N6 — UPF ⇔ DN (Data Network Reference Point)¶

Learning objectives¶

After reading this page, you will be able to:

• Explain that N6 connects UPF ⇔ DN (Data Network) and is the 5G core's exit to the outside.
• Explain that the DN being connected to is identified by a DNN (Data Network Name).
• Explain the role by which the UPF exits to the DN over N6 as a PSA (PDU Session Anchor).
• Explain, as a difference from N3 (GTP-U), that 3GPP does not specify a dedicated tunnel protocol on N6, and it becomes IP connectivity that is implementation- and deployment-dependent.
• Explain how it corresponds to 4G (EPC) SGi (PGW⇔external PDN).

Prerequisites¶

It will go more smoothly if you understand the following first.

• The NF that terminates N6 (the substance on the PSA side) → UPF
• The paired radio-side user plane (N3, GTP-U) → Protocol dictionary
• The positioning of the PDU Session and the DNN → PDU Session Establishment
• The concept of an interface → Interface dictionary

Why — why it is needed¶

Even after the 5G core has finished registration, authentication, and session establishment and the UPF is in a state where it can forward user data, communication is not complete without an exit to the "outside world" that ultimately delivers that data. The web pages the user wants to see, video distribution servers, IMS-based calls, in-house systems — all these destinations are on a network outside the 5G core (= the DN, Data Network).

This "exit connecting the 5G core (UPF) and the external network (DN)" is N6. Without N6, no matter how much data can be carried inside the core, it cannot get out to the Internet or operator services, and the UE ends up "in coverage yet connected to nothing." N6 is the final front door that sends out the packets the core has processed to the outside world and receives responses from outside.

Overview¶

N6 is the reference point connecting UPF ⇔ DN (Data Network). A DN is the collective term for destination networks outside the 5G core — the Internet, IMS (the call network), an operator's own service network, or an enterprise's in-house network. Which DN to exit to is identified by a DNN (Data Network Name) (equivalent to the 4G APN).

The greatest characteristic of N6 is that while 3GPP defines N6 as a reference point, it does not specifically define the concrete protocol flowing over N6. On N3 (gNB⇔UPF), a tunneling protocol called GTP-U is specified, but N6 has no such 3GPP-specific tunnel. From N6 onward it is "quite ordinary IP connectivity," and its specifics (routing, NAT, firewall, charging/policy application, etc.) depend on the network configuration, implementation, and deployment.

The UPF that becomes this exit to the DN over N6 is the PSA (PDU Session Anchor, the fixed exit point that holds the UE's IP during the session).

Basic Concept — a beginner-friendly explanation¶

Let us liken N6 to the front entrance of a building.

• After packages (packets) are sorted and transported inside the building (the 5G core), they finally go out through the front entrance (N6) to the town (the DN = the Internet, etc.). Beyond the entrance is already outside the building = the ordinary townscape.
• The package has a destination label (DNN) indicating "which area of which town it goes to," and the doorkeeper (the UPF = the PSA) looks at that label and sends it out to the correct external network in the right direction.
• Even when the UE moves (handover), it keeps using the same entrance (PSA) to this town. Precisely because the entrance is not changed = the exit is fixed, the UE's IP address does not change and communication is not interrupted. This is the meaning of "Anchor" (mooring = keeping in one place) in PSA.
• The return package (DN→UE) also enters the building through this same entrance and is delivered to the UE.

The important point here is the difference between N3 (the in-building tunnel delivery = GTP-U) and N6 (outside the entrance = ordinary IP communication). A package that was carried by a dedicated transport tunnel (GTP-U) inside the building becomes, the moment it exits the entrance (N6), quite ordinary IP communication with no special tunnel. How the package is handled outside the entrance (inspection = firewall, address re-labeling = NAT, recording tolls = charging, etc.) is up to that building's operating policy (implementation, configuration), and 3GPP does not decide "you must do it this way."

Protocol / Transport¶

Architecture¶

This shows how N6 receives, at the UPF (PSA), the user data carried over N3 (GTP-U) and exits to the DN.

flowchart LR
  gNB["gNB (base station)"]
  UPF["UPF (PSA)"]
  DN(("Data Network / Internet"))

  gNB == "N3 (GTP-U tunnel)" ==> UPF
  UPF -- "N6 (general IP connectivity)" --> DN

  classDef anchor fill:#efe,stroke:#3a3,stroke-width:2px;
  classDef ext fill:#eef,stroke:#66f,stroke-width:2px;
  class UPF anchor;
  class DN ext;

How to read the diagram: from the gNB to the UPF, user data is carried by the thick-line N3 (GTP-U) tunnel. At the UPF (PSA) the tunnel is terminated, and from there on N6 is ordinary IP connectivity (thin line) exiting to the DN. Note that from N6 onward it is general IP with no 3GPP-specific tunnel, and that the exit UPF functions as the PSA. Where to apply NAT/firewall, etc., is implementation- and deployment-dependent.

