SMF — Session Management Function in 5G NR

Introduction

The Session Management Function (SMF) is the control-plane network function of the 5G Core that owns the life of a data connection. Defined in TS 23.501 with its procedures in TS 23.502, it is the function that establishes, modifies and releases every PDU session, assigns the UE its IP address, selects the user-plane box that will carry the traffic, and programs that box with forwarding, QoS and charging rules over the N4 interface.

You meet the SMF the instant a device wants data. Registration and mobility are handled by the AMF; but the moment the UE asks for connectivity to a data network — the public internet, an enterprise LAN, the IMS network that carries voice — the AMF hands the request to an SMF, and from then on that SMF is the brain of the session. It stays involved for the whole life of the connection: while the UE moves, while policy changes, while quota is consumed, until the session is torn down.

It matters because the SMF is the linchpin of CUPS — the Control and User Plane Separation that defines the 5G data path. It is the only function that both makes session decisions and directly commands the box that moves the bytes. Understand the SMF and you understand how policy, addressing, QoS and mobility all converge into a single set of rules installed in a UPF.

Why the SMF is needed

The concrete purpose is separation of concerns. In LTE the control and user planes were fused in the PGW; scaling data throughput meant scaling the signalling brain along with it, and placing a data exit at the network edge meant relocating the intelligence too. 5G splits them: session logic (the SMF) is centralized and cloud-native, while the forwarding engine (the UPF) can be placed anywhere — deep in a data centre for internet access or right beside a factory for low latency — and still be driven remotely.

The SMF is the piece that makes that split work. Sessions change on a different cadence than a UE's location, so decoupling session control from the mobility function (the AMF) lets each scale independently. And because the SMF holds all the session intelligence, the UPF beneath it can stay deliberately simple, cheap and swappable — it just executes the rules it is handed.

What the SMF owns: the PDU session

The unit of work for the SMF is the PDU session — a logical data connection between the UE and a specific data network, identified end-to-end by a PDU Session ID. Everything the SMF does is in service of one of these: creating it, changing it, tearing it down, and keeping the forwarding plane underneath it correct while the UE moves. Per TS 23.501, a single UE can hold several PDU sessions at once — one to the public internet, one to an enterprise DNN, one to an IMS/voice network — and each is managed independently, potentially by a different SMF.

A PDU session is characterized at creation by a bundle of parameters the SMF must honour: its PDU Session Type (IPv4, IPv6, IPv4v6, Ethernet or Unstructured), the DNN (Data Network Name), the S-NSSAI (which slice), and its SSC mode. The SMF validates each against subscription data before committing anything to the user plane.

Session lifecycle: establishment, modification, release

The procedures in TS 23.502 read as a simple lifecycle, and it pays to hold that shape in your head before diving into any single call flow. A PDU session is established when the UE asks for connectivity to a DNN, modified whenever something about it changes (a new QoS flow, a policy update, the UE moving to a new UPF), and released when the UE, the network, or a policy decision decides it should end.

Establishment is the busy one. The UE sends a PDU Session Establishment Request as a NAS-SM message; because the UE has no direct control link to the core, that message travels inside N1 and is relayed by the AMF. The AMF selects an SMF and calls Nsmf_PDUSession_CreateSMContext over N11. The SMF then, in roughly this order: retrieves the Session Management Subscription from the UDM over N10 (via Nudm_SDM_Get) and subscribes to changes; registers itself as the serving SMF for this PDU Session ID with Nudm_UECM_Registration; runs an SM Policy Association Establishment with the PCF over N7 (Npcf_SMPolicyControl_Create) to obtain PCC rules; allocates the UE's IP address; selects a UPF; and establishes the N4 session by installing forwarding, QoS and reporting rules with PFCP. Finally it returns the N2 SM Information that tells the gNB how to build the N3 tunnel, and a PDU Session Establishment Accept flows back to the UE.

