Skip to content

Roaming — Roaming in 5GC (SEPP / N32)

Difficulty: Intermediate–Advanced ／ Estimated study time: 30 min ／ Prerequisites: Registration, Authentication ／ Main actors: SEPP, AMF, AUSF, UDM ／ Main interface: N32

Learning objectives

After reading this chapter, you will be able to:

  • Explain that Roaming is "the mechanism by which a subscriber communicates using the network of a partner operator (VPLMN) while outside the coverage of their home operator (HPLMN)."
  • Explain the difference in user-plane path between the two 5G roaming methods, LBO (Local Break Out) and Home Routed (HR).
  • Illustrate that a SEPP (Security Edge Protection Proxy) stands at the boundary between PLMNs, relaying and protecting inter-operator SBI signaling over N32.
  • Explain the flow whereby, during roaming Registration, the VPLMN AMF queries the HPLMN's AUSF/UDM for authentication/subscriber information via SEPP/N32.
  • Explain the evolution from 4G's S8/S6a and DEA/IPX to 5G's SEPP/N32.

Prerequisites

The focus of this chapter

The details of the SEPP NF itself are on the SEPP page, and the message/PRINS details of the N32 reference point are on the N32 page. Building on those, this chapter focuses on "how the roaming-specific differences (inter-PLMN, via SEPP/N32) flow through the 5GC as a whole."

Why — why the roaming mechanism is needed

A subscriber wants to communicate even in areas where their home operator's (HPLMN: Home PLMN) radio does not reach (such as overseas). But the HPLMN cannot have base stations all over the world. So, borrowing the network of a local partner operator (VPLMN: Visited PLMN) to communicate is roaming.

There are two challenges here.

  • Confirming subscriber information — the VPLMN does not hold the subscriber's subscription/authentication information. It needs to query the HPLMN's UDM/AUSF.
  • The trust boundary between operators — if networks of different companies exchange signaling directly, there is a risk of impersonation, eavesdropping, and topology leakage. A checkpoint must be placed at the boundary to protect against this.

In 5GC, this checkpoint is handled by the SEPP (Security Edge Protection Proxy), which relays and protects inter-operator SBI signaling over N32.

Analogy: Roaming is like "using your home bank card overseas." The local ATM (VPLMN) does not know your balance, but through the international payment network (SEPP/N32) it queries your home bank (HPLMN), and if authentication passes you can use it. The checkpoint (SEPP) guards the counter for currency exchange and identity verification.

What — LBO and Home Routed, and SEPP/N32

The two roaming methods

In 5G roaming, the methods split in two according to where the user plane (the actual data) breaks out to the external network.

Method User-plane path Characteristics
LBO
(Local Break Out)		 Breaks out to the external network directly at a UPF within the VPLMN Low latency. Reaches the internet directly at the visited network. The VPLMN's policy and charging apply
Home Routed
(HR)		 Routed back to the HPLMN, breaking out from the home UPF Consistent application of the HPLMN's services, policy, and charging. V-UPF and H-UPF coordinate over N9

In Home Routed, the control plane too has V-SMF and H-SMF coordinating, and the user plane has V-UPF and H-UPF connected over N9 (TS 23.501).

Which to use

Whether to use LBO or Home Routed is determined by the target DNN/slice, the inter-operator contract, and regulation (lawful interception, data sovereignty). It is implementation- and contract-dependent and not uniform.

SEPP and N32

At the boundary between PLMNs stands the SEPP. The V-SEPP on the VPLMN side and the H-SEPP on the HPLMN side face each other, connected between them by N32.

  • N32-c (control) — the handshake, capability exchange, and negotiation of the protection method between SEPPs (for control).
  • N32-f (forwarding) — for actual data transfer, relaying the actual SBI messages (AMF⇔AUSF/UDM, etc.).

The SEPP handles message filtering, hiding of the internal topology, and integrity protection/encryption. The protection methods are PRINS (Protection of Roaming and Interconnection Signalling) and, for a direct connection, TLS (TS 33.501).

How — how roaming is structured (Architecture)

The HPLMN and the VPLMN face each other with their respective SEPPs as the boundary.

graph LR
    subgraph VPLMN[VPLMN Visited network]
        UE[UE] --- AMF_V[AMF]
        AMF_V --- SMF_V[V-SMF]
        SMF_V --- UPF_V[V-UPF]
        AMF_V --- SEPP_V[V-SEPP]
    end
    subgraph HPLMN[HPLMN Home network]
        SEPP_H[H-SEPP] --- AUSF[AUSF]
        SEPP_H --- UDM[UDM]
        SEPP_H --- SMF_H[H-SMF]
        SMF_H --- UPF_H[H-UPF]
    end
    SEPP_V -->|N32| SEPP_H
    UPF_V -.->|N9 when Home Routed| UPF_H

