How to Implement Mobility for Junos Multi-Access User Plane
Summary
For Junos OS Release 19.4R1, we introduced Junos Multi-Access User Plane supporting a combined SGW-U/PGW-U (SAEGW-U) on MX Series routers in accordance with 3GPP Release 14 CUPS architecture. This provided high-throughput 4G and 5G fixed-wireless access service with support for 5G non-stand-alone (NSA) mode. Starting with Junos OS Release 20.4R1, Junos Multi-Access User Plane supports running an MX router as either a standalone SGW-U or a standalone PGW-U to enable high-throughput 4G and 5G mobility service.
Junos Multi-Access User Plane supports running an MX router as either a standalone SGW-U or a standalone PGW-U while still supporting running an MX router as a SAEGW-U. Running an MX router as a standalone SGW-U enables mobility service, that is, relocation of a UE to a new eNodeB, new SGW-U, or new SAEGW-U. This includes support for GTP-U based S5-U and S8-U interfaces, which provides links between SGW-U and PGW-U devices. Junos Multi-Access User Plane also provides tunnel relay functionality to forward user plane traffic between S1-U and S5-U/S8-U interfaces and between S5-U/S8-U and SGi interfaces.
Figure 1 shows the basic topology of running MX routers separately as and SGW-U and a PGW-U to enable mobility.

Logistics of UE handover, including SGW & PGW selection, are handled by SGW-C and PGW-C functions. The SGW-C and PGW-C participate in control protocol exchanges and update their SGW-U/PGW-U counterparts over Sxa and Sxb interfaces with any new or changed attributes of the UE session and bearers.
We support the following mobility scenarios:
Handover with eNodeB and no SGW change
Handover with SGW change (direct forwarding)
Handover with SGW change (indirect forwarding)
In summary, starting with Junos OS Release 20.4R1, Junos Multi-Access User Plane supports three different modes of operation on a single MX router:
SGW-U, where the MX router acts as an SGW-U for all sessions and connects to a third-party SGW-C over a single Sxa interface and Juniper or third-party PGW-Us over multiple S5/8-U interfaces.
PGW-U, where the MX router acts as a PGW-U for all sessions and connects to a third-party PGW-C over a single Sxb interface and Juniper or third-party SGW-Us over multiple S5/8-U interfaces.
Combined SGW/PGW-U (SAEGW-U), where depending on the UE location, the MX router acts as an SGW-U for some sessions, a PGW-U for another set of sessions and SAEGW-U for the remaining sessions. In this mode, the SAEGW-U connects to an SAEGW-C over a single Sxa/Sxb interface and to other Juniper or third-party SGW-Us and PGW-Us over multiple S5/8-U interfaces.
Only a single type of Sx association is supported at a time: Sxa, Sxb or combined Sxa/Sxb.
MX Series Router As SGW-U
Overview
Junos Multi-Access User Plane can function as a standalone SGW user plane (SGW-U) in a single MX router. As Figure 2 shows, Juniper’s MX SGW-U interoperates with a third-party SGW-C through a the Sxa interface and one or more Juniper or third-party PGW-Us over one or more S5/8-U interfaces.

The MX SGW-U supports the following CUPS interfaces:
Sxa—Packet Forwarding Control Protocol (PFCP) enables communication on the Sxa interface between the SGW-C and SGW-U. PFCP encodes TLV messages for transport over UDP/IP. The Sxa interface can also transport user data packets (GTP-U based) between the user plane and control plane. SGW-U runs PFCP as the control protocol with the third-party SGW-C to set up data paths for wireless subscribers.
S1-U—The S1-U interface is the data path between an eNodeB and the SGW-U. Application data packets from end-user equipment are encapsulated over GTP. For upstream packets, the SGW-U is responsible for forwarding GTP packets to the appropriate PGW-U. For downstream packets, SGW-U forwards GTP packets to eNodeB(s).
S5/8-U—The S5/8-U interface is the data path between an SGW-U and a PGW-U.
