School of Specs The 5G system architectureOverview

Running it in the real world · chapter 7 of 7 · 6 minutes

7 Roaming, other accesses, the edge and the outside

What changes when the subscriber is abroad, the access is not a 3GPP radio, the old 4G core is still there, or somebody outside wants in.

Built from §4.2.4 §4.2.8 §4.3 §5.6.3 §5.13 §5.17 §5.20

7.1 Why the core is never alone

Every chapter so far assumed one operator, one core, one radio network and a device that belongs there. Almost nothing in production looks like that.

The subscriber is abroad. The access is a Wi-Fi network in a hotel. The 4G core is still running next door and has to keep working. An application company wants a quality change for one customer. This chapter is the shape of each of those, and where in the document the rest of them live.

7.2 Being served by somebody else's network

Roaming is the case the whole architecture was drawn twice for. Two arrangements exist, and a device can be using both at once for different sessions §5.6.3:

  • Local breakout — the SMF and every UPF involved are under the visited operator's control, so the traffic leaves the network where the device is.

  • Home routed — the session is held by an SMF in the home network and one in the visited network, with at least one UPF in each. The traffic goes home before it goes anywhere.

Figure 4.2.4-3: Roaming 5G System architecture - home routed scenario in service-based interface representation
Figure 4.2.4-3: Roaming 5G System architecture - home routed scenario in service-based interface representation 4.2.4

In home-routed roaming the device's session signalling terminates in the visited SMF, which forwards what matters to the home one.

The home SMF checks the request against the subscription and may reject it, and may send quality requirements back — which the visited SMF is free to check against the roaming agreement §5.6.3.

Which mode is used is not the device's choice. The home operator controls it through subscription data, per data network name and per slice §5.6.3 — the same two keys that pick an SMF in The connection, and what is promised on it.

At the border between the two networks stands a SEPP — Security Edge Protection Proxy — at each end. It is a non-transparent proxy: every control plane message between the operators passes through it, is filtered and policed, and the topology behind it is hidden §6.2.17.

7.3 Ways in that are not a 3GPP radio

The core is meant to depend on the access as little as possible, and this is where that pays off. Non-3GPP access networks reach the same core through a gateway that presents the same two interfaces the radio network presents, N2 for signalling and N3 for user data §4.2.8.1:

  • N3IWF for an untrusted non-3GPP access, such as a public Wi-Fi network.

  • TNGF for a trusted one, where the access network advertises which operators it can serve.

  • W-AGF for a wireline access network, and a TWIF for devices that cannot speak the core's signalling over Wi-Fi at all.

After registration the device speaks the same signalling over N1 whichever way it came in. A device registered over both a radio network and a non-3GPP access has two separate instances of that signalling connection at once §4.2.8.1.

7.4 Living next to 4G

Most 5G cores were switched on beside a working 4G core, and §5.17 is about not breaking it.

The starting assumption is that both have access to a common subscriber database — the HSS for 4G, the UDM for 5G, one master record per user §5.17.1.1.

A device that can do both operates in one of two modes §5.17.2.1:

  • Single-registration mode — one active mobility state, either in 5G or in 4G, and one coordinated registration. The device maps its temporary identity from one system to the other as it moves.

  • Dual-registration mode — two independent registrations over separate radio connections, two temporary identities kept apart, and the device may be in either system or both.

The optional interface between the two cores is N26, between the AMF and the 4G MME. It carries the mobility and session state across, and it is what makes an unbroken handover of a voice call possible §5.17.2.2.1.

Without it, mobility still works, but the session is re-established rather than moved §4.3.1.

7.5 Putting the server near the user

The document does not invent a new mechanism for this. It lists the ones already in the architecture and says edge computing is one or a combination of them §5.13:

  • choosing a UPF near the device;

  • steering part of a session to a local part of the data network with an uplink classifier or a multi-homing branch;

  • using session continuity mode 2 or 3, so an anchor can move;

  • letting an application function influence the routing, and exposing network information outward.

7.6 Letting the outside in

The NEF is the controlled door for anything outside the operator. What can be asked for through it falls into five categories §5.20:

  • Monitoring — location, reachability, roaming status, loss of connectivity, quality monitoring results.

  • Provisioning — an outside party supplying information about how a device is expected to behave.

  • Policy and charging — asking for mobility, quality or charging treatment for a device.

  • Analytics reporting — fetching or subscribing to analytics the network produces.

  • Member UE selection — asking which of a list of devices fit some criteria.

An application function the operator trusts may be allowed to skip the NEF and talk to network functions directly; one it does not trust may not §5.20.

7.7 The rest of the document, in one table

Everything above is the part of the high-level features clause that comes up in general conversation §5. The remainder is a long list of self-contained features, each with its own clause:

Feature Clause
Using radio and Wi-Fi at once §5.32
Time-sensitive and deterministic traffic §5.27, §5.28
Ultra-reliable low latency §5.33
Extended reality and high data rate §5.37
Private and non-public networks §5.30
Cellular IoT §5.31
Networks that behave like a LAN §5.29
Network sharing §5.18
Overload and congestion control §5.19
Emergency calls, warnings, voice, messages §5.16

7.8 Where to look next

The roaming drawings are §4.2.4 and the non-3GPP access architecture is §4.2.8. Interworking and migration are §5.17 and the architecture for it is §4.3. Edge computing is §5.13 and exposure is §5.20.

The in-depth course of this track gives roaming, interworking, edge and exposure a chapter each, and works through every feature in the table above.

Check yourself

Answers appear when you pick one, with where they come from.

Q7.1 In home-routed roaming, where does the traffic leave the mobile network?

Q7.2 What sits between two operators' control planes?

Q7.3 A Wi-Fi network the operator does not trust is used to reach the 5G core. What does the traffic pass through?

Q7.4 What does a device in single-registration mode hold?

Q7.5 Which of these is a way the core supports edge computing?

Q7.6 An outside party wants to be told when a device becomes reachable. Which exposure category is that?

This chapter was written against TS 23.501 version 20.2.0, verified 2026-08-04. A newer version of the document may say something else.