5G Network Slicing Lab

Interactive · 3GPP TS 23.501 / 23.502

S-NSSAI Slicing Simulator

Provision slices, drive UE load, and watch the shared 5G RAN schedule 273 PRBs (100 MHz · 30 kHz SCS) across them in real time. Then flood eMBB and see exactly why slice isolation exists — URLLC's latency SLA survives only when its resources are guaranteed.

Provisioned slices

Resource policy

Slice isolation

RB reservation per S-NSSAI

Shared RAN · PRB allocation273 PRBs

5G Core Network (Open5GS)

Deploy and configure 5G Service Based Architecture (SBA) network functions

01

Open5GS 5G Core Architecture

Beginner

Understand the 5G Service Based Architecture and verify all Open5GS network functions are operational.

3GPP 5G Core Architecture

The 5G Core uses a Service Based Architecture (SBA) where Network Functions communicate via HTTP/2 APIs. Key NFs include: AMF (Access & Mobility), SMF (Session Management), UPF (User Plane), NRF (Repository), AUSF (Authentication), UDM (Data Management), UDR (Data Repository), PCF (Policy Control), and NSSF (Slice Selection).

┌─────────────────────────────────────────────────────────────────────────────┐ │ 5G CORE NETWORK (SBA) │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ ┌─────┐ ┌─────┐ ┌─────┐ ┌─────┐ ┌─────┐ ┌─────┐ ┌──────┐ │ │ │ NRF │ │AUSF │ │ UDM │ │ UDR │ │ PCF │ │NSSF │ │ BSF │ │ │ └──┬──┘ └──┬──┘ └──┬──┘ └──┬──┘ └──┬──┘ └──┬──┘ └──┬───┘ │ │ │ │ │ │ │ │ │ │ │ └───────┴───────┴───────┴───────┴───────┴───────┘ │ │ SBI (HTTP/2) │ │ ┌───────┬───────────────────────────────┐ │ │ ┌──┴──┐ ┌──┴──┐ ┌──┴──┐ │ │ │ AMF │ │ SMF │───────────────────────│ UPF │──────► Internet │ │ └──┬──┘ └─────┘ └─────┘ │ │ │ N2 │ ├──────┼──────────────────────────────────────────────────────────┤ │ ┌──┴──┐ │ │ │ gNB │ ◄──── 5G NR Radio (Uu) │ │ └──┬──┘ │ │ │ │ │ ┌──┴──┐ │ │ │ UE │ 5G Smartphone / IoT Device │ │ └─────┘ │ └─────────────────────────────────────────────────────────────────────────────┘

1

Check all Open5GS services: systemctl status open5gs-*

2

Verify NRF is running (service registry): curl /* SECURITY: Removed Direct IP:port connection */

3

Check AMF logs for N2 readiness: journalctl -u open5gs-amfd -f

Verify Open5GS Services

# Check all 5G Core Network Functions

$ systemctl status open5gs-nrfd open5gs-amfd open5gs-smfd open5gs-upfd --no-pager

● open5gs-nrfd.service - Open5GS NRF Daemon

Active: active (running)

● open5gs-amfd.service - Open5GS AMF Daemon

Active: active (running)

● open5gs-smfd.service - Open5GS SMF Daemon

Active: active (running)

● open5gs-upfd.service - Open5GS UPF Daemon

Active: active (running)

# List all registered NFs in NRF

$ curl -s /* SECURITY: Removed Direct IP:port connection *//nnrf-nfm/v1/nf-instances | jq '.[] | .nfType'

"AMF"

"SMF"

"UPF"

"AUSF"

"UDM"

"PCF"

"NSSF"

"BSF"

02

AMF Configuration & PLMN Setup

Intermediate

Configure the Access and Mobility Management Function (AMF) with PLMN identity and supported slices per 3GPP TS 23.501.

AMF Role in 5G

The AMF handles: UE Registration, Connection Management, Mobility Management, Access Authentication via AUSF, Security context management, and Slice Selection (NSSF interaction). It communicates with gNB via N2 (NGAP) and with UE via NAS over N1.

/etc/open5gs/amf.yaml

# View AMF Configuration

$ cat /etc/open5gs/amf.yaml

amf:

sbi:

server:

- address: 127.0.0.5

port: 7777

ngap:

server:

- address: 127.0.0.5 # gNB connects here via N2

guami:

- plmn_id:

mcc: 999

mnc: 70

amf_id:

region: 2

set: 1

plmn_support:

- plmn_id:

mcc: 999

mnc: 70

s_nssai:

- sst: 1 # eMBB Slice

- sst: 2 # URLLC Slice

- sst: 3 # mMTC Slice

1

Edit AMF config: sudo nano /etc/open5gs/amf.yaml

2

Set PLMN (MCC=999, MNC=70 for testing)

3

Add S-NSSAI entries for each slice type

4

Restart AMF: sudo systemctl restart open5gs-amfd

03

SMF & UPF Session Management

Intermediate

Configure Session Management Function (SMF) and User Plane Function (UPF) for PDU session establishment and IP allocation.