The MX SGW-U as the user plane provides the following functionality:
Session management support:
Resource management for bearer resources
IP address and TEID assignment for GTP-U packets (IP address is allocated by the SGW-C and TEID-U is allocated by the SGW-U)
Packet forwarding (GTP-U tunnel relay between S1-U and S5/8-U interfaces)
UE mobility support:
Forwarding of End Marker message (as long as user plane to source eNodeB exists)
For UE mobility, the End Marker message is used to help packet ordering at the target eNodeB. The End Marker is sent by the SGW-U during handover when the UE moves to a new eNodeB but keeps the same SGW-U. The SGW-U sends the End Marker message to the original eNodeB across all S1-U tunnels corresponding to the UE session. The original eNodeB forwards the End Marker packets to the target eNodeB.
If handover involves an SGW-U change as well, the PGW-U sends the End Marker message to the original SGW-U on all S5-U/S8-U tunnels corresponding to the UE session. The SWG-U in turn forwards all End Marker packets over corresponding S1-U tunnels to the original eNodeB, which forwards them to the target eNodeB.
Sending of End Marker message after switching the path to target eNodeB
Buffered packet forwarding
When a UE enters ECM-IDLE or power saving mode, all downlink data packets destined for the UE are buffered at the SGW-U. The SGW-C provisions the SGW-U with one of the following behaviors:
Buffer packets without notifying the SGW-C upon arrival of the first downlink packet
Buffer packets with notifying SGW-C upon arrival of the first downlink packet
Drop packets
No indication is sent to the SGW-C when the MX router as SGW-U is instructed to buffer but does not have available buffering queue space. The MX router as SGW-U discards packets until a queue becomes available. On the first packet, if First DL Packet notification is configured, the SGW-U notifies the SGW-C of the packet arrival. The MX router as SGW-U supports up to 1GB of active buffering on up to 100,000 bearers per anchor PFE.
Accounting per UE and bearer (volume accounting only)
Lawful intercept
Junos Multi-Access User Plane provides purely the SGW-U in the form of an MX router that interacts with a third-party SGW-C. The MX router, functioning as an SGW-U, receives instructions from the SGW-C through the Sxa interface using PFCP. Based on those instructions, the MX routing engine manages SGW-U sessions and programs data paths in the anchor PFEs. Like the SAEGW-U, for the MX router to function as an SGW-U, it must contain the following minimum elements:
At least one anchor PFE interface–An anchor PFE interface on the SGW-U is a line card interface that has no physical interface connection, but rather provides the core processing of data traffic by doing the following:
Forwards GTP-U packets
Enforces class of service and firewall filter rules on subscriber sessions
Collects statistics on data usage for charging/accounting purpose
At least one signalling/control interface-This is the Sxa interface in the CUPS architecture. The signalling/control interface is a physical interface that does the following:
Sends/receives PFCP packets to/from the SGW-C
At least one ingress interface-This is the S1-U interface in the CUPS architecture. The ingress interface is a physical interface that does the following:
Forwards GTP-U packets between eNodeBs and the anchor PFE
At least one egress interface-This is the S5/8-U interface in the CUPS architecture. The egress interface is a physical interface that does the following:
Forwards GTP-U packets between the anchor PFE and the designated PGW-U
You can configure all four interface types on the same line card, as long as that line card supports all of the interface types.
Configuring an MX Router as an SGW-U
As Figure 3 shows, a standard setup of an MX router as an SGW-U includes an ingress line card, and egress line card, and a recommended two anchor PFE line cards operating redundantly.

The ingress line card provides the S1-U interface, connecting to the radio access network (RAN), and the Sxa interface, connecting to the SGW-C.
The anchor PFE line cards provide the core processing of data traffic through internal pfe- interfaces. At least one anchor PFE card is required, but two are recommended to provide redundancy.
The egress line card provides the S5/8-U interface, connecting to the PGW-U.
