AMF vs SMF vs UPF: Who Does What in the 5G Core

If you learned LTE first, there's one sentence that unlocks the 5G Core: the MME was split in two.

Mobility management went to the AMF. Session management went to the SMF. The S-GW and P-GW collapsed into the UPF. Three functions where LTE had three differently-shaped ones — and the reshaping is what makes slicing and edge computing work.

The cleanest way to hold them apart:

AMF manages the device. SMF manages the session. UPF carries the packets.

---

AMF — Access and Mobility Management Function

The AMF is the UE's single point of contact with the core. Every piece of NAS signalling from the device arrives here.

What it owns:

Registration management — accepting the UE onto the network, maintaining registration state, handling periodic updates.

Connection management — the NAS-level connection, plus CM-IDLE and CM-CONNECTED state.

Reachability and paging — knowing where the UE is at tracking-area granularity and paging it when downlink data arrives.

Mobility management — tracking area updates, handover coordination between gNBs.

NAS security — ciphering and integrity protection for NAS messages. The AMF hosts the SEAF (Security Anchor Function), holding the key hierarchy root for the serving network.

Access authorisation — enforcing which slices and services the subscriber may use.

N1 and N2 termination — N1 is NAS toward the UE, N2 is NGAP toward the gNB.

What it deliberately doesn't do

Here's the detail that catches people out. The AMF does not perform session management — but session-management NAS messages still travel through it.

When a UE sends a PDU Session Establishment Request, that's a NAS message. It arrives at the AMF because all NAS arrives at the AMF. The AMF looks at the message type, sees it's session management, and forwards it to the appropriate SMF without interpreting the contents.

It's acting as a NAS router. The container it forwards is opaque to it. That's why an AMF can serve a UE whose sessions terminate at several different SMFs across several different slices — it never needed to understand any of them.

---

SMF — Session Management Function

The SMF owns everything about a PDU Session from creation to teardown.

What it owns:

Session lifecycle — establishment, modification, release.

IP address allocation — assigning the address or IPv6 prefix for the session.

UPF selection and control — choosing which UPF (or chain of UPFs) serves the session, then programming them over N4.

QoS enforcement setup — translating PCF policy into QoS profiles for the RAN and enforcement rules for the UPF.

Policy interaction — retrieving PCC rules from the PCF.

Charging — interacting with the CHF, and configuring usage reporting on the UPF.

Session-management NAS — the SMF originates and terminates the SM NAS messages that the AMF merely relays.

UPF selection is where deployment intent lives

The single most consequential SMF decision is which UPF to use, and it's driven by:

DNN and S-NSSAI. UE location. Latency requirements of the service. UPF load and availability. Whether the session needs local breakout to an edge site.

A session for general internet access gets a central UPF. A session for an edge application gets one near the gNB. Same procedure, same SMF, entirely different data path — and the choice is a policy decision, not an architectural one.

The SMF can also insert an Uplink Classifier (ULCL) so one session splits traffic across two UPFs: edge-destined flows break out locally, everything else goes central. The UE sees one session with one IP address and knows nothing about the split.

---

UPF — User Plane Function

The UPF is the only one of the three on the data path. Every user packet passes through it; no signalling does.

What it owns:

Packet routing and forwarding — between the RAN over N3 and the Data Network over N6, and between UPFs over N9.

Packet inspection and classification — matching packets to QoS Flows.

QoS enforcement — rate limiting, marking, and applying the QoS rules the SMF installed.

Usage reporting — counting traffic for charging and quota enforcement.

PDU Session anchoring — the anchor UPF holds the session's IP address and is the point of presence toward the data network.

Traffic steering — ULCL and branching point behaviour for local breakout.

Lawful intercept — the user-plane interception point.

Buffering — holding downlink packets while an idle UE is paged.

How the SMF programs it

Everything the UPF does comes from four rule types installed over N4 using PFCP:

PDR (Packet Detection Rule) — how to recognise packets belonging to this session and flow. FAR (Forwarding Action Rule) — what to do with matched packets: forward, buffer, drop, duplicate. QER (QoS Enforcement Rule) — rate limits and QoS marking. URR (Usage Reporting Rule) — what to measure and when to report it.

The UPF applies these mechanically. It has no notion of subscribers, policies, or slices — only rules. That's what lets it be optimised purely for forwarding performance, and why UPFs are often built on DPDK, SmartNICs, or dedicated hardware while the AMF and SMF run as ordinary containers.

---

Side by side

That last row is the whole argument for the split. These three scale on completely different axes. A massive IoT network has enormous AMF load and trivial UPF load. A fixed wireless network is the reverse. Combined in one function, you'd dimension for the worst case on every axis simultaneously.

---

Walking through the flows

Registration

The UE sends a Registration Request over NAS. The gNB selects an AMF and forwards it over N2.

The AMF authenticates the UE via the AUSF and UDM, establishes NAS security, retrieves subscription data, determines the Allowed NSSAI (querying the NSSF where needed), and returns a Registration Accept.

The SMF and UPF are not involved at all. The device is on the network with no data connectivity — a distinction that surprises people, but registration and connectivity are genuinely separate steps in 5G.

PDU Session establishment

The UE sends a PDU Session Establishment Request as SM NAS. The AMF recognises the message type and selects an SMF — via the NRF, filtered by S-NSSAI and DNN — then forwards the container.

The SMF takes over: retrieves session policy from the PCF, allocates an IP address, selects a UPF, and programs it over N4 with the PDR/FAR/QER/URR set.

The SMF returns QoS profiles to the AMF, which passes them to the gNB over N2 so radio bearers can be set up. The Establishment Accept goes back to the UE with its address and QoS rules.

Data now flows UE → gNB → UPF → Data Network, and neither the AMF nor the SMF sees a single user packet.

Downlink data to an idle UE

Worth tracing because it shows all three cooperating.

A packet arrives at the UPF for a UE in CM-IDLE. The UPF has no tunnel to send it down, so it buffers the packet (per its FAR) and notifies the SMF over N4. The SMF asks the AMF to page. The AMF pages across the registered tracking areas. The UE responds with a Service Request, the RAN connection and tunnel are re-established, and the SMF tells the UPF to release the buffered packet.

Three functions, three interfaces, one packet.

---

Why the split matters

Independent scaling. Each function scales on its own axis, so capacity is dimensioned per dimension rather than per worst case.

Edge computing. The UPF moves to the edge while control stays central. This is the entire mechanism — without CUPS, low-latency edge breakout isn't possible.

Slicing. One AMF serves the device; per-slice SMFs and UPFs provide isolation. That only works because mobility and session management were separated.

Different implementation targets. AMF and SMF are signalling workloads suited to standard cloud infrastructure. The UPF is a packet-forwarding workload wanting hardware acceleration. Separating them lets each be built appropriately.

---

The mental model

AMF = the device. Registration, mobility, paging, NAS security. Routes SM NAS without reading it.

SMF = the session. Lifecycle, IP allocation, UPF selection, policy translation.

UPF = the packets. Forwarding, QoS enforcement, usage reporting, anchoring. Rules only, no policy.

N4 + PFCP is the control link: PDR, FAR, QER, URR.

They scale on different axes — devices, sessions, traffic. That's why they're separate.

The MME split into AMF and SMF is what made slicing and edge placement possible.

---

Further reading

• 5G Core architecture — the full service-based design
• PDU Sessions in 5G — session establishment in detail
• 3GPP TS 23.501 — System architecture, network function descriptions
• 3GPP TS 23.502 — Procedures for the 5G System
• 3GPP TS 29.244 — PFCP specification