Note that in configurations with multiple UPF stages, the UPF ahead of the PSA is connected by N9 (GTP-U). In that N9 also uses a 3GPP-specific tunnel (GTP-U), it contrasts with N6, which has no tunnel (the tunnel is terminated at the PSA, and the N6 beyond it is raw IP).

Procedures that use it¶

N6 is not an interface with control signaling; it is an exit through which, as a result of a PDU Session being established, user data can reach the DN.

• UPF (PSA) selection: in PDU Session Establishment, the SMF selects the UPF that becomes the PSA according to the connection destination (DNN, etc.). This UPF becomes the exit to the DN over N6.
• Relationship with IP address allocation: the IP address allocated to the UE is managed and allocated by the SMF, and that UE's packets reach the DN from N6 via the UPF that is the PSA. The UE uses this IP to communicate with destinations on the DN.
• Uplink/downlink flow: uplink (UE→DN) enters the UPF over N3 (GTP-U), and after tunnel termination at the UPF, exits to the DN over N6. Downlink (DN→UE) enters the UPF over N6, and the UPF returns it to the gNB over N3 (GTP-U).

To avoid duplication, see PDU Session Establishment for the detailed call flow of PDU Session establishment, including PSA selection, IP address allocation, and N4 rule setting. This page does not repeat the procedure details.

Main Messages¶

Packet Analysis (Wireshark)¶

Because N6 has no 3GPP-specific tunnel, it is observed in a capture as quite ordinary IP traffic. There is no N6-specific display filter like N2's ngap or N3's GTP-U.

Decode highlights:

• On the N6 segment, a tunnel identifier like GTP-U's TEID does not appear. The raw IP packet after the tunnel is terminated at the UPF (PSA) flows. Comparing it against a capture on the N3 side (in the GTP-U-wrapped state), you can understand the boundary where the tunnel is stripped at the UPF.
• If DHCP/RADIUS/Diameter, etc., are used in the configuration on the DN side, those protocols may be observed, but this is configuration-dependent and not an N6-specific mandatory element.
• Whether DPI (Deep Packet Inspection) or app identification is performed, and its extent, is implementation-dependent. Since there is no N6-specific filter, the observed protocols directly reflect the configuration on the DN side.

Comparison with EPC¶

• In 4G: the user plane's exit to the external network was SGi. The PGW (P-GW) exits to an external PDN (Packet Data Network, the Internet or operator networks) via SGi. The connection destination was identified by an APN (Access Point Name).
• In 5G: the exit becomes N6, and the UPF (PSA) exits to the DN via N6. The connection destination is identified by a DNN (Data Network Name) (plus slice designation by S-NSSAI).

3GPP Specification¶

• 3GPP TS 23.501 §4 — System architecture and reference points (definition of N6: UPF⇔DN)
• 3GPP TS 23.501 §5.6 series — PDU Session・DN・DNN related (DN identification by DNN, etc.). Individual clause numbers are to be confirmed
• 3GPP TS 23.502 — Procedures (PDU Session Establishment, etc., including PSA selection and IP allocation). Individual clause numbers are to be confirmed

Summary¶

• N6 is the reference point connecting UPF ⇔ DN (Data Network), the 5G core's exit to the outside (the Internet, etc.).
• The connected DN is identified by a DNN (Data Network Name), and the UPF that becomes the exit functions as a PSA (PDU Session Anchor).
• 3GPP defines N6 as a reference point but does not specify a dedicated tunnel protocol on N6. N6 is general IP connectivity, and its specifics are implementation- and deployment-dependent.
• Unlike N3 (GTP-U), N6 has neither a 3GPP-specific tunnel nor dedicated signaling. It may become a NAT/FW/charging/policy application point, but that is implementation-dependent.
• It corresponds to 4G's SGi (PGW⇔external PDN, APN identification), and in 5G it becomes N6 (UPF(PSA)⇔DN, DNN identification). The nature of IP connectivity with no dedicated tunnel specified is common.

Next Step¶

• UPF — the NF that terminates N6 (the exit as the PSA)
• PDU Session Establishment — the procedure by which, through PSA selection and IP allocation, the DN becomes reachable over N6
• N3 / N9 — the GTP-U user plane
• N7 — SMF⇔PCF, session policy control
• Interface dictionary / Protocol dictionary — to check terminology, the DNN, and GTP-U