If you take one idea from this page, make it this one : the SMF decides and the UPF does. Every packet of user data in 5G passes through a UPF and never through an SMF - the SMF touches no traffic at all. What it does instead is work out how that traffic should be handled, and then program the UPF accordingly. It is a controller, not a conduit.

That split is the single biggest structural change from 4G, where the SGW and PGW each did both jobs at once - deciding and forwarding, in the same box. Separating them means the part that forwards packets can be small, fast and placed wherever the traffic needs it, close to a factory or a stadium, while the part that makes decisions stays centralised where the policy and subscription data live. It is what makes edge deployment possible at all, and it is the reason the SMF and UPF appear as two boxes in every diagram on this page.

SMF stands for Session Management Function. Simply put, it collects all the informations related to PDU session management from various network components (e.g, UPF, PCF, UDM) and controls / orchastrates those network components based on request from AMF.

• Overall Architecture
• SMF Functionality
• SMF and interaction with other components
  • N11 : SMF and AMF
  • N7 : SMF and PCF
  • N10 : SMF and UDM
  • N4 : SMF and UPF
• UE-Initiated PDU Sesstion Establishment Process
• Reference :
• YouTube

Overall Architecture

The diagram below is the full core architecture with the SMF's own reference points picked out in blue, and it is worth counting them before reading on. There are four : N11 to the AMF, N10 to the UDM, N7 to the PCF and N4 to the UPF. Those four are exactly the four subsections you will find later on this page, so the picture is effectively a contents list.

Four is also a telling number in itself. Compare it with the NSSF, which has one, or the AMF, which has nine. The SMF sits in the middle of the range because it needs three different kinds of input before it can do anything - who the subscriber is, what policy applies, and where to send the traffic - and then one channel back to report the result.

The SMF and interactions with other network components within 5G Core network is illustrated below.

• N11 joins session control to access control : the blue link between AMF and SMF carries session-context requests and responses. The AMF relays UE and RAN signaling, but the SMF remains responsible for the PDU session decision.
• N10 supplies subscription limits : the UDM link gives the SMF the subscribed DNN and slice settings. A requested PDU session cannot be accepted merely because the UE asks for it; the SMF checks the subscription.
• N7 supplies policy decisions : the PCF link can provide authorized QoS and charging treatment. This is a control-plane input to the SMF, not a path taken by user packets.
• N4 programs packet handling : the SMF installs PFCP rules in the UPF. This blue link controls packet treatment while the UPF, not the SMF, forwards the resulting user traffic.
• N3 and N6 carry data outside the SMF : the drawing shows the RAN-to-UPF link marked 3 and the UPF-to-DN link marked 6. Their placement makes the control-plane and user-plane split visible.

Followings are the name of each network component.

AMF     Access and Mobility Management Function ==> Equivalent to MME in 4G
<hl1>AUSF</hl1>    Authentication Server Function
DN       Data Network
NEF      Network Exposure Function
NRF      Network Repository Function
NSSF    Network Slice Selection Function
PCF      Policy Control Function ==> Equivalent to PCRF in 5G
(R)AN   (Radio) Access Network
SMF     Session Management Function
<hl1>UDM</hl1>     Unified Data Management ==> Equivalent to HSS in 4G
UPF      User Plane Function ==> Equivalent to PGW in 4G
SMSF   SMS Function
<hl1>SEAF</hl1>    SEcurity Anchor Function ==> part of AMF function
<hl1>ARPF</hl1>    Authentication credential Repository and Processing Function</hl1>
<hl1>SIDF</hl1>    Subscription Identifier De-concealing Function

SMF Functionality

The list below is long, but it collapses into three groups once you notice what each item is really about. Some are about setting a session up - establishment, IP address allocation, subscription verification. Some are about telling the UPF what to do - QoS configuration, packet routing and forwarding, traffic steering. And some are about watching what happens afterwards - usage reporting, charging, downlink data notification.

Reading them in those three groups is more useful than reading them in order, because it shows the same pattern repeating : in every case the SMF gathers information from somewhere, converts it into rules, and installs those rules in the UPF. Even charging works this way - the SMF does not count bytes, it tells the UPF which counters to keep and then collects the answers.

