Skip to content

Service Request

Difficulty: Advanced / Estimated study time: 45 min / Scope: UE-triggered / Network-triggered Service Request / Related NFs: AMF, SMF, UPF / Related Interfaces: N1, N2, N3, N4

Learning objectives

After reading this page, you will be able to:

  • Explain the Why (why a Service Request is needed) as the mechanism by which a UE that has dropped into low-power standby (CM-IDLE) re-establishes the connection and user plane when it resumes communication.
  • Explain, by contrast, the difference between a UE-triggered and a Network-triggered Service Request (the trigger, and whether Paging precedes it).
  • Explain, with diagrams, the CM-IDLE → CM-CONNECTED state transition and the reverse-direction AN Release (CM-CONNECTED → CM-IDLE).
  • Follow the flow of the user-plane re-activation of the PDU Session (AMF→SMF Nsmf UpdateSMContext → reconfiguration of the UPF's N3 tunnel/FAR over N4 → re-establishment of the N3 path with the gNB).
  • Explain, from the core's viewpoint, that the leading roles in a Service Request are the AMF (NAS/N2 control) and the SMF/UPF (U-Plane re-establishment).
  • Use Wireshark Display Filters to name the points to focus on when analyzing a NAS Service Request / NGAP Initial Context Setup / PFCP Session Modification.
  • Contrast the differences between the 4G (EPC) Service Request (MME-triggered / UE-triggered, S1AP, ECM-IDLE→CONNECTED) and the 5G Service Request.

Prerequisites

It will go more smoothly if you understand the following first. If you are not there yet, start from the Curriculum.

  • That the UE is registered — a Service Request targets a registered (5GMM-REGISTERED) UE. For the registration flow, see Initial Registration.
  • That a PDU Session is already established (the user plane to be re-activated was set up in the past) → PDU Session Establishment
  • Understanding of Paging (a Network-triggered Service Request starts as a response to Paging) → Paging
  • N1 / N2 / N3 / N4 (the UE⇔AMF NAS, the gNB⇔AMF NGAP, the gNB⇔UPF U-Plane, the SMF⇔UPF PFCP) → N1 / N2 / N3 / N4
  • The roles of the main NFsAMF / SMF / UPF

What you'll learn in this chapter

This chapter focuses on the Service Request procedure. It is the procedure by which a UE in the CM-IDLE (standby) state re-establishes the radio connection and UE context and transitions from CM-IDLE → CM-CONNECTED. It covers the following two triggers.

  • UE-triggered Service Request — the UE spontaneously resumes the connection in order to originate, send UL (uplink) data, or respond to network-triggered signaling. The UE sends a NAS Service Request.
  • Network-triggered Service Request — a UE that has been woken by Paging upon the arrival of DL (downlink) data starts it as a response. This corresponds to the continuation of paging.md.

This chapter focuses on the involvement of the core (5GC). In particular, it centers on the NAS Service Request received by the AMF (N1/N2) and the subsequent user-plane re-activation of the PDU Session (the AMF→SMF→UPF N3/N4 coordination). The following are out of scope for this chapter (they are mentioned, but not gone into in detail).

  • RRC Resume / the detailed radio-side (RRC) procedures — the radio-connection resume steps (RRC Setup/Resume, radio resource allocation) are kept conceptual, focusing on the core's involvement (radio side, implementation-dependent).
  • The details of AKA re-authentication — re-authentication may occur during a Service Request, but the details of authentication are directed to a separate chapter (Security/Authentication).
  • The details of Handover — connection switching while moving is out of scope for this chapter (see Handover).
  • RRC Inactive / Small Data Transmission — the Rel-16-and-later extensions are only outlined in Release differences.

Why — why a Service Request is necessary

Let's start from the Why (why it is needed). Even a registered (5GMM-REGISTERED) UE does not keep holding a dedicated radio connection while it is not communicating. Maintaining a radio connection at all times would quickly drain the UE's battery and exhaust the network's radio resources. So, while there is no communication, the UE releases the dedicated radio connection and enters a standby state (CM-IDLE) to save its battery (this reverse-direction procedure of "releasing the connection and dropping into standby" is AN Release).

However, when a standby (CM-IDLE) UE tries to resume communication, there is a problem. In CM-IDLE, the following two are severed.

  1. The signaling connection — there is no UE⇔AMF NAS connection and no gNB⇔AMF N2 UE-associated connection. Control messages cannot be sent right away.
  2. The user-plane path — the PDU Session is logically maintained, but the N3 (gNB⇔UPF) tunnel through which actual data flows is deactivated. As is, no uplink/downlink data flows.

A Service Request is the procedure by which this standby UE declares "I am going to communicate again; please re-establish the connection and the data path," re-establishes the signaling connection, re-activates the PDU Session's user plane, and returns to CM-CONNECTED.

Analogy: opening the front door to receive a parcel / calling back

A Service Request is like the moment when a person who has been on standby at home 'starts moving again' for an errand. When a person who had closed the door and was resting to save power (CM-IDLE) decides to go out and hand over a parcel themselves (UE-triggered: origination, UL data), or is called by the doorbell (Paging) and goes to receive a parcel (Network-triggered: a response to Paging), they first open the front door to make a path. Opening the door = re-establishing the signaling connection; securing the hallway the parcel passes through = re-activating the user plane (N3). If you do not re-lay the hallway (the N3 tunnel), then even if you answer the doorbell, the parcel (data) will not reach inside the house. That is why a Service Request re-establishes both the "connection" and the "data path."

Overview

A Service Request starts from two triggers. Either way the result is the same — the UE transitions to CM-CONNECTED, the PDU Session's user plane (N3) is re-activated, and uplink/downlink data begins to flow.

