5G NR › NAS & Core › Section 11.3
NAS & Core

PDU Session —
Opening the data path

Registration gave the UE an identity. A PDU session gives it a data path — an IP address, a GTP-U tunnel from gNB to UPF, and radio bearers with defined QoS. This section traces the full establishment procedure from the UE's NAS request through SMF/UPF setup to the first user data packet.

TS 23.502 §4.3.2 TS 24.501 §6.4.1 TS 38.331 §5.3.4

What a PDU session is

A PDU Session is an association between a UE and a Data Network (DN) — typically the internet or an IMS core. Each PDU session has:

An IP address (IPv4, IPv6, or both) assigned by the SMF/UPF. A set of QoS flows, each with a QFI and guaranteed/non-guaranteed bit rate. A GTP-U tunnel between gNB and UPF over N3. One or more DRBs in the RAN, mapped from QoS flows by SDAP.

A UE can have up to 15 concurrent PDU sessions. In practice, most devices have 1–3: internet, IMS, and perhaps an enterprise VPN.

Trigger — when PDU session is established

PDU session establishment can be triggered by the UE (sending a PDU Session Establishment Request) or by the network (via a network-triggered service request). The UE typically requests it immediately after Registration Accept, piggybacked in the RRCSetupComplete.

In our example, the UE sends a PDU session request for SST=1 (eMBB) in the Registration Request. The AMF includes the PDU session response in the Registration Accept.

Full establishment procedure

1
UE sends PDU Session Establishment Request (NAS)
Carried in UL NAS Transport (message type 0x67). Contains PDU session ID=1, PDU type=IPv4, SST=1 (eMBB), DNN="internet". AMF forwards to selected SMF via N11.
2
SMF selects UPF and establishes N4 session
SMF sends N4 Session Establishment Request to UPF. UPF allocates a TEID (Tunnel Endpoint ID) for the N3 GTP-U tunnel and returns it to SMF. UPF also assigns the UE's IP address from its pool.
N4 Session Establishment — SMF → UPF
UE IP address:   192.168.1.47  (assigned by UPF)
UPF N3 TEID:     0x0001A2B3   (tunnel endpoint for gNB→UPF)
UPF N3 address:  10.0.0.1      (UPF's N3 interface IP)
QoS rules:       QFI=1 → 5QI=9 (best-effort internet)
3
AMF sends PDU Session Resource Setup Request to gNB (NGAP)
The AMF forwards the session parameters to the gNB via NGAP. This includes the QoS profiles, UPF's GTP-U TEID and IP, and the NAS PDU (PDU Session Establishment Accept) to forward to the UE.
4
gNB sends RRCReconfiguration — establishes DRB1
The gNB configures a DRB for the PDU session and sends RRCReconfiguration to the UE. The UE applies the DRB config (SDAP, PDCP, RLC-AM, MAC, PHY), sends RRCReconfigurationComplete, then responds with PDU Session Establishment Accept on the new DRB.
5
gNB responds with PDU Session Resource Setup Response — GTP-U tunnel up
gNB allocates its own GTP-U TEID and sends it to AMF/UPF. The N3 tunnel is now bidirectional. User data can flow: UE → DRB1 → gNB → GTP-U → UPF → internet.

The complete data path

Data path after PDU session establishmentTS 23.502 §4.3.2
// Downlink: internet → UE
Internet ──► UPF (N6) ──► GTP-U tunnel (N3) ──► gNB ──► DRB1 ──► UE
              UE IP: 192.168.1.47
              TEID (gNB→UPF): 0x0001A2B3
              QFI=1, 5QI=9 (best-effort)

// Uplink: UE → internet
UE ──► DRB1 ──► gNB ──► GTP-U tunnel (N3) ──► UPF ──► Internet
              TEID (UPF→gNB): 0x0002C4D5  (gNB's TEID)

// Full protocol stack (downlink, from internet to UE):
Internet: IP packet (src: 8.8.8.8, dst: 192.168.1.47)
N6:  UDP/IP encap (trivial routing)
N3:  GTP-U header + UDP/IP (TEID 0x0001A2B3)
N3:  Ethernet/IP transport
Air: SDAP (QFI=1) → PDCP → RLC → MAC → PHY → OFDM → UE

QoS flow to DRB mapping in the RAN

The SMF specifies QoS flow rules in the N4 session. These flow to the gNB via NGAP. The gNB maps each QFI to a DRB — flows with similar QoS (same 5QI) can share one DRB. The SDAP layer in the UE applies this mapping and adds QFI headers to uplink packets.

PDU session established — data path open
UE IP           → 192.168.1.47
GTP-U tunnel    → gNB TEID ↔ UPF TEID 0x0001A2B3
QoS flow        → QFI=1, 5QI=9 (best-effort internet)
DRB             → DRB1 established — SDAP + PDCP + RLC-AM + MAC + PHY
UE is now fully connected — data flows
← PreviousRegistration & Authentication