The states a session moves through are worth naming precisely, because logs and specifications refer to them constantly.

Note the distinction between releasing a session and merely deactivating its user plane: on idle, the SMF keeps the context but drops the N3 tunnel, rebuilding it on the next Service Request. Full release frees the IP and closes the policy and charging associations for good.

IP address allocation and UPF selection

Two of the SMF's decisions shape everything downstream: what address the UE gets, and which forwarding box anchors its traffic.

Address allocation depends on the PDU Session Type. For an IPv4 session the SMF typically allocates from an internal pool or via DHCPv4, returning the address in the PDU Session Establishment Accept. For IPv6 the mechanism is Stateless Address Autoconfiguration (SLAAC): the SMF assigns a /64 IPv6 prefix and the UE forms its own address, with Router Advertisements sent through the UPF; IPv4v6 combines both. For an Ethernet PDU session there is no IP address at all — the session carries Ethernet frames and the UPF behaves like a bridge port, which is how 5G supports industrial and LAN-style connectivity. Unstructured sessions carry opaque PDUs (for example, some IoT transports) with no addressing imposed by the SMF.

UPF selection is one of the SMF's most consequential jobs. Guided by TS 23.501, it weighs the DNN and S-NSSAI, the UE's location, the SSC mode, the UPF's capabilities and load reported over N4, and whether local breakout or an UL CL (Uplink Classifier) / Branching Point is needed. The result may be a single PSA-UPF (PDU Session Anchor) or a chain: an intermediate I-UPF near the RAN plus a separate anchor, joined over N9 — and the SMF controls every element over N4.

N4 and PFCP: how the SMF programs the UPF

This is the heart of session management. The SMF never forwards a packet itself — instead it tells the UPF exactly how to. That instruction channel is N4, and the protocol on it is PFCP (Packet Forwarding Control Protocol), defined in TS 29.244. PFCP runs over UDP (port 8805) and lets the SMF create, modify and delete an N4 session inside the UPF using three request/response pairs: PFCP Session Establishment, PFCP Session Modification and PFCP Session Deletion, plus PFCP Session Report in the reverse direction when the UPF needs to tell the SMF something (usage thresholds, first packet detected, error). Before any session exists, the two ends first bring up a node-level association with PFCP Association Setup and keep it alive with PFCP Heartbeat.

The intelligence lives in the rules the SMF installs. Each N4 session carries a set of rule objects, and understanding the four main ones is understanding how a UPF is programmed. A packet arriving at the UPF is first matched by a PDR, which points at a FAR for what to do with it, plus optionally a QER for how to treat it and one or more URRs for how to count it. Tunnel endpoints on N3/N9 are identified by an F-TEID (a GTP-U TEID plus IP address) that the SMF and UPF exchange in these rules.

Two more rule types round out the picture: the BAR (Buffering Action Rule) governs how the UPF buffers downlink packets for an idle UE and how it signals the SMF to trigger paging, and the MAR (Multi-Access Rule) supports ATSSS steering across 3GPP and non-3GPP access. But PDR/FAR/QER/URR are the quartet you must be able to recite: match, act, police, count.

QoS, policy from the PCF, and charging

The SMF is where policy becomes enforcement. On its own it holds no business rules; it obtains them from the PCF over N7 during SM Policy Association Establishment, in the form of PCC rules (Policy and Charging Control rules). Each PCC rule binds a traffic flow (an SDF template) to a treatment: a 5QI (5G QoS Identifier) and associated characteristics, bit-rate limits (GBR/MBR), an ARP (Allocation and Retention Priority), gating, and a charging key. The SMF's job is to translate those abstract PCC rules into concrete enforcement: it derives QoS flows (each tagged with a QFI), builds the corresponding QERs and PDRs for the UPF over N4, and hands the RAN the QoS profiles it needs via N2 SM Information.

