10 Radio, Wi-Fi, cable — every way in

10.1 Why the core barely knows what a radio is

3GPP wanted one core network that very different accesses could plug into: a 5G base station, a public Wi-Fi hotspot, a cable modem line, a satellite. If the core knew about frequencies and antennas, every new radio would mean a new core.

So the boundary is drawn at two reference points and nothing else. N2 carries control signalling between the access network and the AMF (the function that tracks where a device is and whether it can be reached).

N3 carries user packets between the access network and the UPF (the box that forwards a device's actual traffic). Anything terminating N2 and N3 is an access network as far as the core is concerned.

That leaves a short list of what the core still has to know about a 3GPP radio, and that list is §5.4. The same list for everything else is §5.5.

10.2 What the core tracks, and how precisely

Reachability management is two jobs: knowing where a device is, and paging it when something arrives. Where the job runs depends on the connection state — in the core when the device is CM-IDLE, in the NG-RAN when it is CM-CONNECTED §5.4.1.1. The states themselves are Registration, reachability and paging.

The precision differs sharply: idle, the core knows the device only to the granularity of its Tracking Area List; connected, it knows the serving access node §5.4.2.

Three reachability categories are negotiated at registration §5.4.1.1:

• Normal — the device listens for paging while idle, and traffic flows both ways in either state.

• MICO mode, mobile initiated connection only — it does not listen at all.

• Unavailability Period — it has warned the network it is about to disappear, so paging does not apply.

Underneath sits a pair of timers that disagree on purpose: the device runs a periodic registration timer given to it by the AMF, and the AMF runs a Mobile Reachable timer set longer, stopping it whenever the device becomes CM-CONNECTED §5.4.1.1.

PPF is the paging proceed flag. With it cleared, the AMF stops paging and rejects requests to deliver anything downlink. Only when the second, much longer timer also expires is the device quietly deregistered.

MICO mode turns that behaviour on deliberately. The device asks for it, the AMF decides. Once granted, the registration area is no longer limited by paging area size, and an AMF serving a whole PLMN may hand out an "all PLMN" registration area, after which moving no longer causes a re-registration.

The device leaves idle only on its own terms: a configuration change, the periodic timer, uplink data, or uplink signalling. A device setting up an emergency call may not ask for MICO, and an active MICO mode is switched off at both ends once the emergency session is established §5.4.1.3.

The power-saving variants of MICO belong to Small devices, small messages.

The Unavailability Period is the polite version: before going quiet, the device tells the AMF when it expects to disappear and for how long.

The AMF clears the PPF for that stretch, may stretch the periodic registration timer so it does not expire in the middle, and reports the remaining time to any application function subscribed to a loss-of-connectivity event §5.4.1.4.

10.3 The third state the core cannot see into

A device that is done talking but likely to talk again soon is expensive to release and expensive to keep. RRC_INACTIVE is the compromise: the radio network keeps the device's context and keeps N2 up, so from the AMF's side nothing has changed §5.4.2.

Device state in RAN	AMF's connection state	Who pages	Location known to
RRC_IDLE	CM-IDLE	AMF	Tracking Area List
RRC_INACTIVE	CM-CONNECTED	NG-RAN	RAN Notification Area
RRC_CONNECTED	CM-CONNECTED	nobody	serving access node

The RAN Notification Area may be some or all of the cells in the registration area. A device entering a cell outside it updates, and a periodic version of the same update runs on a timer the radio network sets.

The radio network also runs a guard timer, longer than the one it gave the device.

When that expires it starts the AN Release procedure and may tell the AMF how long it has been since it last heard from the device — which the AMF uses to shorten its own Mobile Reachable timer rather than start it from full §5.4.2 §5.4.1.1.

10.4 Paging, and the hints the core gives about it

The AMF pages a CM-IDLE device and chooses the strategy; the NG-RAN pages an RRC_INACTIVE one and chooses its own.

When the SMF (the function that sets up and steers a device's data sessions) triggers the page, it includes the 5QI and the ARP of the QoS Flow the waiting packet belongs to, so the AMF has something to decide with §5.4.3.1. Both come from What the network promises.

Paging Policy Differentiation goes finer: the application marks the DSCP field of the downlink IP packet, and that mark chooses the policy.

The UPF reports the DSCP alongside the flow in its Downlink Data Report, the SMF turns it into a Paging Policy Indicator, and the PPI, the ARP and the 5QI travel to the AMF together §5.4.3.2.

