5G COREAMFUDMSMFUPFGTP-U tunnel5G NR radioRegistration requestCheck SIMPDU session requestN4 rulesto 203.0.113.10to 198.51.100.23Xn handoverPath switchto 198.51.100.23
Coloured parts: the ones the current step is about; the rest wait in whiteEnvelope: one message; its label says what it carriesGlowing tube: your PDU session's GTP-U tunnel between a gNB and the UPFCables: fibre from the gNBs, the dashed service line in the core, a thick line to the internetInside a 5G network. The phone talks by radio to gNB A. Its sign-on goes to the AMF, which checks the subscriber with the UDM; its request for a PDU session goes on to the SMF, which gives it an IP address and sets up the UPF. Your data then rides a GTP-U tunnel between the gNB and the UPF, and the UPF connects it to the internet. When you walk into gNB B's cell the gNBs hand you over and the core moves the tunnel's end; the session and address stay. 198.51.100.23 and 203.0.113.10 are RFC 5737 documentation addresses, as are the operator-side tunnel addresses 192.0.2.1, 192.0.2.11 and 192.0.2.12; the subscriber identity uses the ITU-T E.212 test network code 001-01.

Signing on

  1. Your phone talks by radio to the nearest 5G base station, called a gNB. The gNB only handles the radio. Everything else happens in the core network behind it, linked by fibre.

Opening a session

Moving your data

Changing cells

What is going on, line by line

;; step 1/11 · radio · radio
;; Your phone → gNB A
phone ⇄ gNB A, by radio ("New Radio", TS 38.300)
gNB = gNodeB, the 5G base station
behind it: fibre to the 5G core (TS 23.501)
(the lesson "Mobile networks: 4G and 5G" covers the radio side)

AMF, SMF and UDM talk through service-based interfaces (HTTP/2 APIs, TS 29.500), drawn as one shared line; the SMF controls the UPF over N4 (PFCP). A real 5G core has more functions than shown: the AUSF runs the SIM check with the UDM, the PCF sets policy and the NRF helps functions find each other.