Two Protocols, One Control Plane
Every 5G control-plane operation involves two distinct protocols working in tandem: NAS (Non-Access Stratum) handles communication between the UE and the core network (AMF), while RRC (Radio Resource Control) manages the radio link between the UE and the gNB. A common source of confusion in certification exams and real-world troubleshooting is conflating these two layers. They operate at different protocol stack positions, serve different purposes, maintain independent state machines, and carry different message sets -- yet they are deeply intertwined because NAS messages are transported inside RRC messages over the air interface.
3GPP defines NAS in TS 24.501 (5GS NAS protocol) and RRC in TS 38.331 (NR RRC protocol). Understanding the boundary between them is essential for anyone working with 5G signaling traces.
Protocol Stack Positions
NAS and RRC sit at different layers of the 5G control-plane stack:
| Layer | Protocol | Endpoints | Transport | 3GPP Spec |
|---|---|---|---|---|
| NAS (L3 - Core) | 5G NAS (5GMM + 5GSM) | UE <-> AMF | Carried transparently over RRC + NGAP | TS 24.501 |
| RRC (L3 - RAN) | NR RRC | UE <-> gNB | Carried over SRB (PDCP -> RLC -> MAC -> PHY) | TS 38.331 |
| PDCP (L2) | NR PDCP | UE <-> gNB | Ciphering + integrity for both SRB and DRB | TS 38.323 |
| RLC (L2) | NR RLC | UE <-> gNB | Segmentation, ARQ | TS 38.322 |
| MAC (L1/L2) | NR MAC | UE <-> gNB | Scheduling, HARQ, multiplexing | TS 38.321 |
The critical architectural point is that NAS messages are encapsulated within RRC messages. Specifically, the RRC DLInformationTransfer and ULInformationTransfer messages carry NAS PDUs as opaque containers. The gNB does not interpret NAS content -- it simply relays it between the UE and AMF via the NGAP protocol on the N2 interface.
State Machine Comparison
NAS States (5GMM)
The 5GMM (5G Mobility Management) sublayer defines three states:
| NAS State | Description | UE Behavior | Network Behavior |
|---|---|---|---|
| 5GMM-DEREGISTERED | UE has no active registration | Cannot access services, no NAS signaling context | AMF has no context for UE (or context is marked deregistered) |
| 5GMM-REGISTERED | UE has valid registration | Can establish PDU sessions, receives paging | AMF maintains GUTI, security context, allowed NSSAI |
| 5GMM-CONNECTED (sub-state) | NAS signaling connection active | NAS messages can be sent immediately | AMF has active N2 NGAP UE association |
| 5GMM-IDLE (sub-state) | Registered but no signaling connection | UE monitors paging, performs cell reselection | AMF pages UE when DL data arrives at UPF |
RRC States
NR RRC defines three states, adding a new RRC_INACTIVE state compared to LTE:
| RRC State | Description | UE Behavior | gNB Behavior |
|---|---|---|---|
| RRC_IDLE | No RRC connection | Cell reselection, paging monitoring, DRX | No UE context at gNB |
| RRC_INACTIVE | RRC connection suspended | Cell reselection, RNA-based paging, DRX | UE context stored at anchor gNB, RAN paging area configured |
| RRC_CONNECTED | Active RRC connection | Scheduled by gNB, measurements, handover | Full UE context, DRBs configured, scheduling active |
State Relationship Matrix
| NAS State | Possible RRC States | Typical Scenario |
|---|---|---|
| 5GMM-DEREGISTERED | RRC_IDLE | Power-on before registration |
| 5GMM-DEREGISTERED | RRC_CONNECTED | During initial registration procedure |
| 5GMM-REGISTERED / IDLE | RRC_IDLE | Registered, no activity, monitoring paging |
| 5GMM-REGISTERED / IDLE | RRC_INACTIVE | Registered, connection suspended, fast resume |
| 5GMM-REGISTERED / CONNECTED | RRC_CONNECTED | Active data transfer or signaling |
Note that 5GMM-CONNECTED requires RRC_CONNECTED (since NAS signaling needs an RRC connection), but 5GMM-REGISTERED/IDLE can coexist with either RRC_IDLE or RRC_INACTIVE. This relationship is defined in TS 23.501 clause 5.3.3.