You can configure all of this functionality on a single line card as long as that line card supports all of the SGW-U functionality. We show separate line cards here for simplicity and recommended setup.
To configure an MX router as an SGW-U, perform the following configuration procedures in the listed order:
GRES Configuration
The graceful Routing Engine switchover (GRES) feature in Junos OS enables a router with redundant Routing Engines to continue forwarding packets, even if one Routing Engine fails. GRES preserves interface and kernel information. Traffic is not interrupted.
- Configure Graceful Restart (GRES).[edit chassis]user@host# set redundancy graceful-switchoveruser@host# commit
Chassis Configuration for the Anchor PFE Line Cards
Define each Packet Forwarding Engine (PFE) on each anchor PFE line card as an anchor interface.
- [edit chassis]user@host# set fpc anchor-pfe0-slot pfe 0 forwarding-packages mobility user-planeuser@host# set fpc anchor-pfe0-slot pfe 0 forwarding-packages mobility card-type-alluser@host# set fpc anchor-pfe0-slot pfe 1 forwarding-packages mobility user-planeuser@host# set fpc anchor-pfe0-slot pfe 1 forwarding-packages mobility card-type-alluser@host# set fpc anchor-pfe1-slot pfe 0 forwarding-packages mobility user-planeuser@host# set fpc anchor-pfe1-slot pfe 0 forwarding-packages mobility card-type-alluser@host# set fpc anchor-pfe1-slot pfe 1 forwarding-packages mobility user-planeuser@host# set fpc anchor-pfe1-slot pfe 1 forwarding-packages mobility card-type-alluser@host# commit
Interface Configuration
Configure the interfaces needed for the SGW-U.
- Define the S5/8-U interface. This interface is on the
egress line card.[edit interfaces]user@host# set S5/8-U-interface-name unit 0 family inet address interface-address
- Define the Sxa interface, which connects to the SGW-C.
This interface is on the ingress line card.[edit interfaces]user@host# set Sxa-interface-name unit 0 family inet address interface-address
- Define the S1-U interface, which connects to the access
network. This interface is on the ingress line card and is set to
admit only GTP packets.[edit interfaces]user@host# set S1-U-interface-name unit 0 family inet address interface-addressuser@host# set S1-U-interface-name unit 0 family inet filter input input-filter-nameuser@host# set S1-U-interface-name unit 0 family inet filter output output-filter-name
- Define the UPF local address and Mobile Edge interface.[edit interfaces]user@host# set lo0 unit 0 family inet address UPF-local-addressuser@host# set mif unit 0 family inet
Note If you are connecting to multiple SGW-Cs, define the local address under the control-plane-peers stanza for each SGW-C rather than define a single loopback address.
Note mif.0 is used in the default inet.0 routing instance. Junos OS creates a default APN with inet.0 as the routing instance. If you want to configure other routing instances, you must create mif interfaces with unit numbers other than 0.
- Assuming two anchor PFE linecards, each with two PFEs,
define the anchor PFE interfaces.[edit interfaces]user@host# set apfe0 anchoring-options primary-list pfe-pfe0-slot/0/0user@host# set apfe0 anchoring-options secondary pfe-pfe1-slot/0/0user@host# set apfe1 anchoring-options primary-list pfe-pfe0-slot/1/0user@host# set apfe1 anchoring-options secondary pfe-pfe1-slot/1/0user@host# commit
Note You cannot mix primary and secondary anchor PFEs on the same MPC. An MPC can have only either primary anchor PFEs or secondary anchor PFEs.
Caution Changing the anchor PFE redundancy configuration once sessions are active kills all active sessions.
Mobile Edge Configuration
Once you’ve configured all of the necessary interfaces, you can configure the MX router to be a SGW-U.