  • UE-triggered — the UE starts it spontaneously. The trigger may be origination, sending UL (uplink) data, responding to network-triggered signaling, and so on. The UE sends a NAS Service Request.
  • Network-triggered — the UPF/SMF/AMF detect the arrival of DL data, and the AMF pages the UE via Paging. This is a Service Request that the paged UE starts. In other words, the biggest difference from the UE-triggered case is that in the network-triggered case Paging precedes it.
Aspect UE-triggered Network-triggered
Trigger UE origination / sending UL data / responding to network-triggered signaling DL data arrival → paged via Paging
Paging precedes No (the UE starts it spontaneously) Yes (it starts as a response to Paging)
First entity to act UE (sends the NAS Service Request) UPF/SMF/AMF (start Paging) → the response is from the UE
State of the target UE A registered UE in CM-IDLE A registered UE in CM-IDLE
Main NFs AMF (acceptance/control) / SMF/UPF (U-Plane re-establishment) Same as left (+ SMF/UPF/AMF when starting Paging)
Interfaces used N1 (NAS) / N2 (NGAP) / N3 (U-Plane) / N4 (UPF reconfiguration) / N11-equivalent (Nsmf) Same as left (+ Paging: N2/N4/N11-equivalent)
Result Transition to CM-CONNECTED + U-Plane (N3) re-activation Same as left
flowchart LR
    UEtrig["UE-triggered
(origination / UL data)"] --> SR["Service Request
(NAS)"] DL[("DL data arrival")] --> PG["Paging
(the network-triggered preceding procedure)"] PG --> SR SR --> ACT["U-Plane re-activation
(AMF→SMF→N4→UPF, N3 re-establishment)"] ACT --> CONN(("CM-CONNECTED
data flowing")) classDef pg fill:#eef,stroke:#66a,stroke-width:1px; class PG pg;

Relationship with Paging (the continuation of paging.md)

Paging was the procedure that "calls a CM-IDLE UE." How the paged UE responds and re-establishes the connection and U-Plane is this Service Request. Therefore, the Network-triggered Service Request is the direct continuation of Paging, and paging.md and this chapter divide up the single continuous flow "Paging → Service Request." The UE-triggered case does not involve Paging; the UE spontaneously starts the same Service Request.

Basic Concept — a beginner-friendly explanation

To understand the Service Request, grasp three keywords.

1. Why a return from CM-IDLE is needed

CM = Connection Management. A registered UE has mainly two states, depending on the presence of the UE⇔AMF N1 (NAS) signaling connection and the gNB⇔AMF N2 UE-associated connection (this is kept strictly aligned with Paging).

  • CM-IDLE (standby) — a state where there is no signaling connection for that UE between the UE and the network. The UE has released the dedicated radio connection to save its battery. The PDU Session's user plane (N3) is also deactivated.
  • CM-CONNECTED (connected) — a state where a signaling connection for that UE is established. Data/signaling can be exchanged right away.

When communication ceases, the network drops the UE from CM-CONNECTED → CM-IDLE via AN Release (the release of the radio connection), to save power. But when it wants to communicate again, it needs to re-establish the severed connection and U-Plane. That return procedure is the Service Request, which brings it back from CM-IDLE → CM-CONNECTED. Note that this is on a different axis from the RM state (Registration Management: REGISTERED / DEREGISTERED); a Service Request targets a UE that is "RM=REGISTERED and CM=IDLE."

2. The difference between UE-triggered and Network-triggered

Even for the same Service Request, who moves first differs.

  • UE-triggered — the UE itself spontaneously sends a NAS Service Request when "it is about to originate" or "it wants to send uplink data." No Paging is needed (because it notices and moves on its own).
  • Network-triggered — when an errand for the UE (DL data) arrives on the network side, the UE is on standby and cannot notice it. So the network calls "please wake up" via Paging, and the paged UE starts a Service Request as a response.

Even when the trigger differs, 'what gets re-established' is the same

Even when the trigger differs (spontaneous or a Paging response), what follows — re-establishing the connection, re-activating the PDU Session's U-Plane (N3), and returning to CM-CONNECTED — is common. So this chapter shows the procedure mainly for the UE-triggered case and treats the Network-triggered case as the "difference where Paging precedes it."

3. PDU Session activation (why the U-Plane must be re-established)

During CM-IDLE, the PDU Session itself is logically maintained (the UE's IP address and PDU Session ID do not disappear). However, the N3 (gNB⇔UPF) user-plane tunnel through which actual data flows is deactivated. The reason is that, while the UE is on standby with no radio connection, keeping only the N3 tunnel alive would be pointless because the delivery target (gNB) for downlink data is not fixed.

Therefore, in a Service Request, in addition to re-establishing the signaling connection, the PDU Session's user plane is re-activated. Specifically, the following are re-established.

  • The gNB⇔UPF N3 tunnel — the N3 (GTP-U) path through which uplink/downlink data flows. The TEIDs/addresses on the gNB side and UPF side are newly set/updated.
  • The UPF's forwarding rules — the SMF updates the UPF's FAR (Forwarding Action Rule) etc. over N4 (PFCP), directing downlink data to the new gNB's N3 TEID.

At this time, which PDU Session the UE re-activates may be indicated by information included in the Service Request (equivalent to the List Of PDU Sessions To Be Activated described later; the IE name is to be confirmed). It does not necessarily wake all PDU Sessions at once; it is designed to wake only the ones needed (details/conditions are to be confirmed).