Message Type Comparison
Key NAS Messages (5GMM + 5GSM)
| Category | Message | Direction | Purpose |
|---|---|---|---|
| Registration | Registration Request | UE -> AMF | Initial/mobility/periodic registration |
| Registration | Registration Accept | AMF -> UE | Assigns 5G-GUTI, allowed NSSAI, registration area |
| Authentication | Authentication Request | AMF -> UE | Carries RAND, AUTN for AKA |
| Authentication | Authentication Response | UE -> AMF | Carries RES* |
| Security | Security Mode Command | AMF -> UE | Activates NAS ciphering + integrity |
| Session Mgmt | PDU Session Establishment Request | UE -> AMF (for SMF) | Request data connectivity |
| Session Mgmt | PDU Session Establishment Accept | AMF (from SMF) -> UE | IP address, QoS rules, session AMBR |
| Deregistration | Deregistration Request | UE -> AMF or AMF -> UE | Terminate registration |
| Service Request | Service Request | UE -> AMF | Transition from IDLE to CONNECTED |
Key RRC Messages
| Category | Message | Direction | Purpose |
|---|---|---|---|
| Connection | RRC Setup Request | UE -> gNB | Request RRC connection |
| Connection | RRC Setup | gNB -> UE | Establish SRB1, assign C-RNTI |
| Connection | RRC Setup Complete | UE -> gNB | Carries initial NAS message |
| Reconfiguration | RRC Reconfiguration | gNB -> UE | Add/modify DRBs, measurements, handover |
| Reconfiguration | RRC Reconfiguration Complete | UE -> gNB | Confirm reconfiguration applied |
| Resume | RRC Resume Request | UE -> gNB | Resume from RRC_INACTIVE |
| Resume | RRC Resume | gNB -> UE | Restore suspended UE context |
| Release | RRC Release | gNB -> UE | Move to RRC_IDLE or RRC_INACTIVE |
| Measurement | Measurement Report | UE -> gNB | Report serving/neighbor cell measurements |
| System Info | SIB1 | gNB -> UE (broadcast) | Cell access info, scheduling of other SIBs |
Timer Comparison
Timers control protocol behavior at both layers. Misconfigurations cause registration failures, unnecessary re-establishments, and ping-pong effects.
| Timer | Layer | Default Value | Function | Configured By |
|---|---|---|---|---|
| T3510 | NAS | 15 s | Registration Request guard | TS 24.501 clause 10.2 |
| T3512 | NAS | 54 min | Periodic registration update | AMF via Registration Accept |
| T3346 | NAS | 10--1800 s | Back-off after congestion reject | AMF via reject message |
| T3502 | NAS | 12 min | Registration retry after failure | AMF via Registration Reject |
| T3580 | NAS | 16 s | PDU Session Establishment guard | TS 24.501 clause 10.2 |
| T300 | RRC | 100--2000 ms | RRC Setup Request guard | SIB1 |
| T301 | RRC | 100--2000 ms | RRC Re-establishment Request guard | SIB1 |
| T304 | RRC | 50--10000 ms | Handover execution guard | RRC Reconfiguration |
| T310 | RRC | 0--6000 ms | RLF detection (after N310 out-of-sync) | SIB1 / dedicated |
| T311 | RRC | 1000--30000 ms | RRC re-establishment guard after RLF | SIB1 |
| T319 | RRC | 100--2000 ms | RRC Resume Request guard | SIB1 |
Worked Example 1 -- Timer Interaction During Registration
Consider a UE powering on in a T-Mobile US 5G SA cell:
- T = 0 ms: UE sends RRC Setup Request. Timer T300 starts (configured to 400 ms in SIB1).
- T = 12 ms: gNB responds with RRC Setup. T300 stops.
- T = 15 ms: UE sends RRC Setup Complete containing NAS Registration Request. NAS timer T3510 starts (15 s).
- T = 18 ms: gNB relays NAS message to AMF via NGAP Initial UE Message.
- T = 45 ms: Authentication exchange completes (NAS Authentication Request/Response).
- T = 62 ms: Security Mode Command/Complete exchange.
- T = 78 ms: AMF sends NAS Registration Accept (contains 5G-GUTI, allowed NSSAI, T3512 value = 54 min). T3510 stops.
- T = 80 ms: UE sends NAS Registration Complete.
The entire registration took 80 ms. If the AMF had not responded within 15 s, T3510 would have expired and the UE would retry up to 5 times (with exponential backoff controlled by T3502 on final failure).
T-Mobile US measured a median initial registration time of 85 ms on their Nokia 5G SA core across 15,000 sampled events in Q1 2025.
Worked Example 2 -- RRC Release with Suspend to RRC_INACTIVE
After a period of data inactivity, the gNB decides to suspend the RRC connection:
- gNB sends RRC Release with
suspendConfigIE containing:
- I-RNTI: Inactive RNTI for future resume (40-bit identifier)
- RAN-NotificationAreaInfo: list of cells/TAIs forming the RNA
- T380: RAN notification area update timer (e.g., 60 min)
- nextHopChainingCount: for key derivation on resume
- UE transitions to RRC_INACTIVE but remains in 5GMM-REGISTERED/IDLE at NAS layer.
- When DL data arrives: AMF pages the UE. UE sends RRC Resume Request (timer T319 starts). gNB restores context and sends RRC Resume. The UE reaches RRC_CONNECTED in approximately 10--15 ms.