- Configure the connection to the control plane, the SGW-C.[edit services mobile-edge gateways saegw gateway-name control-plane-peers]user@host# set local-address local-addressuser@host# set apn-services apns apn-name mobile-interface mif.0user@host# set peer-groups group-name path-management enableuser@host# set peer-groups group-name heartbeat-interval secondsuser@host# set peer-groups group-name n3-requests n3-requestsuser@host# set peer-groups group-name t3-response secondsuser@host# set peer-groups group-name peer-address remote-peer-addressuser@host# set peer-groups group-name peer-hostname remote-peer-hostname
Note If you are connecting to multiple SGW-Cs, define the local address under the control-plane-peers stanza for each SGW-C. The loopback address, however, is still required for Lawful Intercept to function.
- Configure the connection to the access network through
the S1-U interface.[edit services mobile-edge gateways saegw gateway-name access-network-peers]user@host# set local-address local-addressuser@host# set peer-groups group-name peer-address remote-peer-addressuser@host# set peer-groups group-name peer-hostname remote-peer-hostname
- Configure the connection to the core network peers (PGW-Us)
through the S5/8-U interface.[edit services mobile-edge gateways saegw gateway-name core-network-peers]user@host# set local-address local-addressuser@host# set routing-instance routing-instance-nameuser@host# set path-management enableuser@host# set n3-requests n3-requestsuser@host# set t3-response seconds
- Define the interfaces that will provide the anchor PFE
functionality.[edit services mobile-edge gateways saegw gateway-name system]user@host# set anchor-pfes interface apfe0user@host# set anchor-pfes interface apfe1user@host# commit
Firewall Configuration
Define input and output firewall filters that discard all packets except GTP packets at the S1-U and S5/8-U interfaces.
For GTP-U path management, the filter must work in enhanced mode.
- GTP packets are UDP packets that have a destination port
of 2152. GTP prime packets have a destination port of 3386. Accept
and count these packets and discard all others:[edit firewall filter input-filter-name]user@host# set term 1 from protocol udpuser@host# set term 1 from destination-port 2152user@host# set term 1 from destination-port 3386user@host# set term 1 then count filter-nameuser@host# set term 1 then next-hop-index 16777220user@host# set term 2 then count defaultuser@host# set term 2 then acceptuser@host# set enhanced-modeuser@host# commit[edit firewall filter output-filter-name]user@host# set term 1 from protocol udpuser@host# set term 1 from destination-port 2152user@host# set term 1 from destination-port 3386user@host# set term 1 then count filter-nameuser@host# set term 1 then next-hop-index 16777220user@host# set term 2 then count defaultuser@host# set term 2 then acceptuser@host# set enhanced-modeuser@host# commit
MX Series Router As PGW-U
Overview
Junos Multi-Access User Plane can function as a standalone PGW user plane (PGW-U) in a single MX router. As Figure 4 shows, Juniper’s MX PGW-U interoperates with a third-party PGW-C through a the Sxb interface and one or more Juniper or third-party SGW-Us over one or more S5/8-U interfaces.

The MX PGW-U supports the following CUPS interfaces:
Sxb—Packet Forwarding Control Protocol (PFCP) enables communication on the Sxb interface between the PGW-C and PGW-U. PFCP encodes TLV messages for transport over UDP/IP. The Sxb interface can also transport user data packets (GTP-U based) between the user plane and control plane. PGW-U runs PFCP as the control protocol with the third-party PGW-C to set up data paths for wireless subscribers.
S5/8-U—The S5/8-U interface is the data path between an SGW-U and a PGW-U.
SGi—Interface to the core Internet, supporting IPv4.
The MX PGW-U as the user plane provides the following functionality:
Session management support:
Resource management for bearer resources
IP address and TEID assignment for GTP-U packets (IP address is allocated by the PGW-C and TEID-U is allocated by the PGW-U)
Packet forwarding
UE mobility support:
Sending of "end marker" after switching the path to target node
Accounting per UE and bearer (volume accounting only)
Lawful intercept
Junos Multi-Access User Plane provides purely the PGW-U in the form of an MX router that interacts with a third-party PGW-C. The MX router, functioning as an PGW-U, receives instructions from the SPGW-C through the Sxb interface using PFCP. Based on those instructions, the MX routing engine manages PGW-U sessions and programs data paths in the anchor PFEs. Like the SAEGW-U, for the MX router to function as an PGW-U, it must contain the following minimum elements:
At least one anchor PFE interface–An anchor PFE interface on the PGW-U is a line card interface that has no physical interface connection, but rather provides the core processing of data traffic by doing the following:
Encodes/decodes GTP-U packets. The anchor PFE interface decodes GTP-U packets from SGW-Us and forwards them to the core network and encodes IPv4 packets from the core network and forwards them to SGW-Us.