For a device in RRC_INACTIVE the AMF is not in the loop, so the SMF instead has the UPF write the PPI into the core-network tunnel header, where the gNB (a 5G base station) reads it off the arriving packet §5.4.3.2.

The feature applies only to PDU sessions of IP type.

Paging Priority is a separate flag driven by the ARP rather than the DSCP: when the ARP belongs to a priority service such as MPS or MCS, the AMF marks the message and the NG-RAN handles it ahead of others.

If such a request arrives while an ordinary page is outstanding, the AMF pages again with the priority set §5.4.3.3.

Two pieces of paging assistance flow the other way, from the radio network into the AMF's stored context §5.4.4.3. The UE Radio Capability for Paging is stored by the AMF without understanding it and handed back at every initial context setup, so the radio network can spot an omission.

The Information on Recommended Cells and RAN Nodes for Paging is given up at N2 release, so the next page starts where the device was last seen.

The AMF also feeds the radio network's power-saving tricks. Wake-up signal assistance is built from paging probability and goes to an ng-eNB — a 4G base station attached to the 5G core — which uses it to pick the wake-up group when it pages §5.4.9.2.

The two subgrouping features are NR instead: up to eight paging subgroup identifiers §5.4.12.1, and up to thirty-two for the low-power wake-up signal §5.4.12a.1.

Subgrouping only works if every AMF connected to one gNB allocates subgroups by the same policy, including AMFs of different PLMNs sharing that gNB.

10.5 What the device can do on the air

The UE Radio Capability lists the radio technologies, bands and power classes a device supports. It is large enough that resending it over the air at every transition out of idle would be a waste, so the AMF stores it while the device is registered and hands it to the radio network in the N2 request.

If neither side has it, the radio network asks the device and uploads it §5.4.4.1.

The AMF deletes it on deregistration and on initial registration; it survives a change of AMF but is never carried into a 4G core.

UTRA capabilities are excluded, and NB-IoT capabilities are held separately and only sent when the device is camping on NB-IoT.

A device whose radio capability changes has to go back to CM-IDLE and re-register with the "UE Radio Capability Update" indication, which makes the AMF throw its copy away §5.4.4.1.

RACS replaces the blob with a pointer. A UE Radio Capability ID stands for a set of capabilities, and only the identifier is signalled — over the air, from AMF to NG-RAN, and between core nodes §5.4.4.1a.

The UCMF owns every mapping in a PLMN §6.2.21, and identifiers are either manufacturer-assigned or PLMN-assigned §5.9.10. A node meeting an unfamiliar one looks it up: the NG-RAN asks the AMF, the AMF asks the UCMF.

A device stores at least the sixteen most recent PLMN-assigned identifiers, so crossing a border does not cost a full upload §5.4.4.1a.

10.6 The rest of what the core sends down

What	Why the radio network wants it	Clause
Accepted DRX parameters	how often the device wakes to check for paging	§5.4.5
CN assisted RAN parameters tuning	expected activity, handover rate, mobility and trajectory — when to keep a device or release it	§5.4.6.2
CN assisted RAN paging information	how to page in RRC_INACTIVE, beyond the PPI	§5.4.6.3
Location reporting request	exact cell for emergency calls, lawful intercept and charging	§5.4.7
Mobility Restriction List	which areas and which spectrum this device may use	§5.4.8

The two assistance rows are hints only: the specification says outright that how the radio network uses the tuning information is not defined here, and that the algorithms producing it are vendor specific §5.4.6.2.

The last two rows are obeyed. A location reporting request is answered §5.4.7, and a radio node handed a Mobility Restriction List that forbids unlicensed spectrum shall stop the device using it §5.4.8.

Handover matters mainly in what has to be set up again afterwards. After an N2-based handover the AMF must ask the target node for location reporting again; after an Xn-based handover the source node passes the request across itself §5.4.7.

The Radio Capability ID travels both ways too, in the path switch and handover request messages §5.4.4.1a.

Unlicensed spectrum is the one radio property the core polices directly, and only where an Access Restriction for Unlicensed Spectrum is in force for that subscriber — signalled from the UDM, or generated locally by the visited network's own policy in the AMF.

With that restriction in place, the AMF rejects registration outright if NR in unlicensed spectrum is the primary radio; as a secondary carrier, the restriction goes down in the Mobility Restriction List instead.

Such cells must sit in Tracking Areas of their own, and the RAT type reported onwards to the SMF, the PCF (the function that decides the rules a session runs under) and the charging records says "unlicensed" §5.4.8.

Satellite access is identified the same way, by its own RAT types over N2 §5.4.10; that story is Relays, satellites, femtos and shared networks.

