULCL (Uplink Classifier) architectures, a single PDU session may involve multiple UPFs:
- PSA UPF (PDU Session Anchor): Terminates the PDU session, allocates the UE IP address.
- I-UPF (Intermediate UPF): Provides local breakout or branching point.
- ULCL UPF: Classifies uplink traffic and routes matching flows to a local DN while forwarding the rest to the PSA UPF.
This is defined in TS 23.501 clause 5.6.4 and is essential for edge computing deployments where latency-sensitive traffic must be routed to a nearby MEC server while general internet traffic goes to the central DN.
Key Takeaways for Certification
The PDU session establishment procedure is one of the most frequently tested topics in 5G certification exams. Focus on understanding the N1/N2/N4 interface interactions, the role of PFCP rules at the UPF, the difference between SSC modes, and how QoS flows map to DRBs through SDAP. The signaling sequence -- UE to AMF (NAS), AMF to SMF (SBI), SMF to UPF (PFCP), and the return path through gNB (NGAP + RRC) -- must be committed to memory.
Key Takeaway: PDU session establishment is a multi-node orchestration that creates the end-to-end data path in 5G SA. The SMF acts as the central controller, fetching subscription data from UDM, policy rules from PCF, and programming the UPF via PFCP -- all within a typical 25--30 ms window. Understanding each step and the information exchanged is critical for both network troubleshooting and 5G certification preparation.