18 Being served by somebody else's network

18.1 Why the document keeps saying "V-" and "H-"

A subscription belongs to one operator. Radio coverage belongs to whoever built the masts where you happen to be standing. Once a year those two are different countries, and the system still has to work.

So 5G is written twice. There is a non-roaming shape, where one operator owns everything, and there is a roaming shape, where the network you can hear is the visited network (VPLMN) and the network that knows who you are is the home network (HPLMN).

Clause §4.2.4 draws that second shape. The rest of the document then adds a roaming paragraph to almost every feature, which is why roaming reads as a thread rather than a chapter.

18.2 Which side each function lands on

Everything that has to be near the radio, or that only makes sense for "here", is in the visited network: the access network, the AMF (the function that tracks where a device is) and a visited NSSF (the function that works out which slices a device may use).

With them sit a visited NRF (the directory functions look one another up in), a visited PCF (the function that decides the rules a session runs under) and — in both arrangements — at least one visited UPF (the box every one of the user's packets passes through).

Everything that knows the subscriber is at home: the UDM and the UDR that hold the subscription, the AUSF that authenticates, and the home PCF.

Authentication in particular is never delegated. The AMF picks an AUSF instance in the subscriber's home network, found from the home network identifier inside the concealed identity §6.3.4.

The vertical line in that figure is an operator border, not a network cable. Every control-plane message that crosses it is a service call from one operator's function to another's, and it goes through the gate described further down.

Application functions are the box that moves. The figure above is the local break-out shape, and it draws the AF inside the visited network: there the visited PCF may talk to the AF to build the rules for a service delivered in the visited network §4.2.4.

In the home-routed shape, drawn further down as Figure 4.2.4-3, the AF sits on the home side of the border instead.

18.3 Two ways for the packets to go

The real choice in roaming is where the traffic leaves the mobile network for the data network. There are two arrangements, and one device can be using both at the same time for different sessions §5.6.3.

• Local Break Out (LBO) — the SMF (the function that sets up and steers a session) and the anchor it controls are both in the visited network, so packets reach the internet in the country you are standing in.

• Home Routed (HR) — there is an SMF and at least one UPF on each side. The visited UPF hands the traffic over a tunnel to a home UPF, and the packets leave the mobile network at home.

The home network decides which one applies, through subscription data held per data network name and per slice value §5.6.3. The document gives the phone no way to ask: it asks for a data network, and the subscription settles the rest.

Note that even a home-routed session still has a UPF in the visited network. The specification says why in one line, in which "LI" is lawful interception (a legally ordered tap on one named subscriber's traffic).

18.4 How a home-routed session is put together

Home routing is the interesting case, because two session managers have to agree about one session §5.6.3.

• The phone's session-management signalling terminates in the V-SMF. The phone never talks to the home network directly.

• The V-SMF forwards session-management information to the H-SMF and passes it the subscriber identity during session establishment.

• The H-SMF checks the request against the subscription — which it fetches from the UDM itself — and may reject it on a mismatch.

• The H-SMF may send QoS requirements to the V-SMF, at setup and later. The same interface carries the user-plane forwarding information the two sides need to build the tunnel between their UPFs.

• The V-SMF may check those QoS requests against the roaming agreement, and each side picks the UPFs on its own side.

The AMF selects both SMFs §6.3.2, and hands the identifier of the chosen H-SMF to the V-SMF §5.6.3.

There is a fallback worth knowing: if the AMF tried local break-out and the chosen visited SMF rejects the request with the right cause, the AMF selects a new V-SMF and an H-SMF and retries as home routed §5.6.3.

The named links between the two sides are small in number: N16 between the two SMFs, N24 between the two PCFs, N9 between the two UPFs, and N32 between the two border proxies §4.2.7.

18.5 The gate between two operators

Two operators do not trust each other the way two racks in one data centre do. The document states the requirement plainly in §4.2.4: each network puts proxy functionality on the inter-operator interfaces to secure the connection and hide its topology.

That proxy is the SEPP, and its clause is four lines long because the detail lives in the security specification. It is given two jobs: message filtering and policing on the inter-operator control-plane interfaces, and topology hiding §6.2.17.

What "topology hiding" actually means is not written here. 23.501 gives the two words and leaves the meaning, the flows and the N32 reference point to TS 33.501 [29].

Messages between the two SEPPs may pass through intermediate exchange providers, which is why the link is protected rather than merely routed.

Discovery crosses the border the same guarded way: the local NRF talks to the remote network's NRF, addressing it with the target network's identifier, and returns profiles for functions on the other side §6.3.1.

The user plane gets its own guard. A UPF may run Inter PLMN User Plane Security (IPUPS), which forwards a tunnelled packet only if it belongs to an active session and is not malformed §5.8.2.14.

Each side controls its own such UPF, either folded into a UPF that does other work or inserted into the path as a separate one §4.2.4.