Enforces class of service and firewall filter rules on subscriber sessions
Collects statistics on data usage for charging/accounting purpose
At least one signalling/control interface-This is the Sxb interface in the CUPS architecture. The signalling/control interface is a physical interface that does the following:
Sends/receives PFCP packets to/from the PGW-C
At least one ingress interface-This is the S5/8-U interface in the CUPS architecture. The ingress interface is a physical interface that does the following:
Forwards GTP-U packets between the anchor PFE and the designated SGW-U
At least one egress interface-This is the SGi interface in the CUPS architecture. The egress interface is a physical interface that does the following:
Forwards IPv4 packets between the anchor PFE and the core network
You can configure all four interface types on the same line card, as long as that line card supports all of the interface types.
Configuring an MX Router as an PGW-U
As Figure 5 shows, a standard setup of an MX router as an PGW-U includes an ingress line card, and egress line card, and a recommended two anchor PFE line cards operating redundantly.

The ingress line card provides the S5/8-U interface, connecting to the SGW-U.
The anchor PFE line cards provide the core processing of data traffic through internal pfe- interfaces. At least one anchor PFE card is required, but two are recommended to provide redundancy.
The egress line card provides the SGi interface, connecting to the core Internet.
You can configure all of this functionality on a single line card as long as that line card supports all of the PGW-U functionality. We show separate line cards here for simplicity and recommended setup.
To configure an MX router as an PGW-U, perform the following configuration procedures in the listed order:
GRES Configuration
The graceful Routing Engine switchover (GRES) feature in Junos OS enables a router with redundant Routing Engines to continue forwarding packets, even if one Routing Engine fails. GRES preserves interface and kernel information. Traffic is not interrupted.
- Configure Graceful Restart (GRES).[edit chassis]user@host# set redundancy graceful-switchoveruser@host# commit
Chassis Configuration for the Anchor PFE Line Cards
Define each Packet Forwarding Engine (PFE) on each anchor PFE line card as an anchor interface.
- [edit chassis]user@host# set fpc anchor-pfe0-slot pfe 0 forwarding-packages mobility user-planeuser@host# set fpc anchor-pfe0-slot pfe 0 forwarding-packages mobility card-type-alluser@host# set fpc anchor-pfe0-slot pfe 1 forwarding-packages mobility user-planeuser@host# set fpc anchor-pfe0-slot pfe 1 forwarding-packages mobility card-type-alluser@host# set fpc anchor-pfe1-slot pfe 0 forwarding-packages mobility user-planeuser@host# set fpc anchor-pfe1-slot pfe 0 forwarding-packages mobility card-type-alluser@host# set fpc anchor-pfe1-slot pfe 1 forwarding-packages mobility user-planeuser@host# set fpc anchor-pfe1-slot pfe 1 forwarding-packages mobility card-type-alluser@host# commit
Interface Configuration
Configure the interfaces needed for the PGW-U.
- Define the SGi interface. This interface is on the egress
line card.[edit interfaces]user@host# set SGi-interface-name unit 0 family inet address interface-address
- Define the Sxb interface, which connects to the PGW-C.
This interface is on the ingress line card.[edit interfaces]user@host# set Sxb-interface-name unit 0 family inet address interface-address
- Define the S5/8-U interface, which connects to the SGW-U.