RRC Resume (the radio-side resume) is out of scope

The concrete steps by which the UE re-establishes the radio connection (RRC Setup / RRC Resume) are in the RRC/RAN domain. This chapter focuses on the core's involvement (the part where the AMF receives the NAS and the SMF/UPF re-establish N3), and keeps the radio side conceptual (implementation/RAN-dependent).


Architecture

The elements involved in a Service Request and the interfaces that connect them. It emphasizes the path where the UE's NAS Service Request reaches the AMF via the gNB, and the AMF re-establishes the UPF's N3 (U-Plane) through the SMF.

flowchart LR
    UE(("UE
(CM-IDLE→CONNECTED)")) RAN["(R)AN / gNB"] AMF["AMF
(NAS/N2 control)"] SMF["SMF
(PDU Session activation)"] UPF["UPF
(N3 reconfiguration)"] DN[(Data Network)] UE -- "N1 (NAS): Service Request" --> AMF UE -. "RRC (radio, out of scope)" .- RAN RAN -- "N2 (NGAP): Initial UE Message / InitialContextSetup" --> AMF AMF -- "N11-equivalent (Nsmf UpdateSMContext)" --> SMF SMF -- "N4 (PFCP): Session Modification" --> UPF RAN == "N3 (GTP-U re-establishment)" ==> UPF UPF == "N6" ==> DN classDef core fill:#efe,stroke:#3a3,stroke-width:2px; class AMF,SMF,UPF core;

The role of each element is as follows.

  • UE — the returning terminal. It sends the NAS Service Request spontaneously in the UE-triggered case, or as a Paging response in the Network-triggered case. The radio-side RRC resume is out of scope.
  • (R)AN / gNB — the radio access. It carries the UE's NAS to the AMF in an Initial UE Message (NGAP), sets the UE context / AS security / radio resources via the AMF's InitialContextSetup, and re-establishes N3 (GTP-U) to the UPF.
  • AMF — the command center of control. It terminates N1 (NAS) / N2 (NGAP), accepts the Service Request, and instructs the SMF regarding the PDU Session(s) to be re-activated.
  • SMF — session management. At the AMF's request, it reconfigures the UPF's U-Plane (N3/FAR) over N4 (PFCP) and re-activates the PDU Session.
  • UPF — the user-plane forwarding entity. On the SMF's instruction, it reconfigures the N3 tunnel (gNB-side TEID/address) and FAR, and flows uplink/downlink data.
  • DN (Data Network) — the external data network. After re-establishment, it communicates with the UE through the U-Plane.

For the details of the interfaces, see the Interface Dictionary.

Network Function (the NFs that appear)

The roles of the core-side NFs that appear in a Service Request. The gNB is on the radio-access side and is not a core NF (this table is limited to core NFs).

NF Role in this procedure Information held/retrieved Main APIs/procedures used in this procedure Impact on failure
AMF The entity that accepts and controls the Service Request. Terminates NAS (N1) / NGAP (N2) and notifies the SMF of the PDU Session(s) to be re-activated. Sets the UE context / AS security with the gNB UE context, CM state, 5G-GUTI, security keys, PDU Session(s) to be re-activated NGAP (receives Initial UE Message / Initial Context Setup) / Nsmf_PDUSession_UpdateSMContext (consumes; to be confirmed: operation name) The Service Request is not processed; connection re-establishment and data flow become impossible
SMF On the AMF's notification, re-activates the user plane of the target PDU Session. Reconfigures the UPF's N3/FAR over N4 PDU Session context, UPF information, gNB-side/UPF-side N3 TEID Nsmf_PDUSession_UpdateSMContext (provides) / N4 (PFCP) Session Modification The U-Plane is not re-established, and uplink/downlink data does not flow
UPF Reconfigures the downlink/uplink N3 tunnel (gNB-side TEID/address) and FAR. In the Network-triggered case, delivers buffered DL data PDR/FAR/QER, N3 TEID, UE IP, (when Network-triggered) buffered DL packets PFCP Session Modification Request (N4/TS 29.244) The N3 path cannot be laid / data is not delivered because the FAR is not updated

Interface / Protocol

The interfaces and protocols used in this procedure.

Interface Protocol Transport Counterpart Use in this procedure
N1 NAS (5GMM) (tunneled over NGAP/N2) UE ⇔ AMF The UE→AMF Service Request (Service type, etc.), the AMF→UE Service Accept, etc.
N2 NGAP SCTP (port 38412) gNB ⇔ AMF Transport of NAS (Initial UE Message); setting the UE context / U-Plane information via Initial Context Setup Request/Response, etc.
N3 GTP-U UDP (port 2152) gNB ⇔ UPF Re-establishment of the user plane. Setting the gNB/UPF-side TEID and flowing uplink/downlink data
N4 PFCP UDP (port 8805) SMF ⇔ UPF Reconfiguring the UPF's U-Plane (N3/FAR) (PFCP Session Modification)
N11-equivalent (Nsmf) SBI (HTTP/2, TLS, JSON) TCP/TLS AMF → SMF The AMF→SMF request to re-activate the PDU Session (assumed to be Nsmf_PDUSession_UpdateSMContext)

On the notation of N11 and SBI

In the 3GPP architecture, the reference point between AMF⇔SMF is called N11, but in reality it is an exchange via the Nsmf_PDUSession service over the SBI (Service Based Interface, HTTP/2). Here it is written as "N11-equivalent (SBI)." The specific operation name for AMF→SMF (assumed to be Nsmf_PDUSession_UpdateSMContext) is a representative example, and the exact conditions of application are to be confirmed against the relevant procedure in TS 23.502.

For the details of protocols, see the Protocol Dictionary; for the list of interfaces, see the Interface Dictionary.