Based on 23.501-6.2.2, the functionality of SMF is descrbed as follows. The most fundamental function of SMF is PDU session management and you can take all other functions as subsidiary functions to better manage PDU session.

• PDU Session Establishement (23.502-4.3.2) : The SMF is responsible for establishing, modifying, and releasing PDU sessions. These sessions are logical connections between the UE and the Data Network (DN).
• a UE initiated PDU Session Establishment procedure.
• a UE initiated PDU Session handover between 3GPP and non-3GPP.
• a UE initiated PDU Session handover from EPS to 5GS.
• a Network triggered PDU Session Establishment procedure.
• IP Address Management : It allocates and manages IP addresses for UEs, handling both IPv4 and IPv6 address types. It performs the role of a DHCP server for IP address allocation
• QoS Management : It configures traffic steering parameters and ensures appropriate routing of packets in the UPF
• Policy Control : The SMF interacts with the Policy Control Function (PCF) to receive and implement policy and charging rules
• Charging : The SMF handles connectivity charging through interaction with the Charging Function (CHF)
• Downlink Data Notification : The SMF manages the process of notifying the network when downlink data arrives for an idle UE, initiating paging procedures
• Subscription Verification : It checks UE requests against user subscriptions to ensure compliance
• Traffic usage reporting : The SMF interacts with the User Plane Function (UPF) to collect usage data for each PDU session.
• Packet routing and forwarding : SMF configures the UPF with the necessary routing and forwarding rules for each PDU session. It instructs the UPF on how to handle incoming and outgoing packets for specific sessions.
• Traffic steering : The SMF receives policy rules from the PCF that may include traffic steering instructions. Based on these rules, the SMF configures the UPF to apply appropriate traffic steering policies. It can instruct the UPF to route traffic through specific network slices or to particular data networks based on service requirements.

SMF and interaction with other components

The SMF has four different partners in the architecture diagram above. N11 carries session context between AMF and SMF. N7 brings policy from PCF, N10 brings subscription data from UDM, and N4 programs packet handling in UPF. The examples below follow one successful session and show only selected fields, not complete captures.

N11 : SMF and AMF

The AMF asks the SMF to create and update a PDU session context over N11. The AMF carries N1 and N2 information, while the SMF makes session decisions and returns the information needed by the UE and RAN.

The sequence below shows the request, the response, and a later update. The update depends on the session state and may occur at a different time from initial establishment.

N11 : SMF and AMF. Representative successful sequence; conditional exchanges are omitted.

Each numbered row matches one arrow above. The values are synthetic selected fields. Referenced binary parts and omitted PFCP information elements are not shown as complete messages.

POST /nsmf-pdusession/v1/sm-contexts
Content-Type: multipart/related (JSON part)
{"supi":"imsi-001010123456789","pduSessionId":10,
 "dnn":"internet","sNssai":{"sst":1,"sd":"000001"},
 "servingNfId":"3f19d3ba-a7d4-4b17-96a7-05b43d914817",
 "servingNetwork":{"mcc":"001","mnc":"01"},
 "anType":"3GPP_ACCESS","requestType":"INITIAL_REQUEST",
 "smContextStatusUri":"https://amf.example.net/sm-status/10",
 "n1SmMsg":{"contentId":"n1-sm-request"}}

201 Created
Location: /nsmf-pdusession/v1/sm-contexts/ctx-10
{"pduSessionId":10,
 "n2SmInfo":{"contentId":"n2-sm-setup"},
 "n2SmInfoType":"PDU_RES_SETUP_REQ"}

POST /nsmf-pdusession/v1/sm-contexts/ctx-10/modify
Content-Type: multipart/related (JSON part)
{"n2SmInfo":{"contentId":"n2-sm-setup-rsp"},
 "n2SmInfoType":"PDU_RES_SETUP_RSP"}

200 OK
{"upCnxState":"ACTIVATED"}

N7 : SMF and PCF

The SMF requests session policy from the PCF over N7 when dynamic policy control applies. The PCF decides authorized session parameters and PCC rules. The SMF then converts relevant decisions into UE signaling and UPF rules.

The sequence below shows the request, the response, and a later update. The update depends on the session state and may occur at a different time from initial establishment.

N7 : SMF and PCF. Representative successful sequence; conditional exchanges are omitted.