18.6 Policy, charging and interception when you are a visitor

Policy splits cleanly. For access and mobility rules the AMF picks a visited PCF and uses the same one for device policy; it may also select a home PCF and hand its address to the visited PCF, so the two can talk over N24 §6.3.7.1.

For a session it depends on the shape: local break-out means the visited PCF, chosen on the visited slice value, and home routing means the home PCF, chosen on the home slice value.

The visited PCF is not a proxy for the home one. In local break-out it has no access to home subscriber policy at all, and works from locally configured rules that come out of the roaming agreement §4.2.4.

Charging follows the same seam. In the home-routed case the charging function is the home one, selected by the home PCF and the home SMF §6.3.11. The visited network charges from its own UPF, which is one of the reasons that UPF is there at all §5.6.3.

23.501 does not define interception at all. Clause §5.2.7 is a single sentence pointing at TS 33.126 [35].

The document does say who holds the hooks, though: the SMF in the visited network for session events §6.2.2, the UPF for the traffic itself §6.2.3, and — for a subscriber roaming out of their home network — the UDM, which it calls the only point of contact §6.2.7.

18.7 Slices, seen from abroad

Only the standard slice values are global. Those mean the same thing in both networks, so they travel unchanged. Anything else needs an agreement, and then the visited NSSF maps the subscribed home values to the values used locally — and need not tell the home network which values it picked §5.15.6.

The consequence is that a roaming device carries two names for the same slice. The allowed list it is given holds visited values, together with the mapping back to home values.

When it asks for a session it supplies both: the home value that its policy rules matched, and the visited value from its allowed list §5.15.6.

Slice admission control — the counting of how many devices and sessions a slice may hold — has three modes for visitors, chosen from subscription data: counted by the visited network alone, counted by the visited network with quota fetched from home, or decided by the home network on every request §5.15.11.3.

18.8 Quality, and what the visited network is allowed to refuse

The home network asks for QoS; the visited network is not obliged to grant it. The V-SMF may apply visited policies from the agreement and refuse the session, or refuse some of the flows §5.7.1.11.

To reduce pointless failures, the V-SMF can send QoS constraints up front: the 5QI values it will accept (a 5QI is a number pointing into an agreed table of delay, loss and priority), the priority level, the allocation priority, and the highest aggregate session bit rate it will allow.

In this release those constraints apply only to the non-guaranteed default flow §5.7.1.11.

Where an operator-specific 5QI arrives, visited-network policies may remap the QoS values of the non-default flows. Whether and how is left to the implementation and to the agreement between the two operators, and the specification says openly that remapping can degrade the service §5.7.1.11.

Voice is the exception that proves the rule: for IMS voice the visited SMF may override the allocation priority from home, so that visitors and locals are treated alike §5.7.1.11.

18.9 Moving while a session is running

A session does not follow you across a border by itself. What moves is the visited half of it: when the AMF sees that the current V-SMF cannot serve the new location, it changes it — the same machinery as inserting an intermediate SMF at home §5.34.3.

That happens both inside one visited network and between two of them, and between two visited networks the two V-SMFs talk over N38 §4.2.4.

The new visited SMF checks the running QoS against its own constraints. It may accept a higher value for a while, downgrade the values locally before passing them to the radio, or release the session if the home network will not come back with something compliant §5.7.1.11.

Emergency sessions are blunter: there is no inter-operator mobility for them, so a border crossing risks dropping the call — unless the anchor SMF and UPF stay put, which operator policy may allow §5.16.4.1.

Where the home operator wants the traffic close by without giving up control, it can place its own UPF physically near the visited network and break out there — still a home-routed session, still controlled by the H-SMF §Annex U, §U.1.

18.10 Choosing which network to visit

The visited network is chosen by the device, not by the core. TS 23.501 says so by pointing elsewhere: network selection has two halves, picking the operator and picking the access, and the requirements and procedures for the first live in other specifications §5.2.2.

The home network still gets a say. It can send the device a protected steering-of-roaming container — a prioritised list of networks — and the AUSF has a service whose whole job is protecting it §7.2.7.

That delivery is privileged: the container may be handed over even in an area where the device's service is otherwise restricted §5.3.4.1.1. The same steering mechanism is reused to update preferred network lists for private networks §5.30.2.3.

Subscription data carries roaming restrictions as well, evaluated once the subscriber has been identified and authenticated §5.2.4, and held in the UDM §6.2.7.

18.11 Where this meets the rest of the system

The same two shapes exist when the visited network is 4G. Clause §4.3.2 draws local break-out and home routing for interworking, with the anchor built as a combined 5G and 4G gateway.

That clause also notes that the 4G-era interface between the two operators' policy functions is not required, because no known deployment uses it — in 5G the roaming policy link is N24. The rest is in Living next to 4G.

Read this chapter against The connection to a data network for what a session is, Where the packets actually go for what the extra UPF costs you, and What the network promises for the parameters the two SMFs argue about.

Then One network, many networks for the value mapping, Rules, and paying for them for the rules themselves, and How one function finds another for how one operator's function finds another's.