Procedure — Call Flow

This is the heart of this page. The main steps of a Service Request are shown in a Mermaid sequenceDiagram. The basis is 3GPP TS 23.502 §4.2.3 series (UE Triggered / Network Triggered Service Request), TS 24.501 §5.6 series (NAS Service Request), and TS 38.413 (NGAP) (the fine details of section numbers are to be confirmed). It is shown with the UE-triggered case as the main axis, and the Network-triggered case is supplemented as the "difference where Paging precedes it."

Prerequisite: the UE is registered and in CM-IDLE, and a PDU Session is already established

Assume the UE is 5GMM-REGISTERED and in CM-IDLE, and that the PDU Session to be re-activated was established in the past (but its U-Plane (N3) is deactivated). If it were CM-CONNECTED, a connection would already exist, so a Service Request would be unnecessary.

UE-triggered Service Request (main axis)

sequenceDiagram
    autonumber
    participant UE as UE (CM-IDLE)
    participant RAN as (R)AN / gNB
    participant AMF
    participant SMF
    participant UPF

    Note over UE,RAN: The need to originate / send UL data arises
    Note over UE,RAN: RRC connection establishment/resume (radio side, outline/out of scope)
    UE->>RAN: Carry Service Request (NAS)
    Note right of UE: TS 24.501 §5.6.1. Service type (mo-signalling/mo-data, etc.)
    RAN->>AMF: Put NAS onto Initial UE Message (NGAP)
    Note right of RAN: N2 / TS 38.413

    opt Security re-establishment/re-authentication (conditional, situation dependent)
        Note over UE,AMF: Verify the existing security context. Re-authenticate only when needed (details in a separate chapter)
    end

    Note over AMF: Determine which PDU Session(s) to re-activate
    AMF->>SMF: Nsmf_PDUSession_UpdateSMContext (request U-Plane activation)
    Note right of AMF: N11-equivalent (SBI). To be confirmed: operation name/conditions
    SMF->>UPF: PFCP Session Modification Request (N4)
    Note right of SMF: Reconfigure N3/FAR (reflecting the gNB-side N3 TEID may be finalized later)
    UPF-->>SMF: PFCP Session Modification Response
    SMF-->>AMF: UpdateSMContext Response (U-Plane information)

    AMF->>RAN: Initial Context Setup Request (NGAP)
    Note right of AMF: Set the UE context / AS security / PDU Session N3 information
    RAN->>UE: RRC configuration (AS security/radio resources, outline/out of scope)
    UE-->>RAN: RRC configuration complete (outline/out of scope)
    RAN-->>AMF: Initial Context Setup Response (NGAP)
    Note right of RAN: Notify the gNB-side N3 TEID

    opt Reflect the gNB-side N3 TEID into the UPF (implementation/procedure dependent)
        AMF->>SMF: Nsmf_PDUSession_UpdateSMContext (gNB N3 information)
        SMF->>UPF: PFCP Session Modification (downlink FAR → gNB N3 TEID)
        UPF-->>SMF: PFCP Session Modification Response
    end

    Note over UE,UPF: N3 (GTP-U) re-established → uplink/downlink data flowing
    Note over UE: Transition to CM-CONNECTED

The difference from Network-triggered (Paging precedes it)

In the Network-triggered case, the biggest difference is that Paging is inserted before the diagram above. The UPF buffers and notifies of the DL data arrival, this passes through SMF→AMF, the AMF sends NGAP Paging, and the paged UE starts the Service Request of the diagram above.

sequenceDiagram
    autonumber
    participant UE as UE (CM-IDLE)
    participant RAN as (R)AN / gNB
    participant AMF
    participant SMF
    participant UPF

    Note over UPF: DL data for the target UE arrives (N3 not active) → buffer
    UPF->>SMF: PFCP Session Report (Downlink Data Report)
    SMF->>AMF: Namf_Communication_N1N2MessageTransfer (DL notification)
    Note right of SMF: For details, see the Paging chapter (paging.md)
    AMF->>RAN: NGAP Paging (to the gNBs of the Registration Area)
    RAN-->>UE: Air Paging (RRC, DRX)
    Note over UE: From here, start the same Service Request as "UE-triggered" above
    UE->>RAN: Service Request (NAS)
    Note over UE,UPF: Connection re-establishment / U-Plane re-activation (common with the diagram above)
    Note over UPF,UE: After re-establishment, deliver the buffered DL data

Step-by-step explanation (numbers correspond to the UE-triggered diagram)

  1. UE→(R)AN: the need to originate, send UL data, etc. arises; the UE (on the radio side) establishes/resumes the RRC connection (outline/out of scope) and carries the Service Request (NAS). The NAS may include a Service type (e.g. mo-signalling / mo-data, etc.; values to be confirmed) and information on the PDU Session(s) to be re-activated. Reference: TS 24.501 §5.6.1 (section number to be confirmed).
  2. (R)AN→AMF: the gNB puts the NAS onto an Initial UE Message (NGAP) and sends it to the AMF (N2 / TS 38.413).
  3. (Conditional) security/re-authentication: the AMF verifies the existing security context. It re-authenticates and runs Security Mode only when needed (situation dependent; the details are the subject of the Security/Authentication chapter).
  4. AMF's determination: the AMF determines which PDU Session(s) to re-activate, and notifies the SMF of the targets.
  5. AMF→SMF: requests U-Plane activation via Nsmf_PDUSession_UpdateSMContext (N11-equivalent SBI). The specific operation name/conditions are to be confirmed.
  6. SMF→UPF: reconfigures the UPF's N3/FAR via a PFCP Session Modification Request (N4). If the gNB-side N3 TEID is not yet fixed at this point, it may be fixed/reflected in a later step (steps 10-11) (procedure/implementation-dependent). Reference: TS 29.244.
  7. SMF→AMF: returns U-Plane information (the UPF-side N3 TEID, etc.) in the UpdateSMContext Response.
  8. AMF→(R)AN: sets the UE context, AS security, and PDU Session N3 information in the gNB via an Initial Context Setup Request (NGAP).
  9. (R)AN⇔UE (radio side, outline/out of scope): the gNB sets the AS security/radio resources via RRC, and the UE returns completion.
  10. (R)AN→AMF: notifies the gNB-side N3 TEID, etc. via an Initial Context Setup Response (NGAP).
  11. (Implementation/procedure dependent) reflecting the gNB N3 TEID: to reflect the gNB-side N3 TEID into the UPF's downlink FAR, an N4 update via AMF→SMF→UPF may be performed again (procedure/implementation-dependent; some implementations integrate this with step 6 above = to be confirmed).
  12. Data flow / state transition: N3 (GTP-U) is re-established, and uplink/downlink data flows. The UE transitions to CM-CONNECTED. In the Network-triggered case, the DL data buffered in the UPF is delivered.

