Setting up a test 5G network

TL;DR: Beware that Android phones may silently ignore your configured MCC/MNC/slice! Monitor their network requests (e.g. via tcpdump or gNB/core logs) to verify what settings the UE is actually using.

Following are various notes from setting up a test 5G network.

Configuration §

Here are some critical things to be aware of when configuring the core for a UE to attach.

5G SA vs NSA §

The UE must support SA mode:

• 5G SA (Standalone) means that both the RAN and the core are 5G.
• In contrast, NSA (Non-stanalone) permits a mix, e.g. a 5G RAN and 4G LTE core.

Bands §

The UE must support the frequency band in use by the gNB:

• Band n78 (TDD) is the most common 5G band.

PLMN §

The MCC and MNC used by the UE must match the gNB and core:

• Together the MCC and MNC form the PLMN. e.g. MCC of 001 and MNC of 01 equals a PLMN of 00101.
• PLMN values:
  • 00101 is desigated as a test PLMN. This is commonly used for test networks.
    • This is a good choice for testing purposes.
  • 9xxxx is desigated as a region of private PLMNs.
    • It was common to use the the value 90170.
    • More recently, the value 99970 appears common too (e.g. see the Open5GS quick-start guide)
  • Other values of PLMN should only be used by the respective countries/networks.

APN (DNN) §

Android phones let you configure the APN.

• The APN in 4G is essentially equivalent to the DNN in 5G.
  • However, the phone settings page will typically only mention APN regardless of whether the phone supports 5G.
• While the phone APN settings may expose fields for setting the MCC and MNC, Android may ignore your settings and use hard-coded values for MCC and MNC. Be sure to verify which MCC and MNC your UE is requesting by performing a tcpdump on the core.
• The UE capabilities (e.g. whether it can text, voice call, access the internet) are determined by the APN.
• Enabling internet access is likely simpler than enabling voice calls, because voice calls require the IMS component on the core, whereas internet does not.
• Following is an example APN configuration with internet access. Note that the core must also be configured with the internet APN:
  • Name: internet
  • APN: internet
  • APN type:
    • default,ims,internet
    • default,mms,supl,hipri,fota,cbs,xcap

Network Slicing §

5G introduces network slices.

• The gNB and core must have the slice enabled which the UE is requesting.
• While the Open5GS Web UI provides an interface for configuring which slice a UE should request, Android may ignore your settings and use hard-coded values for the slice. Be sure to verify which slice your UE is requesting by performing a tcpdump on the core or monitoring the gNB logs.
  • It is common for 5G Android phones to have a hard-coded S-NSSAI.
    • Since the S-NSSAI cannot be changed, you have to modify your gNB and core to accept that S-NSSAI.
    • A default SD of 0xffffff is normal.
• SD = Slice Differentiator
• SD is part of S-NSSAI
  • S-NSSAI can consist of SST and SD, or just SD.

Open5GS §

Open5GS is a great piece of open-source software which provides a 5G core that is suitable for test purposes.

General tips §

• Use open5gs-dbctl as the CLI for Open5GS.
  • e.g. use open5gs-dbctl showall to list all UEs in the DB.
• Helpful troubleshooting steps.
• Default configs with templates.
• The core IP is typically 10.45.0.1. UEs have an IP such as 10.45.0.6.
• It should be possible for the core to ping a UE, and vice-versa.
  • e.g. from a UE, try to ping 10.45.0.1, and verify with tcpdump on the core that ICMP requests are coming from the UE.
• Likewise, iperf3 server can run on the core, and an iperf3 client on the UE should be able to reach the core.

Troubleshooting: DNN Not Supported OR Not Subscribed in the Slice §

• The error DNN Not Supported OR Not Subscribed in the Slice comes from this line in the AMF in Open5GS
  • It occurs if !selected_slice is true (“Not Subscribed in the Slice”) or if !sess->dnn is true (“DNN Not Supported”).
• Android OS cotains a list of APNs which can override the user’s configuration
  • This can be confusing.
  • You need to perform a packet capature to verify which APNs your UE is requesting (e.g. tcpdump on the core).
  • This XML file is the list of APNs in Android OS.
• Some modems request IMS and SOS regardless of the APN config.
• Related issues: here, here, here.
• Since September 2022, APN names are case insensitive in Open5GS. Prior to that they were case sensitive.

Troubleshooting: UE disconnects after three minutes §

Some phones will silently drop the network connection if an IMS is not configured within 3 minutes (180 seconds) after attaching. We observed this with the Google Pixel 8 Pro.

The fix is to dial *#*#0702#*#* to enter the hidden IMS settings menu, and then do one of these two:

• Infinite timeout: Change NR_TIMER_WAIT_IMS_REGISTRATION from 180 to -1.
• Disable timeout: Change SUPPORT_IMS_NR_REGISTRATION_TIMER from 1 to 0.

Debugging §

Following are some general debugging tips:

Debugging a COTS UE §

• See this helpful guide.

Wireshark §

• Use the filter ngap to view all 5G signalling traffic captured on the core.
• Use the filter iperf3 to view all iperf3 traffic.

Debugging UE attach §

• Start by checking for the MIB and SIB1.

Open5GS - Not implemented §

• A ‘Not implemented’ error (e.g. this) can be looked up here.

Resources §

Following are some valuable 5G resources:

ShareTechnote §

• 5G handbook.
• 5G network slicing.
• Using the Open5GS WebUI.
  • Note that this page says “I didn’t set SD field, since open5gs reject ngap setup request when I set it in gNB configuration. so I decided to remove SD for both gNB, amf, UE configuration.” In contrast, I had to set the SD to ffffff since that is what my UE was requesting.

SRS §

• srsRAN gNB with srsUE.
• COTS UEs.
• Some examples for testing the network.

I/Q data §

• Excellent guide on I/Q data