Each numbered row matches one arrow above. The values are synthetic selected fields. Referenced binary parts and omitted PFCP information elements are not shown as complete messages.

POST /npcf-smpolicycontrol/v1/sm-policies
{"supi":"imsi-001010123456789","pduSessionId":10,
 "pduSessionType":"IPV4","dnn":"internet",
 "sliceInfo":{"sst":1,"sd":"000001"},
 "notificationUri":"https://smf.example.net/policy/10/notify"}

201 Created
Location: /npcf-smpolicycontrol/v1/sm-policies/pol-10
{"sessRules":{"rule-1":{"sessRuleId":"rule-1",
 "authSessAmbr":{"uplink":"50 Mbps","downlink":"100 Mbps"}}}}

POST /npcf-smpolicycontrol/v1/sm-policies/pol-10/update
{"repPolicyCtrlReqTriggers":["UE_IP_CH"],
 "ipv4Address":"10.20.0.2"}

200 OK
{"sessRules":{"rule-1":{"sessRuleId":"rule-1",
 "authSessAmbr":{"uplink":"50 Mbps","downlink":"100 Mbps"}}}}

N10 : SMF and UDM

The SMF reads session-management subscription data from the UDM over N10. The returned DNN, slice, and session-type settings constrain what the SMF may establish. The SMF may also subscribe to later changes instead of repeatedly fetching the same data.

The sequence below shows the request, the response, and a later update. The update depends on the session state and may occur at a different time from initial establishment.

N10 : SMF and UDM. Representative successful sequence; conditional exchanges are omitted.

Each numbered row matches one arrow above. The values are synthetic selected fields. Referenced binary parts and omitted PFCP information elements are not shown as complete messages.

GET /nudm-sdm/v2/imsi-001010123456789/sm-data
  single-nssai = {"sst":1,"sd":"000001"}
  dnn = internet

200 OK
[{"singleNssai":{"sst":1,"sd":"000001"},
  "dnnConfigurations":{"internet":{
    "pduSessionTypes":{"defaultSessionType":"IPV4"},
    "sscModes":{"defaultSscMode":"SSC_MODE_1"}}}}]

POST /nudm-sdm/v2/imsi-001010123456789/sdm-subscriptions
{"nfInstanceId":"4a4d174e-d204-48fb-b775-b53b1ddf8dbd",
 "callbackReference":"https://smf.example.net/sdm-notify",
 "monitoredResourceUris":["https://udm.example.net/nudm-sdm/v2/imsi-001010123456789/sm-data"]}

201 Created
Location: /nudm-sdm/v2/imsi-001010123456789/sdm-subscriptions/42

N4 : SMF and UPF

N4 uses PFCP, not a service-based HTTP API. The SMF establishes a PFCP session and installs detection, forwarding, and QoS rules in the UPF. After the RAN reports its tunnel endpoint, the SMF modifies the forwarding rule for downlink traffic.

The sequence below shows the request, the response, and a later update. The update depends on the session state and may occur at a different time from initial establishment.

N4 : SMF and UPF. Representative successful sequence; conditional exchanges are omitted.

Each numbered row matches one arrow above. The values are synthetic selected fields. Referenced binary parts and omitted PFCP information elements are not shown as complete messages.

PFCP Session Establishment Request (selected IEs)
Node ID: 192.0.2.10
CP F-SEID: SEID 0x100001, IPv4 192.0.2.10
Create PDR: PDR ID 1, Source Interface Access, FAR ID 1
Create FAR: FAR ID 1, Apply Action FORW, Destination Interface Core
Create QER: QER ID 1, QFI 9

PFCP Session Establishment Response (selected IEs)
Cause: Request accepted
UP F-SEID: SEID 0x200001, IPv4 192.0.2.20
Created PDR: PDR ID 1, F-TEID 0x01020304

PFCP Session Modification Request (selected IEs)
SEID: 0x200001 (UPF session)
Update FAR: FAR ID 2, Apply Action FORW
Forwarding Parameters: Destination Interface Access
Outer Header Creation: GTP-U/UDP/IPv4
  TEID 0x10203040, RAN IPv4 198.51.100.20

PFCP Session Modification Response (selected IEs)
SEID: 0x100001 (SMF session)
Cause: Request accepted

• N11 carries session context : the SMF receives access results through the AMF, not directly from the RAN.
• N7 and N10 supply constraints : policy and subscription data shape what the SMF may install.
• N4 controls forwarding : the UPF forwards traffic only under the PFCP rules installed by the SMF.