10.7 Wi-Fi and cable: four gateways doing one job

Everything that is not a 3GPP radio reaches the core through a gateway that terminates N2 and N3 for it and looks, from the core's side, like a radio access network.

Gateway	Fronts	Connection to the device	Who speaks NAS
N3IWF	untrusted non-3GPP access, e.g. public Wi-Fi	NWu	the device
TNGF	a trusted non-3GPP access network	NWt	the device
W-AGF	wireline access	Y4 for a 5G-RG, Y5 for an FN-RG	the 5G-RG, or the W-AGF for an FN-RG
TWIF	trusted WLAN carrying devices that cannot speak 5G NAS	Yt'	the TWIF, on the device's behalf

The two odd ones are worth naming. An FN-RG is a fixed-network residential gateway that predates 5G, so the W-AGF registers with the core on its behalf §4.2.8.1A. An N5CW device cannot do 5G signalling over WLAN at all, so the TWIF registers for it and relays its packets §4.2.8.5.3.

A device on both a 3GPP and a non-3GPP access of the same PLMN gets two N1 signalling connections but a single AMF. Pick an N3IWF in a different PLMN and it becomes two separate registrations with two AMFs §4.2.8.1.

10.8 What changes when the way in is not radio

• There is no paging. A device cannot be paged over non-3GPP access at all §5.5.3.1.

• The core reaches it the other way round. For a session last routed over Wi-Fi while the device is idle there, the AMF may run a network triggered Service Request over the 3GPP access instead, marked as being about the non-3GPP side §5.5.3.1.

• Moving does not register. Changing Wi-Fi access point causes no registration procedure. Switching to a different N3IWF or TNGF does, and only within the same PLMN. Nor may the device ask for MICO mode here §5.5.1.

• One connection at a time, and its death drives everything: dead peer detection in IKEv2 for NWu, NWt and Yt', lost synchronisation or a dropped PPPoE session for Y4 and Y5. The gateway then releases N2, and the device goes CM-IDLE while staying registered §5.5.2.

• Timers instead of periodic registration. The device runs a non-3GPP deregistration timer and the AMF a longer implicit one §5.5.1.

• Sessions survive. Going idle keeps the PDU sessions and only deactivates the N3 user plane, so they can be moved to the 3GPP access §5.5.2. Doing both at once is Using two accesses at once.

• Location is a node name. The AMF knows only which N3IWF, TNGF, TWIF or W-AGF is serving the device §5.5.3.2.

10.9 Wi-Fi that never touches the core

Non-seamless WLAN offload is the case where the 5G system gets out of the way. The device is on WLAN, uses the local address the WLAN gave it, and sends the chosen flows straight out — no N3IWF, no TNGF, no ePDG.

Which flows go that way comes from a URSP rule (an operator instruction telling the device which connection to send an application's traffic over) carrying the offload indication, or from local configuration §5.42.

If the WLAN wants 5G-based authentication first, the device authenticates with its 5G credentials and is still not registered afterwards §5.42 §4.2.15. When roaming it uses a decorated identity so the WLAN knows which visited network to ask, and the realm differs from the trusted-access one.

There is no address preservation between WLAN and NG-RAN, which is exactly what the name says. A device already on untrusted access may push some of its traffic outside the IPsec tunnel by the same rules §5.42.

10.10 The old radios come in sideways

GERAN and UTRAN — 2G and 3G packet access — never reach a 5G core over N2 and N3 at all. Instead a combined SMF and PGW-C is enhanced to talk to an SGSN (the node that handled a 2G or 3G data session) over the Gn/Gp interface, and to behave towards it like the control plane of a 4G gateway.

From there the session is a 5G one: the same node uses N7 towards the PCF and N40 towards the CHF (the function that meters what a session used, so it can be billed), so policy and charging are 5G functions §Annex L.

IP address preservation is not supported for direct mobility between 5GS and GERAN or UTRAN §Annex L. The 4G side of this is Living next to 4G.

10.11 Where this meets the rest of the system

The states used throughout, and the mobility restrictions the Mobility Restriction List carries §5.3.4.1, are defined in Registration, reachability and paging.

The 5QI and ARP that choose a paging strategy are What the network promises, and quality towards an N3IWF or TNGF is agreed the same way §4.2.8.1.

What survives an access changing underneath it is the PDU session The connection to a data network; where its packets travel is Where the packets actually go. NAS signalling is protected identically over any access, by requirement rather than accident §4.2.8.1 — see Who you are and who may listen.