This interface is on the ingress line card and is set to admit only
GTP packets.[edit interfaces]user@host# set S5/8-U-interface-name unit 0 family inet address interface-addressuser@host# set S5/8-U-interface-name unit 0 family inet filter input input-filter-nameuser@host# set S5/8-U-interface-name unit 0 family inet filter output output-filter-name
- Define the UPF local address and Mobile Edge interface.[edit interfaces]user@host# set lo0 unit 0 family inet address UPF-local-addressuser@host# set mif unit 0 family inet
Note If you are connecting to multiple PGW-Cs, define the local address under the control-plane-peers stanza for each PGW-C rather than define a single loopback address.
Note mif.0 is used in the default inet.0 routing instance. Junos OS creates a default APN with inet.0 as the routing instance. If you want to configure other routing instances, you must create mif interfaces with unit numbers other than 0.
- Assuming two anchor PFE linecards, each with two PFEs,
define the anchor PFE interfaces.[edit interfaces]user@host# set apfe0 anchoring-options primary-list pfe-pfe0-slot/0/0user@host# set apfe0 anchoring-options secondary pfe-pfe1-slot/0/0user@host# set apfe1 anchoring-options primary-list pfe-pfe0-slot/1/0user@host# set apfe1 anchoring-options secondary pfe-pfe1-slot/1/0user@host# commit
Note You cannot mix primary and secondary anchor PFEs on the same MPC. An MPC can have only either primary anchor PFEs or secondary anchor PFEs.
Caution Changing the anchor PFE redundancy configuration once sessions are active kills all active sessions.
Mobile Edge Configuration
Once you’ve configured all of the necessary interfaces, you can configure the MX router to be a PGW-U.
- Configure the connection to the control plane, the PGW-C.[edit services mobile-edge gateways saegw gateway-name control-plane-peers]user@host# set local-address local-addressuser@host# set apn-services apns apn-name mobile-interface mif.0user@host# set peer-groups group-name path-management enableuser@host# set peer-groups group-name heartbeat-interval secondsuser@host# set peer-groups group-name n3-requests n3-requestsuser@host# set peer-groups group-name t3-response secondsuser@host# set peer-groups group-name peer-address remote-peer-addressuser@host# set peer-groups group-name peer-hostname remote-peer-hostname
Note If you are connecting to multiple SGW-Cs, define the local address under the control-plane-peers stanza for each SGW-C. The loopback address, however, is still required for Lawful Intercept to function.
- Configure the connection to the core network peers (SGW-Us)
through the S5/8-U interface.[edit services mobile-edge gateways saegw gateway-name core-network-peers]user@host# set local-address local-addressuser@host# set routing-instance routing-instance-nameuser@host# set path-management enableuser@host# set n3-requests n3-requestsuser@host# set t3-response seconds
- Define the interfaces that will provide the anchor PFE
functionality.[edit services mobile-edge gateways saegw gateway-name system]user@host# set anchor-pfes interface apfe0user@host# set anchor-pfes interface apfe1user@host# commit
Firewall Configuration
Define input and output firewall filters that discard all packets except GTP packets at the S1-U and S5/8-U interfaces.
For GTP-U path management, the filter must work in enhanced mode.
- GTP packets are UDP packets that have a destination port
of 2152. GTP prime packets have a destination port of 3386. Accept
and count these packets and discard all others:[edit firewall filter input-filter-name]user@host# set term 1 from protocol udpuser@host# set term 1 from destination-port 2152user@host# set term 1 from destination-port 3386user@host# set term 1 then count filter-nameuser@host# set term 1 then next-hop-index 16777220user@host# set term 2 then count defaultuser@host# set term 2 then acceptuser@host# set enhanced-modeuser@host# commit[edit firewall filter output-filter-name]user@host# set term 1 from protocol udpuser@host# set term 1 from destination-port 2152user@host# set term 1 from destination-port 3386user@host# set term 1 then count filter-nameuser@host# set term 1 then next-hop-index 16777220user@host# set term 2 then count defaultuser@host# set term 2 then acceptuser@host# set enhanced-modeuser@host# commit