Parts of the procedure are situation/implementation dependent

The number and order of the N4 updates accompanying U-Plane re-activation (when to reflect the gNB-side N3 TEID into the UPF) differ between the spec's description and implementations. The diagram above is a representative flow for understanding; whether there is one N4 Modification or two, and in which message the gNB N3 TEID is fixed, etc. are implementation-dependent and partly to be confirmed. Whether re-authentication occurs (step 3) is also situation dependent.

Reference: TS 23.502 §4.2.3 series (UE Triggered / Network Triggered Service Request, section number to be confirmed), TS 24.501 §5.6 series (NAS Service Request), TS 38.413 (NGAP), TS 29.244 (PFCP).

Signal Flow

The key Messages / service operations organized in a table. The IEs are made consistent with the Message Dictionary. Some IE names and operation names are marked to be confirmed because they are version/implementation dependent.

Message / Operation Protocol Source→Destination Purpose Key IEs (some to be confirmed) Result
Service Request NAS (5GMM) UE→AMF Request to resume the connection / re-activate the U-Plane Service type (mo-signalling/mo-data, etc.), 5GS mobile identity (5G-S-TMSI, etc.), information on the PDU Session(s) to be re-activated (IE name to be confirmed) The AMF starts Service Request processing
Initial UE Message NGAP gNB→AMF Transport of the NAS (Service Request) NAS-PDU, User Location, etc. The AMF receives the NAS
Nsmf_PDUSession_UpdateSMContext SBI (HTTP/2) AMF→SMF Request to activate the U-Plane of the target PDU Session PDU Session ID, activation instruction, (later) gNB N3 information The SMF triggers the N4 update
PFCP Session Modification Request PFCP SMF→UPF Reconfigure the UPF's N3/FAR Updated FAR (downlink destination = gNB N3 TEID), etc. The UPF reconfigures N3
Initial Context Setup Request NGAP AMF→gNB Set the UE context / AS security / PDU Session N3 information UE Security Capability, PDU Session Resource (N3 information), etc. The gNB sets the context/radio configuration
Initial Context Setup Response NGAP gNB→AMF Configuration complete / notify the gNB N3 TEID gNB-side N3 TEID/address, etc. The U-Plane information is fixed
Service Accept NAS (5GMM) AMF→UE Accept the Service Request (when needed) Acceptance information, (as needed) PDU Session status The UE recognizes acceptance

Service Accept is not always sent

When a Service Request succeeds, an explicit Service Accept is not necessarily returned; it depends on conditions (to be confirmed / situation dependent). On failure, a Service Reject may be returned with a Cause value (see the Cause Dictionary). For the detailed IEs and reference specs of each Message, see the Message Dictionary.

State Machine

The CM (Connection Management) state transitions on the UE side. A Service Request returns a CM-IDLE UE to CM-CONNECTED, and the reverse-direction AN Release drops CM-CONNECTED to CM-IDLE (basis: TS 23.501 §5.3 series, section number to be confirmed).

stateDiagram-v2
    [*] --> CM_IDLE: registered, after connection release
    CM_IDLE --> CM_CONNECTED: UE-triggered Service Request (origination / UL data)
    CM_IDLE --> CM_CONNECTED: Network-triggered Service Request (Paging response)
    CM_CONNECTED --> CM_IDLE: AN Release (radio connection release / U-Plane deactivation)
    CM_CONNECTED --> [*]
  • CM-IDLE — standby. There is no signaling connection for the UE, and the PDU Session's U-Plane (N3) is also deactivated. Starting a Service Request here (UE-triggered or a Paging response) moves it to CM-CONNECTED.
  • CM-CONNECTED — connected. Data/signaling are possible. After a period of no communication, etc., it returns to CM-IDLE via AN Release (the U-Plane is deactivated).

Service Request and AN Release are two sides of the same coin

Service Request (CM-IDLE→CONNECTED) and AN Release (CM-CONNECTED→IDLE) are a bidirectional pair that "lays / folds up" the connection and U-Plane. It repeats a cycle of folding up via AN Release to save power and re-laying via Service Request when communication resumes. This is on a different axis from the RM state (REGISTERED / DEREGISTERED); even while going back and forth between CM-IDLE ⇔ CM-CONNECTED, RM=REGISTERED is maintained. The details of the state definitions are to be confirmed in TS 23.501 §5.3 series.

Packet Analysis (Wireshark)

The key points when analyzing a Service Request with Wireshark. On the core side, the main observation targets are NAS Service Request / NGAP Initial Context Setup (N2) and PFCP Session Modification (N4).