The role of each Network Function

NF Role in roaming
AMF (VPLMN) Accepts the UE's registration. Relays subscriber queries and authentication to the HPLMN via SEPP/N32
SEPP (V/H) The checkpoint at the PLMN boundary. Relays inter-operator SBI over N32 and performs filtering, topology hiding, and protection
AUSF (HPLMN) Performs authentication of the roaming subscriber (authentication vector processing). Located on the home side
UDM (HPLMN) The source of subscriber information and authentication data. Responds to queries from the VPLMN
SMF (V/H) In Home Routed, V-SMF and H-SMF coordinate to build the PDU Session
UPF (V/H) LBO breaks out at the V-UPF; Home Routed has V-UPF and H-UPF coordinate over N9

Main Interfaces

Interface Segment Role
N32 V-SEPP ⇔ H-SEPP Relay and protection of inter-operator SBI signaling (TS 29.573, TS 33.501)
N32-c SEPP ⇔ SEPP For control. Handshake and protection-method negotiation
N32-f SEPP ⇔ SEPP For actual data transfer. Relay of SBI messages
N9 V-UPF ⇔ H-UPF Inter-UPF user-plane connection when Home Routed (TS 23.501)

Relationship with N14

During roaming, when inter-AMF coordination is needed for handover or mobility, N14 (AMF⇔AMF) is involved. When it crosses the PLMN boundary, it goes via SEPP/N32.

Procedure — Call Flow of roaming Registration

When registering with the VPLMN, authentication and subscriber confirmation are done by the HPLMN. Here is an outline.

sequenceDiagram
    participant UE
    participant AMF_V as VPLMN AMF
    participant SEPP_V as V-SEPP
    participant SEPP_H as H-SEPP
    participant HN as HPLMN (AUSF/UDM)
    Note over UE,AMF_V: (1) UE requests registration with the VPLMN
    UE->>AMF_V: Registration Request (SUCI/GUTI)
    Note over AMF_V,SEPP_H: (2) Query authentication info to the HPLMN (via N32)
    AMF_V->>SEPP_V: Nausf authentication request
    SEPP_V->>SEPP_H: N32-f (protected SBI)
    SEPP_H->>HN: Restore and forward the authentication request
    HN->>HN: Generate authentication vector, confirm subscriber
    HN-->>SEPP_H: Authentication response
    SEPP_H-->>SEPP_V: N32-f (protected SBI)
    SEPP_V-->>AMF_V: Restore the authentication response
    Note over UE,AMF_V: (3) Mutual authentication (VPLMN AMF ⇔ UE)
    AMF_V->>UE: Authentication Request
    UE-->>AMF_V: Authentication Response
    Note over AMF_V,SEPP_H: (4) Retrieve subscriber data (Nudm, via N32)
    AMF_V->>SEPP_V: Nudm subscriber data request
    SEPP_V->>SEPP_H: N32-f
    SEPP_H-->>SEPP_V: Subscriber data response
    SEPP_V-->>AMF_V: Restore
    AMF_V-->>UE: Registration Accept

Signal Flow (key Messages)

# Message Segment Meaning
1 Registration Request UE→VPLMN AMF Registration request to the VPLMN (SUCI, etc.)
2 Nausf authentication request (N32-f) V-SEPP→H-SEPP→AUSF Relays the authentication-info query to the HPLMN
3 Authentication response (N32-f) H-SEPP→V-SEPP The authentication vector/result from the HPLMN
4 Authentication Req/Res VPLMN AMF⇔UE Mutual authentication with the UE
5 Nudm subscriber data (N32-f) V-SEPP⇔H-SEPP Retrieval of the subscriber profile
6 Registration Accept VPLMN AMF→UE Registration complete

The N32 handshake is a prerequisite

For (2) onward above to hold, V-SEPP and H-SEPP must have established the connection over N32-c and negotiated the protection method (PRINS/TLS) in advance. If N32-c is not up, inter-operator signaling will not pass.

PDU Session structure of Home Routed

In Home Routed, the user plane is routed back to the HPLMN.

graph LR
    UE[UE] --- RAN[NG-RAN]
    RAN --- UPF_V[V-UPF]
    UPF_V -->|N9| UPF_H[H-UPF]
    UPF_H --> DN[Data Network
Breaks out to the external network on the HPLMN side]
    SMF_V[V-SMF] -.control.- UPF_V
    SMF_H[H-SMF] -.control.- UPF_H
    SMF_V -.via N16 SEPP/N32.- SMF_H

Comparison with EPC (4G)

Aspect 4G EPC 5GC
Roaming method LBO / Home Routed (determined by the location of the PGW) LBO / Home Routed (determined by the V-UPF/H-UPF)
Inter-UP connection (HR) S8 (SGW⇔PGW, GTP) N9 (V-UPF⇔H-UPF)
Subscriber query S6a (MME⇔HSS, Diameter) Nudm/Nausf over N32
Inter-operator boundary DEA (Diameter Edge Agent) / IPX SEPP
Protection IPsec / IPX-contract-dependent PRINS / TLS (N32, TS 33.501)
Protocol Diameter (S6a) / GTP (S8) SBI (HTTP/2) over N32

The biggest change in 5G is that the vague DEA/IPX boundary is standardized into an explicit NF called SEPP, and inter-operator signaling is topology-hidden and integrity-protected/encrypted over N32.