UE-Initiated PDU Sesstion Establishment Process

This is the procedure that turns a registered UE into a UE that can actually send data. Registration got the device known to the network and gave it an identity ; it did not give it a path to the internet. That is what a PDU session is, and establishing one is where most of the SMF's work happens.

Before reading the fourteen steps, it is worth knowing the shape of the call flow you will see in the figure. The SMF is contacted once, by the AMF, and then fans out - to the UDM for subscription data, to the PCF for policy, to the UPF to install the forwarding rules - before answering. Everything between step 3 and step 11 is the SMF gathering what it needs and programming the user plane. The AMF waits throughout, which is why the SMF is fairly described as the orchestrator of the procedure rather than just a participant in it.

The UE-Initiated PDU Session Establishment process in the 5G Core (5GC) network is a fundamental procedure that allows a User Equipment (UE) to establish a Packet Data Unit (PDU) session with the network. This process is essential for the UE to gain access to data services in the 5G network.

The UE-Initiated PDU Session Establishment process in the 5G Core network is a multi-step procedure that involves several network functions working in tandem to set up a data session for the UE. This process ensures that the UE gets the necessary resources and policy treatment for its data traffic.

The high level description on the interaction between SMF and other network components for the PDU session establishment can be described as follows :

• PDU Session Establishment Request: The process begins when the UE sends a PDU Session Establishment Request to the Access and Mobility Management Function (AMF). This request contains necessary information such as the desired Slice/Service Type (SST), Session and Service Continuity (SSC) mode, and other relevant parameters.
• AMF to SMF Request: The AMF forwards the request to the Session Management Function (SMF). The AMF selects an SMF based on the information provided by the UE and other network policies.
• SMF Interaction with UPF: The SMF interacts with the User Plane Function (UPF) to set up the necessary user plane resources. The UPF is responsible for handling user data traffic and routing it appropriately.
• Policy Control: The SMF may also interact with the Policy Control Function (PCF) to obtain policy rules for the new PDU session. These rules dictate how the user's data should be treated (e.g., Quality of Service, charging, etc.).
• PDU Session Establishment Accept: Once the necessary resources are allocated and policy rules are set, the SMF informs the AMF, which in turn sends a PDU Session Establishment Accept message to the UE.
• Data Transfer: With the PDU session established, the UE can now transfer data with the 5G network. The UPF handles the routing of this data to the appropriate destination, be it the internet, another UE, or a service within the 5G network.
• Session Context: Throughout the session, the SMF maintains the session context, which contains all the necessary information about the PDU session, such as the allocated resources, policy rules, and other session parameters.

The detailed signaling procedure for PDU session Establishement is depicted in 3GPP as follows :

< 23.502 - Figure 4.3.2.2.1-1: UE-requested PDU Session Establishment for non-roaming and roaming with local breakout >

1. PDU Session Establishment Request: The User Equipment (UE) initiates a request to establish a PDU session by sending the message to AMF. This is the initial communication signaling the UE's intent to establish a data session.

2. SMF selection: The AMF (Access and Mobility Management Function) selects an appropriate SMF (Session Management Function) for managing this PDU session.

3. Nsmf_PDUSession_CreateSMContext Request: AMF sends a request to the selected SMF to create a session management context. This context holds information about the session.

4. Subscription retrieval/ Subscription for updates: SMF interacts with the UDM (Unified Data Management) to retrieve subscription details or subscribe for updates. This ensures SMF has the latest subscriber information.

5. Nsmf_PDUSession_CreateSMContext Response: The SMF responds to the AMF indicating the result of the session management context creation, either successful or with reasons for failure.

6. PDU Session authentication/authorization: Before proceeding, there's an authentication and authorization process ensuring the UE has the right permissions to establish the session.

7a. PCF selection: The SMF selects a PCF (Policy Control Function) for policy decisions related to this session.

7b. SM Policy Association Establishment or SMF initiated SM Policy Association Modification: This step involves either establishing a new policy association or modifying an existing one based on the session requirements.