SMF & UPF Functions

SMF: PDU session management, IP allocation (DHCP/static), QoS flow handling, UPF selection, policy enforcement (via PCF).
UPF: Packet routing & forwarding, QoS handling, traffic measurement, uplink classifier, GTP-U tunneling to gNB.

SMF & UPF Configuration

# SMF Configuration - /etc/open5gs/smf.yaml

smf:

subnet:

- addr: 10.45.0.1/16 # eMBB IP Pool

dnn: internet

- addr: 10.46.0.1/16 # URLLC IP Pool

dnn: urllc

- addr: 10.47.0.1/16 # mMTC IP Pool

dnn: iot

# UPF Configuration - /etc/open5gs/upf.yaml

upf:

pfcp:

server:

- address: 127.0.0.7

gtpu:

server:

- address: 127.0.0.7 # GTP-U for gNB

subnet:

- addr: 10.45.0.1/16

- addr: 10.46.0.1/16

- addr: 10.47.0.1/16

# Verify UPF tunnel interface

$ ip addr show ogstun

ogstun: inet 10.45.0.1/16 scope global ogstun

04

Subscriber Provisioning (UDR/MongoDB)

Intermediate

Provision subscribers in the Unified Data Repository with IMSI, security credentials, and slice access permissions.

5G Subscriber Identity

SUPI (IMSI): 15-digit permanent identifier (MCC+MNC+MSIN).
Security: K (permanent key), OPc (derived operator key) for AKA authentication.
Slice Access: Subscribers are authorized for specific S-NSSAIs in their subscription data.

MongoDB Subscriber Management

# Add subscriber with multi-slice access

$ mongosh open5gs --eval '

db.subscribers.insertOne({

"imsi": "999700000000001",

"msisdn": ["0000000001"],

"security": {

"k": "465B5CE8B199B49FAA5F0A2EE238A6BC",

"opc": "E8ED289DEBA952E4283B54E88E6183CA",

"amf": "8000"

},

"slice": [

{"sst": 1, "default_indicator": true,

"session": [{"name": "internet", "type": 3, "qos": {"index": 9}}]},

{"sst": 2,

"session": [{"name": "urllc", "type": 3, "qos": {"index": 82}}]},

{"sst": 3,

"session": [{"name": "iot", "type": 3, "qos": {"index": 79}}]}

]

})'

# Verify subscriber

$ mongosh open5gs --eval 'db.subscribers.find({imsi:"999700000000001"}).pretty()'

5G RAN - gNodeB (UERANSIM)

Configure and deploy 5G NR base station with NGAP and slice support

05

gNB Configuration (UERANSIM)

Beginner

Configure UERANSIM gNB with cell identity, TAC, PLMN, and supported slices matching the core network.

5G gNodeB Architecture

The gNB implements 5G NR radio interface (Uu) and connects to 5G Core via N2 (NGAP to AMF) and N3 (GTP-U to UPF). Key parameters: NR Cell ID (36 bits), TAC (Tracking Area Code), PLMN, and supported S-NSSAIs for slice-aware operation.

┌─────────────────────────────────────────────────────────────────────────────┐ │ gNB ARCHITECTURE │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ ┌─────────────────────────────────────────────────────────────────┐ │ │ │ gNodeB (gNB) │ │ │ │ ┌──────────────────────┐ ┌──────────────────────────────┐ │ │ │ │ │ CU-CP │ │ CU-UP │ │ │ │ │ │ ┌─────┐ ┌─────┐ │ │ ┌─────┐ ┌─────┐ │ │ │ │ │ │ │ RRC │ │PDCP │ │ │ │SDAP │ │PDCP │ (User) │ │ │ │ │ │ └──┬──┘ └─────┘ │ │ └──┬──┘ └─────┘ │ │ │ │ │ └─────┼───────────────┘ └─────┼───────────────────────┘ │ │ │ │ │ │ │ │ │ │ ┌─────┴──────────────────────────┴─────┐ │ │ │ │ │ DU (RLC/MAC/PHY) │ │ │ │ │ └──────────────────┬──────────────────┘ │ │ │ └──────────────────────┼─────────────────────────────────────┘ │ │ │ Uu (5G NR Air Interface) │ │ ┌──────────────────────┴──────────────────────────────────────────┐ │ │ │ UE │ │ │ └─────────────────────────────────────────────────────────────────┘ │ │ │ │ N2 (NGAP) ────► AMF N3 (GTP-U) ────► UPF │ └─────────────────────────────────────────────────────────────────────────────┘

