UPF — User Plane Function in 5G NR

Introduction

The User Plane Function (UPF) is the single network function in the 5G System that touches user packets. Every control-plane function decides things; the UPF does things — at line rate, for every byte a UE sends or receives. It sits on the data path between the radio access network and the data network, and the whole user plane is built around it: UE → gNB → UPF → DN.

You meet the UPF on every single packet. From the moment a PDU session becomes active until it is released, the UPF is decapsulating GTP-U tunnels, classifying flows, policing rates, marking QoS and counting usage. It never signals the UE and never makes a session decision; it simply executes the rules the SMF installed. That deliberate simplicity is its superpower.

It matters because the UPF is what makes the 5G data path fast and flexible. Because forwarding is separated from control (the CUPS principle, defined in TS 23.501), an operator can place a UPF deep in a central data centre for internet access or right at the network edge next to a factory for ultra-low latency — without moving the control-plane brains. Understand the UPF and you understand where the bytes really go.

Why the UPF is needed

The concrete purpose is Control and User Plane Separation. In LTE the forwarding engine and the session brain lived together inside the PGW, so you could not scale raw throughput or move the data exit to the edge without dragging the control logic along. 5G breaks them apart: the SMF holds all the intelligence, and the UPF becomes a pure, stateless-per-decision packet processor whose entire behaviour is described by the rules currently installed in it.

That separation is what buys the operator flexibility. Because the UPF carries no subscription data, runs no UE signalling and takes no policy decisions, it can be scaled horizontally like any cloud workload, deployed cheaply at the edge for low-latency and local-breakout use cases, and swapped between vendors. The UPF is "dumb and fast" on purpose — that is precisely why it is powerful.

The user-plane workhorse

The UPF (User Plane Function) is the single function in the 5G System that touches user packets. Control-plane functions — the AMF, the SMF, the PCF — decide things; the UPF does things, at line rate, for every byte a UE sends or receives. It sits between the radio access network and the data network (DN), and the whole user-plane path is built around it: UE → gNB → UPF → DN.

That last point is the mental model to lock in. The UPF is deliberately "dumb and fast": it holds no subscription data, runs no signalling toward the UE, and takes no policy decisions. All intelligence is pushed in from the SMF as a set of rules. This is what makes the UPF easy to scale horizontally, cheap to deploy at the edge, and swappable between vendors — it is, in cloud terms, a stateless-per-decision forwarding engine whose behaviour is fully described by the rules currently installed. The functional split and the reference points are defined in TS 23.501; the N4/PFCP protocol that drives it lives in TS 29.244.

The four interfaces: N3, N4, N6, N9

Understanding the UPF is largely a matter of understanding its four wires, because each carries a different kind of traffic and speaks a different protocol. Three of them are user plane; one is control.

Notice the asymmetry: N3, N9 and the way traffic enters carry GTP-U encapsulation, but N6 does not. A downlink packet arrives at the anchor UPF from the DN as a plain IP packet addressed to the UE; the UPF looks up the session, wraps the packet in a GTP-U tunnel toward the serving gNB (or an I-UPF over N9 first), and stamps the right QFI. Uplink is the mirror image: GTP-U comes in on N3, the header is stripped, and the inner IP packet leaves on N6. The UPF is, at heart, a tunnel-endpoint and header-rewrite machine.

PDU Session Anchor and mobility anchoring

Among all the UPFs a packet might traverse, one has a special role for each PDU session: the PDU Session Anchor (PSA). The PSA-UPF is the UPF that owns the N6 exit to the data network and, critically, the UE's IP address. It is the fixed point of the session.

This matters because of mobility. As a UE moves and hands over between gNBs, the radio end of the N3 tunnel changes — the SMF reprograms the anchor's FAR so downlink packets are tunnelled to the new gNB. But the PSA itself stays put, so the UE keeps the same IP address and its TCP connections survive. That is what mobility anchoring means: the anchor is the stable pivot around which the radio side moves. Only in larger relocations does the SMF insert an I-UPF over N9 in front of the anchor, or (rarely, and with an IP change) relocate the anchor itself.

A single PDU session can have more than one anchor at once — a configuration used for local breakout, where one PSA reaches the central internet and a second PSA reaches a nearby edge network, with an UL-CL or branching point steering packets between them. We come back to that below.