Key Display Filters

Filter Meaning
ngap NGAP messages in general (including Initial UE Message / Initial Context Setup)
nas-5gs 5GS NAS messages in general (including Service Request)
pfcp PFCP messages in general (including Session Modification)
sctp.port == 38412 The SCTP port of N2 (NGAP)
udp.port == 8805 The UDP port of N4 (PFCP)
gtp N3 (GTP-U) (the TEID change before and after U-Plane re-establishment)

Filter values, IE names, and message types are environment dependent and to be confirmed

The NAS message type values, the numeric values of ngap.procedureCode, and the names of each IE are based on 3GPP's assignments, but how they are displayed and matched may differ depending on the Wireshark version and dissector implementation. This page does not assert fictitious numbers. Treat the specific procedureCode / message type values as to be confirmed, and on real equipment it is more reliable to check them in the GUI's protocol hierarchy display.

Points to note when decoding (key IEs)

  • NAS Service Request (UE→AMF) — note the following IEs (the IE names are representative notation, to be confirmed).
    • Service type — what the Service Request is for (mo-signalling / mo-data, etc.; the enumerated values are to be confirmed).
    • 5GS mobile identity — typically the 5G-S-TMSI (a short ID for Paging/connection resume).
    • Information on the PDU Session(s) to be re-activated — the instruction on which PDU Session to wake (equivalent to List Of PDU Sessions To Be Activated; IE name to be confirmed).
  • NGAP Initial Context Setup Request/Response (AMF⇔gNB) — the UE context setup and the PDU Session Resource (N3 TEID information). The gNB-side N3 TEID is fixed in the Response.
  • PFCP Session Modification Request (SMF→UPF) — the destination of the downlink FAR is updated to the new gNB's N3 TEID (the essence of U-Plane re-establishment).

The structure of NAS nested inside NGAP

The Service Request's NAS goes inside an NGAP message (Initial UE Message) as a NAS-PDU (the same nested structure as in Registration). In the packet detail pane it is displayed hierarchically as follows (the notation is conceptual; the actual names are dissector dependent = to be confirmed).

NGAP-PDU
 └─ InitialUEMessage
     └─ NAS-PDU
         └─ 5GS NAS Message
             └─ Service Request (Service type / 5G-S-TMSI, etc.)

Actual pcaps are environment dependent (implementation dependent)

The filters and IE names on this page are guidelines for analysis. Actual packets depend on the radio and core implementation and configuration. On an Open5GS or free5GC testbed, if you drop the UE to idle once and then originate/receive, you can actually capture the NAS Service Request / NGAP Initial Context Setup on the N2 segment and the PFCP Session Modification on the N4 segment and study them.

Configuration

The structural-level key points of the configuration for making a Service Request work. Specific values and vendor-specific details (Cisco, etc.) are implementation-dependent, and no fictitious values are written here. Much of the transition to CM-IDLE (AN Release) determination and the RRC resume is on the radio-access side (gNB), and the core (5GC) side's configuration is limited.

  • The deactivation timer / inactivity determination — how long a lack of communication must continue before AN Release drops it to CM-IDLE. The entity making the determination and the threshold are radio-side/implementation-dependent (the gNB's inactivity timer, etc.).
  • The core (AMF) side must be configured to, upon receiving an AN Release, update the UE context's CM state to IDLE and reflect the U-Plane deactivation to the SMF/UPF.
  • AMF — N2 (NGAP) is established, and it can process the Service Request (Initial UE Message / Initial Context Setup). It must hold the target UE's context (CM state, PDU Session list).
  • SMF/UPF — a PDU Session is already established, an N4 (PFCP) association is established, and it must be configured to be able to reconfigure N3/FAR.

Specific values and vendor-specific details are implementation dependent

The configuration file's key names, hierarchy, mandatory items, and the specific inactivity timer values differ across Open5GS / free5GC / commercial vendors (Cisco, etc.). The above are structural-level key points; check the actual key names and values in each implementation's documentation (implementation dependent). No fictitious configuration values are written on this page.

Trouble Shooting

Isolating typical Service Request failures (general discussion). For the details of Cause values, see the Cause Dictionary.

Symptom Presumed cause What to check Related logs/Packets Direction of remedy
(a) The Service Request is not processed (Reject) Security context mismatch, missing UE context, 5G-GUTI/5G-S-TMSI cannot be resolved The AMF's UE context, re-authentication when needed, the GUTI/TMSI mapping NAS Service Request/Reject, AMF logs Check UE context consistency and whether re-authentication is needed; check AMF re-selection/re-registration
(b) The connection is laid but the U-Plane (N3) is not re-established Nsmf UpdateSMContext / N4 Modification failure, gNB N3 TEID not reflected The AMF→SMF→UPF coordination, the N4 FAR update Nsmf/UpdateSMContext, PFCP Session Modification, SMF/UPF logs Check AMF→SMF→UPF reachability and that the downlink FAR reflects the gNB N3 TEID
(c) In the Network-triggered case, no response to Paging UE out of the area / DRX timing mismatch / Registration Area design error The consistency of the UE's serving TA and the Registration Area, the DRX configuration (see Paging) NGAP Paging, the gNB's air Paging logs Check the TAI design, DRX consistency, and serving area (Mobility Reg Update)
(d) Data is not delivered even after re-establishment The downlink FAR still points to the old gNB N3 TEID / the UPF buffer is not delivered The UPF's downlink FAR destination, the completion of the N4 Modification, buffer delivery PFCP Session Modification, the destination TEID of GTP-U (gtp), UPF logs Check the completion of the N4 Session Modification, and the SMF-UPF reachability and FAR update

Comparison with EPC

A comparison so that those experienced with 4G (EPC) can bridge to 5G. The basic idea is common between 4G and 5G: "return from idle and re-lay the user plane of the bearer / session." 4G also has UE-triggered / Network-triggered (Paging response) Service Requests.