8. UPF selection: The SMF selects a UPF (User Plane Function) which will handle the user plane traffic for this session.

9. SMF initiated SM Policy Association Modification: The SMF might initiate a modification to the established policy association based on certain criteria or network conditions.

10a. N4 Session Establishment/Modification Request: SMF make a request to UPF to establish or modify a session on the N4 interface, which is between the SMF and UPF.

10b. N4 Session Establishment/Modification Response: The UPF responds to the SMF's request indicating the success or failure of the session establishment or modification on the N4 interface.

11. Namf_Communication_N1N2MessageTransfer: SMF sends a message to AMF via the Namf_Communication_N1N2MessageTransfer interface. This message contains a wealth of information regarding the PDU session:

12. N2 PDU Session Request (NAS msg): This step involves the AMF sending a PDU session request to RAN over the N2 interface, which is an NAS (Non-Access Stratum) message.

13. AN-specific resource setup (PDU Session Establishment Accept): The Access Network (AN) sets up specific resources for the session, and then a PDU Session Establishment Accept message is sent.

14. N2 PDU Session Response: Finally, a response for the N2 PDU session request is sent from RAN to AMF, indicating the result of the session establishment attempt.

What happens after step 14

The list above stops at step 14, but the second half of the figure carries on to step 21, and the part it covers is where the session actually starts carrying traffic. It is worth walking because it contains one detail that surprises most people the first time they see it.

At step 14 the radio network has told the AMF that its resources are ready. What it has not done is tell the UPF anything - and the UPF is the node that has to forward the packets. That gap is what steps 15 and 16 close :

   15  Nsmf_PDUSession_UpdateSMContext Request     AMF -> SMF
           the AMF passes on what the RAN reported, including the tunnel
           endpoint the RAN will listen on for downlink traffic

   16a N4 Session Modification Request             SMF -> UPF
   16b N4 Session Modification Response            UPF -> SMF
           the SMF installs that endpoint in the UPF, so the UPF finally
           knows where to send downlink packets

   17  Nsmf_PDUSession_UpdateSMContext Response    SMF -> AMF
   18  Nsmf_PDUSession_SMContextStatusNotify       SMF -> AMF
   19  IPv6 Address Configuration                  to the UE, if IPv6 is used
   20  SMF initiated SM Policy Association Modification   optional, back to the PCF
   21  Unsubscription                              optional, tidy-up with the UDM

Now the detail worth noticing. Look at where the two data markers sit in the figure. First Uplink Data appears before step 15, and First Downlink Data only after step 16b. Uplink and downlink do not become usable at the same moment, and there is a real reason for the gap.

Uplink works as soon as the radio bearer exists, because the RAN was told where the UPF is when the session was set up - it can start forwarding the moment the UE has something to send. Downlink cannot, because until step 16 the UPF has no idea which RAN node to send to or over which tunnel. The information travels UE side first and only reaches the UPF once the AMF has relayed it to the SMF and the SMF has programmed it in.

So for a brief window a PDU session is genuinely half open - the UE can talk but cannot be answered. It is short enough that nothing notices, but it explains something that otherwise looks odd in a trace : the first uplink packet of a session can appear before the procedure that establishes it has finished.

NOTE : several steps in the figure are drawn with dashed boxes - 4, 7b, 9, 10a, 16c, 20 and 21. Dashed means conditional, not optional-in-practice. Step 4 for instance is skipped if the SMF already holds the subscription data from an earlier session for the same UE, and the policy steps are skipped entirely in a deployment with no dynamic PCC. A real trace will therefore often be noticeably shorter than the figure suggests.

Reference :

• 3GPP TS 29.502, Nsmf_PDUSession API - N11 service operations.
• 3GPP TS 29.512, Npcf_SMPolicyControl API - N7 service operations.
• 3GPP TS 29.503, Nudm_SDM API - N10 service operations.
• 3GPP TS 29.244, PFCP - N4 session procedures and information elements.
• What is the 5G Session Management Function (SMF)? - Microsoft
• 5G System Overview - 3GPP
• Network Function | Session Management Function (SMF) in 5G Core Network | 5G System (5GS) - TECHTRAINED

YouTube

• 5G Session Management Signalling Analysis - Taha Sajid - (2021)
• 5G Core - Session Management Function (SMF) -Raghvendra Agarwal (2022)