Release differences

Release Changes
Rel-15 Introduction of SEPP/N32. Definition of the LBO/Home Routed roaming reference architecture (TS 23.501)
Rel-16 onward Clarification of N32 protection (PRINS/TLS), expansion of slice coordination in roaming

Relationship with GSMA

Operational N32 (PRINS operation, via IPX operators, etc.) is also specified in GSMA's specifications (FS.34, etc.), but the exact numbers and sections are to be confirmed. The backbone of the standard is carried by 3GPP TS 33.501 / TS 29.573.

Trouble Shooting

Symptom Suspected area What to check
Cannot register at the roaming destination N32-c not established The V-SEPP⇔H-SEPP handshake, protection-method negotiation
Authentication fails The HPLMN AUSF/UDM query path N32-f relay, whether the SUCI/subscriber information reaches the HPLMN
Registration passes but no communication UP path (LBO/HR) configuration The N9 reachability of Home Routed, the V-UPF/H-UPF configuration
Concern that specific NF information is leaking The SEPP's topology-hiding configuration Whether the filtering/hiding policy is enabled (see SEPP)
Message tampering detected The N32 protection method The integrity-protection configuration of PRINS/TLS (see N32)

3GPP Specification

Spec Content
TS 23.501 System architecture (roaming reference architecture, LBO/Home Routed, N9)
TS 23.502 Procedures (roaming registration, PDU Session establishment procedure)
TS 33.501 Security architecture (SEPP, N32, PRINS/TLS protection)
TS 29.573 5G System; Public Land Mobile Network (PLMN) Interconnection (the N32 protocol)

The granularity of section numbers

The TS numbers above are reliable as the main specs of the roaming domain. The detailed section numbers within each TS (the exact location of specific message definitions, etc.) differ by version, so for precise citation they are to be confirmed. The numbers of the GSMA specifications (FS.34, etc.) are also to be confirmed.

FAQ

Q. Which is the standard, LBO or Home Routed?

Both are standard methods. If you prioritize latency and break out at the visited network, choose LBO; if you want to consistently apply your home services, policy, and charging, choose Home Routed. The choice depends on the target DNN/slice, the inter-operator contract, and regulation.

Q. Can you not roam without a SEPP?

The inter-operator SBI signaling of 5GC is designed on the premise of SEPP/N32. Because the SEPP handles filtering, topology hiding, and protection at the boundary, a SEPP is required for standard-compliant roaming. For details, go to the SEPP page.

Q. What is the difference between N32-c and N32-f?

N32-c is for control and handles the handshake and protection-method negotiation between SEPPs, while N32-f is for actual data transfer and relays the actual SBI messages (authentication, subscriber queries, etc.). For details, go to the N32 page.

Summary

  • Roaming is the mechanism by which a subscriber communicates using the VPLMN's network while outside the HPLMN's coverage.
  • By user-plane path, it splits into LBO (breaking out at the VPLMN) and Home Routed (routing back to the HPLMN, with UPF coordination over N9).
  • A SEPP stands at the PLMN boundary, relaying and protecting inter-operator SBI over N32 (N32-c for control / N32-f for forwarding).
  • Protection is PRINS / TLS (TS 33.501). It handles filtering, topology hiding, and integrity protection/encryption.
  • In roaming Registration, the VPLMN AMF queries the HPLMN's AUSF/UDM for authentication/subscriber information via SEPP/N32.

Comprehension check

Q1. Explain the difference between LBO and Home Routed from the viewpoint of the user-plane path.

LBO breaks out directly to the external network at a UPF within the VPLMN, so latency is low. Home Routed routes the user plane back to the HPLMN, with V-UPF and H-UPF coordinating over N9 and breaking out from the home UPF, so the HPLMN's services, policy, and charging can be consistently applied.

Q2. Explain the role of the SEPP and the difference between N32-c / N32-f.

As the checkpoint at the PLMN boundary, the SEPP handles the filtering, topology hiding, and integrity protection/encryption of inter-operator SBI. N32-c is for control and handles the handshake and protection-method negotiation between SEPPs; N32-f is for actual data transfer and handles the relay of SBI messages.

Q3. In roaming Registration, which NF of which PLMN performs authentication/subscriber confirmation, and which path does it take?

Authentication is performed by the HPLMN's AUSF, and subscriber confirmation by the HPLMN's UDM. The query from the VPLMN AMF reaches the HPLMN via V-SEPP→N32→H-SEPP, and the response returns by the same path. Because the VPLMN does not hold subscriber information, it queries the HPLMN.

Next Step