Aspect 4G / EPC 5G / 5GC
Return procedure Service Request (UE-triggered / Network-triggered) Service Request (UE-triggered / Network-triggered)
Control NF MME AMF
Radio-node control S1AP (Initial Context Setup, etc., TS 36.413) NGAP (Initial Context Setup, etc., TS 38.413)
Standby state ECM-IDLE CM-IDLE
Connected state ECM-CONNECTED CM-CONNECTED
Unit of U-Plane re-establishment Re-activation of the EPS bearer (S1-U bearer establishment) U-Plane re-activation of the PDU Session / QoS Flow (N3 re-establishment)
U-Plane transport GTP-U (S1-U) GTP-U (N3)
Control of U-Plane reconfiguration MME→S-GW/P-GW (GTP-C, etc.) AMF→SMF→UPF (Nsmf/N4 PFCP, control/forwarding separation)
The preceding procedure in the Network-triggered case Paging (S1AP, S-GW buffering) Paging (NGAP, UPF buffering)

The idea is continuous from 4G; the separated design has evolved

The two-trigger framework (UE-triggered / Network-triggered) of "return from idle and re-lay the U-Plane" is continuous from 4G. The main evolution in 5G is that the control NF is replaced MME → AMF, radio-node control is replaced S1AP → NGAP, and control (AMF), session management (SMF), and forwarding (UPF) are separated, so that U-Plane re-establishment is performed by the AMF→SMF→UPF (Nsmf/N4 PFCP) coordination. The re-activation of the EPS bearer corresponds to the U-Plane re-activation of the PDU Session/QoS Flow.

Release differences

The main topics related to the Service Request. Uncertain items are marked to be confirmed and not asserted.

  • Rel-15 — the basics of the 5GC Service Request (UE-triggered / Network-triggered, CM states, U-Plane re-activation of the PDU Session) were established.
  • RRC Inactive (RRC_INACTIVE) — a UE state introduced in Rel-15. When the UE is in RRC_INACTIVE, a lightweight connection resume via RRC Resume, rather than a full Service Request, may be used (a radio-side mechanism; the handling of the CM state as seen from the core and the details are to be confirmed). This chapter focuses on the core-triggered Service Request, and the details of RRC Resume are out of scope.
  • Small Data Transmission (SDT) — a signaling-saving extension discussed/introduced from Rel-16 onward, for sending a small amount of data without fully establishing a connection (radio-centric; the scope of application and the impact on the core are to be confirmed). Out of scope of this chapter's Rel-15 basics.
  • Rel-17 / Rel-18 (5G-Advanced) — further power-saving/signaling-saving extensions continue (the specific differences to the Service Request procedure itself are to be confirmed).

Release differences are to be confirmed

Exactly which features were woven into the "Service Request procedure itself," and to what extent, in each Release must be checked against the version differences of the relevant TS individually. In particular, the positioning of RRC Inactive / RRC Resume / Small Data Transmission and the extent of their impact on the core (CM state, U-Plane) is an overview; the specific items are to be confirmed.

3GPP Specification

Spec Section Content
TS 23.502 §4.2.3 series UE Triggered / Network Triggered Service Request (the basis for this chapter's Call Flow; the detailed section numbers are to be confirmed)
TS 23.501 §5.3 series CM states (CM-IDLE / CM-CONNECTED) / Connection Management (section number to be confirmed)
TS 24.501 §5.6 series The NAS-side Service Request procedure (Service type, etc.; section number to be confirmed)
TS 38.413 (various NGAP sections) NGAP (Initial UE Message / Initial Context Setup, etc.; individual section numbers to be confirmed)
TS 29.244 (various PFCP sections) PFCP (N4: reconfiguration of the U-Plane (N3/FAR) = re-activation of the PDU Session)
TS 29.518 Namf (the AMF's service API)
TS 29.502 Nsmf (the SMF's service API, Nsmf_PDUSession)

Handling of section numbers

TS 23.502 §4.2.3 series (UE/Network Triggered Service Request) / TS 23.501 §5.3 series (CM states) / TS 24.501 §5.6 series (NAS Service Request) are referenced as the backbone of this chapter. However, the fine-grained section numbers (branch numbers such as §4.2.3.2 / §4.2.3.3, etc.) may differ by version, and some are marked to be confirmed. The NGAP individual section numbers of TS 38.413 and each IE name (Service type / List Of PDU Sessions To Be Activated, etc.) are also to be confirmed.

FAQ

Q1. How do UE-triggered and Network-triggered differ?

Who moves first differs. In the UE-triggered case, the UE itself spontaneously sends a NAS Service Request in order to originate, send uplink data, etc. (no Paging needed). In the Network-triggered case, when DL data for the UE arrives, the network calls the UE via Paging, and the paged UE starts a Service Request as a response (Paging precedes it). Even when the trigger differs, what follows — "connection re-establishment + U-Plane re-activation + transition to CM-CONNECTED" — is common.

Q2. Why does the U-Plane (N3) need to be re-established?

Because during CM-IDLE, the PDU Session itself is logically maintained, but the N3 (gNB⇔UPF) tunnel through which actual data flows is deactivated. While the UE is on standby there is no radio connection, and the delivery target (gNB) for downlink data is not fixed, so keeping N3 laid would be pointless. To resume communication, the N3/FAR must be reconfigured via SMF→UPF (N4) and the N3 with the gNB re-laid. This is the "U-Plane re-activation of the PDU Session."