The rules the SMF installs: PDR, FAR, QER, URR

Everything the UPF does to a packet is described by four kinds of rule that the SMF installs over N4. They form a small pipeline: first detect which flow a packet belongs to, then decide what to do with it, how to meter it, and what to count. Learn this quartet and you understand the UPF's entire job.

The flow through the pipeline is: a packet arrives, the UPF finds the highest-precedence PDR whose Packet Detection Information matches, and that PDR tells it which FAR, which QER(s) and which URR(s) to apply. The QER polices and marks, the URR counts, and the FAR forwards (or drops, or buffers). All four are bundled inside a PFCP Session Establishment/Modification Request that the SMF sends per PDU session; each PFCP session on the UPF corresponds to one PDU session's worth of rules. Before any of these sessions can exist, the SMF and UPF first stand up a node-level link with PFCP Association Setup and keep it live with periodic PFCP Heartbeat messages.

QoS flows and QFI marking

5G QoS is organized around the QoS flow, the finest granularity of differentiated treatment inside a PDU session. Each flow is identified by a QFI (QoS Flow Identifier), and the UPF is where that identity gets attached to user-plane traffic.

In the downlink, packets arrive at the UPF from the DN with no 5G markings at all. The UPF classifies them (via its PDRs and SDF filters) into the correct QoS flow, then — as the QER and FAR direct — writes the corresponding QFI into the GTP-U extension header of the tunnel toward the gNB, so the RAN knows which radio treatment to give each packet. It also enforces the flow's rate limits: dropping or delaying traffic that exceeds the GBR/MBR of a guaranteed flow, and holding aggregate throughput under the Session-AMBR for non-GBR traffic. In the uplink, the UE marks packets with a QFI according to its QoS rules; the UPF verifies that the marking matches what was authorized and again enforces the applicable limits before forwarding on N6.

Buffering, Uplink Classifier, and Lawful Intercept

Beyond the steady-state forwarding, the UPF handles three important special behaviours, all still driven by SMF rules over N4.

Downlink buffering for an idle UE. When a UE is in CM-IDLE, there is no N3 tunnel to a serving gNB — the radio path is torn down to save power. If a downlink packet then arrives from the DN, the UPF cannot deliver it immediately. Its FAR is set to BUFFER (optionally with a NOCP flag), governed by a BAR (Buffering Action Rule) that bounds how much and how long, so the UPF holds the packets and sends a Data Notification to the SMF. The SMF asks the AMF to page the UE; once the UE responds and re-establishes the session, the SMF updates the FAR to FORWARD with the new tunnel endpoint, and the buffered packets are flushed downstream. Buffering can live in the UPF itself or in the SMF, but the UPF is the common choice.

Uplink Classifier and Branching Point. These are the two mechanisms for splitting one PDU session's traffic across multiple exits — the foundation of local breakout and edge computing. An UL-CL (Uplink Classifier) is a UPF that inspects the destination of uplink packets and diverts some of them (say, traffic for a local edge server) to a local PSA while sending the rest to the central PSA for internet access — invisible to the UE, which sees one IP address. A branching point achieves the same split for IPv6 multi-homing, routing on the packet's source prefix instead. Either way, a second UPF is inserted, connected over N9, and the traffic for the nearby application never traverses the whole network — giving low latency for edge workloads.

Lawful Intercept. Because it is the one place every user packet passes, the UPF is also the natural point-of-interception for user-plane content under a legal warrant. When instructed, it duplicates the targeted traffic to the interception function while forwarding the original transparently, so the intercept is undetectable to the UE. The control-plane side of LI is coordinated by other functions, but the user-plane copy happens here.

Summary

The UPF is the one function that carries user data. It terminates GTP-U tunnels on N3 (to the gNB) and N9 (to other UPFs), exits to the data network on N6 as plain IP, and is controlled solely by the SMF over N4 using PFCP. For every packet it runs the same pipeline the SMF installed: a PDR detects the flow, a FAR forwards/drops/buffers it, a QER polices and marks it with a QFI, and a URR counts it for charging. One UPF per session is the PSA — the UE's stable IP home across handovers — and extra UPFs (an I-UPF, an UL-CL or branching point) enable mobility and local breakout without the UE ever noticing. It buffers for idle UEs, and it is the natural point for lawful intercept. The one thing to carry away: the UPF is deliberately dumb and fast — pure enforcement, zero autonomy — which is exactly the user-plane descendant of LTE's PGW-U.

Quick Q&A

These are the questions that check whether you really understand the user plane, not just the acronyms.