Compared to full RRC connection establishment (which takes 30--50 ms), the RRC Resume path from RRC_INACTIVE saves 15--35 ms. SK Telecom reported that enabling RRC_INACTIVE reduced their control-plane latency for reconnection by 42% and decreased paging load on the core by 28%.
Security at Each Layer
| Aspect | NAS Security | RRC/PDCP Security |
|---|---|---|
| Ciphering algorithm | NEA1 (SNOW), NEA2 (AES), NEA3 (ZUC) | Same algorithms, independently keyed |
| Integrity algorithm | NIA1, NIA2, NIA3 | Same algorithms, independently keyed |
| Key | K-NAS-enc, K-NAS-int (derived from K-AMF) | K-RRC-enc, K-RRC-int (derived from K-gNB) |
| Scope | UE <-> AMF (end-to-end, transparent to gNB) | UE <-> gNB (terminated at gNB PDCP) |
| Activation | NAS Security Mode Command | AS Security Mode Command (within RRC) |
| Mandatory integrity | Always required for NAS | Always required for SRBs, optional for DRBs |
This dual-layer security means that even if a rogue gNB intercepts RRC messages, it cannot read the NAS content because NAS ciphering uses a different key hierarchy. This is a fundamental security improvement over 3G where the RNC terminated both layers.
How NAS and RRC Interact in Key Procedures
During Initial Registration
- RRC establishes the radio link (RRC Setup).
- NAS Registration Request is piggybacked in RRC Setup Complete.
- All subsequent NAS messages (Auth, SMC, Registration Accept) are carried in RRC DL/UL InformationTransfer.
- RRC Reconfiguration adds DRBs after PDU session establishment -- triggered by NAS PDU Session Establishment Accept.
During Handover
- RRC handles the entire handover execution (measurement reports, RRC Reconfiguration with mobility control info).
- NAS is not involved in intra-AMF handover -- the NAS context simply follows the UE to the target gNB.
- For inter-AMF handover, NAS context is transferred between AMFs via N14, and the UE may receive a new 5G-GUTI.
During Paging
- The core network (AMF) sends a NAS-level paging trigger via NGAP Paging message to gNBs in the registration area.
- The gNB translates this into an RRC-level paging message broadcast on PCCH.
- For RRC_INACTIVE UEs, the gNB can also initiate RAN-level paging within the RNA -- this does not involve the AMF.
Verizon reported in their 2025 network optimization review that RAN-level paging for RRC_INACTIVE UEs reduced AMF paging signaling load by 35% after deploying 3GPP Release 17 RRC_INACTIVE enhancements across their 5G SA network.
Common Troubleshooting Patterns
| Symptom | Layer to Check | Likely Cause | Diagnostic |
|---|---|---|---|
| UE cannot register | NAS | Authentication failure, PLMN mismatch | Check NAS reject cause code in Registration Reject |
| Frequent RRC re-establishments | RRC | Poor radio conditions, T310/T311 misconfiguration | Check SINR, adjust T310/N310 thresholds |
| Long connection setup after idle | RRC + NAS | RRC_INACTIVE not enabled, full establishment needed | Enable suspendConfig in RRC Release |
| PDU session fails after registration | NAS (5GSM) | DNN not provisioned, SMF unreachable | Check NAS SM reject cause, AMF-SMF N11 connectivity |
| Handover ping-pong | RRC | A3 offset too low, hysteresis insufficient | Adjust measurement event A3 parameters |
| Periodic registration storms | NAS | T3512 too short across many UEs | Increase T3512 timer, stagger across UE population |
Operator Data on Protocol Performance
| Metric | NAS Layer | RRC Layer | Source |
|---|---|---|---|
| Median registration time | 75 ms (AMF processing) | 12 ms (RRC Setup) | Deutsche Telekom 2025 |
| Security activation time | 18 ms (NAS SMC) | 8 ms (AS SMC) | T-Mobile US 2025 |
| Paging success rate | 98.2% (core paging) | 99.1% (RAN paging for INACTIVE) | SK Telecom 2024 |
| Message volume per UE/hour (active) | 2.4 NAS msgs | 28.6 RRC msgs | Vodafone 2025 |
The significantly higher RRC message volume reflects measurement reports, RRC reconfiguration for beam management, and MAC-layer scheduling that have no NAS equivalent.
Key Takeaway: NAS and RRC are complementary Layer 3 protocols with distinct scope -- NAS manages the UE's relationship with the core network (registration, authentication, session management), while RRC manages the radio link (connection control, measurements, handover). They maintain independent state machines and security contexts, but NAS relies on RRC for transport over the air interface. Mastering both protocols and their interaction is essential for 5G signaling analysis and troubleshooting.