Q3. When does a UE drop to CM-IDLE?

When there is no communication for a certain period, the network performs an AN Release (the release of the radio connection) and drops the UE from CM-CONNECTED → CM-IDLE. The aim is power saving and radio resource conservation. The determination (the inactivity threshold, etc.) is made mainly on the radio-access side (gNB), and the threshold is implementation-dependent. A Service Request is the reverse-direction (IDLE→CONNECTED) return procedure.

Q4. What is the difference between RRC Inactive's RRC Resume and this Service Request?

This chapter's Service Request is the procedure where, when the UE is in CM-IDLE, the connection and U-Plane are fully re-laid including the core (AMF). On the other hand, in the RRC_INACTIVE state (introduced in Rel-15), from the core's view the UE remains treated as connected while it enters a light standby on the radio side, and it returns via a lighter radio-side resume called RRC Resume. The entity that calls/returns (whether it includes the core or is within the radio) and the weight differ. The details of RRC Resume are on the radio side and out of scope of this chapter (details to be confirmed).

Q5. Does re-authentication (AKA) always run in a Service Request?

No. When the existing security context can be validly reused, re-authentication is omitted. Re-authentication can occur only under conditions such as when verification of the security context fails (situation dependent). The details of authentication (5G-AKA) are the subject of the Security/Authentication chapter; this chapter treats re-authentication as a conditional step.

Summary

  • A Service Request is the procedure by which a registered UE in CM-IDLE re-establishes the radio connection and UE context and transitions from CM-IDLE → CM-CONNECTED.
  • There are two triggers. UE-triggered = the UE spontaneously starts it for origination/UL data. Network-triggered = it is called by Paging on the arrival of DL data and starts as a response (Paging precedes it).
  • From the core's viewpoint, the leading roles are the AMF (NAS/N2 control) and the SMF/UPF (U-Plane re-establishment). Radio details such as RRC Resume are out of scope.
  • The broad flow is NAS Service Request (N1/N2) → the AMF sends Nsmf UpdateSMContext to the SMF → the SMF reconfigures the UPF's N3/FAR over N4 → NGAP Initial Context Setup sets the UE context/N3 information → N3 re-establishment → uplink/downlink flow.
  • The U-Plane re-activation of the PDU Session (reconfiguration of the N3 tunnel/FAR) is essential. The reverse-direction AN Release folds up CM-CONNECTED → CM-IDLE (a two-sided pair).
  • It corresponds to the 4G Service Request (MME / S1AP / ECM-IDLE→CONNECTED / EPS bearer re-activation), while 5G uses the AMF / NGAP / CM-IDLE→CONNECTED / U-Plane re-activation of the PDU Session.
  • The basis is TS 23.502 §4.2.3 series / TS 23.501 §5.3 series / TS 24.501 §5.6 series / TS 38.413 / TS 29.244 (some section numbers and IE names are to be confirmed).

Practice — comprehension check and exercises

Comprehension check

Q1. Which CM state is a UE targeted by a Service Request in? (answer)

CM-IDLE. If it were CM-CONNECTED, a connection would already exist, so a Service Request would be unnecessary.

Q2. What is the biggest difference between UE-triggered and Network-triggered? (answer)

Whether Paging precedes it. UE-triggered starts spontaneously without Paging; Network-triggered starts as a response after being called by Paging.

Q3. In a Service Request, what is ultimately re-established as the 'U-Plane re-activation'? (answer)

The gNB⇔UPF N3 tunnel (the gNB/UPF-side N3 TEID) and the UPF's downlink FAR. The SMF reconfigures the UPF over N4 (PFCP).

Q4. What is the (assumed) operation used for AMF→SMF in the U-Plane re-establishment? (answer)

Nsmf_PDUSession_UpdateSMContext (N11-equivalent SBI, to be confirmed). The SMF receives this and reconfigures the UPF over N4.

Q5. What is the reverse-direction (CM-CONNECTED→CM-IDLE) procedure of a Service Request? (answer)

AN Release. It releases the radio connection and deactivates the U-Plane (N3) to drop to CM-IDLE for power saving. A two-sided pair with the Service Request.

Exercises

Problem: Reorder the following main UE-triggered Service Request steps into the correct order.

A. AMF → gNB: Initial Context Setup Request (NGAP)
B. UE → gNB: Service Request (NAS) (after RRC connection establishment)
C. SMF → UPF: PFCP Session Modification (N3/FAR reconfiguration)
D. gNB → AMF: carry the NAS via Initial UE Message (NGAP)
E. N3 (GTP-U) re-established → uplink/downlink data flowing (CM-CONNECTED)
F. AMF → SMF: Nsmf_PDUSession_UpdateSMContext (U-Plane activation)
G. gNB → AMF: Initial Context Setup Response (NGAP) (gNB N3 TEID)
Answer

B → D → F → C → A → G → E

  • B: the UE sends the NAS Service Request (RRC establishment is on the radio side, outlined)
  • D: gNB→AMF carries the NAS via Initial UE Message (N2)
  • F: AMF→SMF UpdateSMContext (request U-Plane activation)
  • C: SMF→UPF N4 Session Modification (N3/FAR reconfiguration)
  • A: AMF→gNB Initial Context Setup Request (context/N3 information)
  • G: gNB→AMF Initial Context Setup Response (notify the gNB N3 TEID)
  • E: N3 re-established, data flowing → CM-CONNECTED

※ The number and order of the N4 updates that reflect the gNB N3 TEID into the UPF are implementation-dependent (some implementations integrate the additional N4 update after C and G = to be confirmed). In the Network-triggered case, Paging precedes B.

Next Step

The next steps to deepen your understanding.