Charging is the other half of the PCC story. The SMF interacts with the CHF (Charging Function) over the Nchf service interface (Nchf_ConvergedCharging) to run converged online and offline charging. Online charging means the SMF requests and holds quota from the CHF before allowing usage; it enforces that quota by installing URRs in the UPF, and when the UPF reports that a volume or time threshold has been crossed via a PFCP Session Report, the SMF reports usage to the CHF and requests more quota (or triggers termination). Offline charging simply accumulates usage records. Either way the loop is the same: URR on the UPF measures, PFCP report carries it up, SMF relays it to the CHF.

This is why the URR matters so much: without one installed by the SMF, the UPF counts nothing and the CHF hears nothing.

SSC modes and service/session continuity

When a UE moves far enough, the PSA-UPF that anchors its session may no longer be well placed — traffic could be tromboning across the network to reach an anchor that is now geographically wrong. Session and Service Continuity (SSC), defined in TS 23.501, governs how the SMF handles that, and the UE requests one of three SSC modes at establishment.

The mechanics are pure SMF work over N4. For SSC mode 3 it selects a new PSA-UPF, establishes a fresh N4 session and IP prefix, signals the UE to move to the new address, and only then deletes the old N4 session. In all modes the SMF may also insert or remove an I-UPF as the UE moves, adjusting the N9 chaining without the UE noticing.

Interfaces, service operations, DNN/S-NSSAI binding, and roaming

Pulling the interfaces together makes the SMF's place in the core concrete. It is reached as Nsmf on the service bus, and it in turn consumes services from and terminates reference points to several peers.

Service operations, precisely. On the SBA bus the SMF both offers and consumes named service operations, and the exact names appear constantly in logs and specs. It produces the Nsmf_PDUSession service — CreateSMContext, UpdateSMContext, ReleaseSMContext and the SMContextStatusNotify callback toward the AMF — plus Nsmf_EventExposure so other NFs can subscribe to session events. It consumes Nudm_SDM_Get/Subscribe and Nudm_UECM_Registration from the UDM, Npcf_SMPolicyControl_Create/Update/Delete from the PCF, Nchf_ConvergedCharging_Create/Update/Release from the CHF, and uses the NRF (Nnrf_NFDiscovery) to find candidate UPFs and peer NFs.

DNN and S-NSSAI binding. Every PDU session is scoped by a (DNN, S-NSSAI) pair: the DNN names which data network to reach, and the S-NSSAI names which network slice the session lives in. The SMF is itself selected partly on this pair — an operator can dedicate SMF instances to particular slices — and it validates the requested pair against the UE's subscription from the UDM before accepting the session. That binding then flows down into everything: which UPFs are eligible, which PCF policy applies, and how the session is charged.

Roaming is where the SMF can split in two. In home-routed roaming the session control is divided into a V-SMF in the visited PLMN and an H-SMF in the home PLMN, joined over the N16 interface. The V-SMF handles the visited-network user plane (a V-UPF anchoring the N3 toward the RAN), while the H-SMF anchors the session in the home network (with the H-UPF reaching the home DNN) and enforces home policy. The alternative, local breakout, keeps a single SMF in the visited network using visited-network policy. The split matters because it lets the home operator retain control of a subscriber's data path and charging even while the device is served by another operator's radio.

Summary

The SMF is the control-plane owner of every PDU session. It takes the request the AMF relays over N11, validates it against subscription data from the UDM (N10), pulls PCC rules from the PCF (N7), allocates the UE's address, selects one or more UPFs, and programs them over N4 with PFCP — installing PDR/FAR/QER/URR to match, act, police and count. It translates abstract policy into concrete QoS flows, drives converged charging with the CHF, keeps the session alive through mobility using the SSC modes, and in roaming splits into a V-SMF/H-SMF pair over N16. The one thing to carry away: the SMF decides and commands, but never carries a byte itself — it is the control-plane descendant of LTE's PGW-C.

Quick Q&A

The questions below separate reciting acronyms from understanding what the SMF actually does.