open5gs-gnb.yaml

# UERANSIM gNB Configuration

$ cat /opt/UERANSIM/config/open5gs-gnb.yaml

mcc: '999'

mnc: '70'

nci: '0x000000010' # NR Cell Identity (36-bit)

idLength: 32

tac: 1 # Tracking Area Code

linkIp: 127.0.0.1

ngapIp: 127.0.0.1

gtpIp: 127.0.0.1

# AMF Connection

amfConfigs:

- address: 127.0.0.5

port: 38412

# Supported Slices (must match AMF)

slices:

- sst: 1 # eMBB

- sst: 2 # URLLC

- sst: 3 # mMTC

ignoreStreamIds: true

06

NGAP Connection to AMF

Intermediate

Start gNB and establish N2 (NGAP) connection to the AMF. Verify NG Setup procedure and slice configuration.

NGAP Protocol (3GPP TS 38.413)

NG Setup: gNB registers with AMF, exchanges supported TACs, PLMNs, and slices.
Messages: NG SETUP REQUEST/RESPONSE, Initial UE Message, PDU Session Resource Setup, Handover procedures. NGAP runs over SCTP on port 38412.

Start gNB & Verify NGAP

# Start UERANSIM gNB

$ cd /opt/UERANSIM && ./build/nr-gnb -c config/open5gs-gnb.yaml

[2024-01-15 10:30:00] [gnb] gNB is starting...

[2024-01-15 10:30:00] [sctp] Trying to establish SCTP connection...

[2024-01-15 10:30:00] [sctp] SCTP connection established

[2024-01-15 10:30:00] [ngap] Sending NG Setup Request

[2024-01-15 10:30:00] [ngap] NG Setup Response received

[2024-01-15 10:30:00] [gnb] gNB is connected to AMF

# Verify SCTP connection

$ ss -tulnp | grep 38412

sctp LISTEN 0 5 127.0.0.5:38412 *:* users:(("open5gs-amfd"))

# Check AMF logs for NG Setup

$ journalctl -u open5gs-amfd | grep -i "ng setup"

NG Setup Request from gNB[MCC:999 MNC:70 gNB-ID:0x10]

NG Setup Response sent, Supported S-NSSAI: [SST:1,2,3]

07

Cell Parameters & Radio Config

Advanced

Understand NR cell identity structure, PCI planning, and frequency configuration per 3GPP TS 38.104.

NR Cell Identity

NCI (36 bits): gNB ID (22-32 bits) + Cell ID (4-14 bits).
PCI: Physical Cell ID (0-1007) = PSS (0-2) × 168 + SSS (0-167).
NR-ARFCN: Frequency channel number, e.g., n78 band: 620000-653333 (3.3-3.8 GHz).

NR Cell Configuration

# NR Cell Identity Calculation

gNB ID (28 bits): 0x0000001 = 1

Cell ID (8 bits): 0x00 = 0

NCI (36 bits): 0x000000010

# Cell Global Identifier (CGI)

PLMN: 999-70

NCI: 0x000000010

NR-CGI: 99970-000000010

# Tracking Area (TA)

TAC: 1

TAI (PLMN+TAC): 999-70-0001

5G UE - User Equipment (UERANSIM)

Simulate 5G devices with registration, authentication, and PDU sessions

08

UE Configuration (SUPI/Keys)

Beginner

Configure UE with IMSI, security keys (K, OPc), and requested S-NSSAI for slice access.

5G UE Identity & Security

SUPI: Subscription Permanent Identifier (IMSI format).
SUCI: Subscription Concealed Identifier (encrypted SUPI for privacy).
5G-GUTI: Temporary ID assigned by AMF after registration.
AKA: K + RAND → AUTN, RES*, KAUSF, KSEAF, KAMF chain.

open5gs-ue.yaml

# UERANSIM UE Configuration

$ cat /opt/UERANSIM/config/open5gs-ue.yaml

# UE Identity (must match MongoDB subscriber)

supi: 'imsi-999700000000001'

mcc: '999'

mnc: '70'

# Security Keys

key: '465B5CE8B199B49FAA5F0A2EE238A6BC'

op: 'E8ED289DEBA952E4283B54E88E6183CA'

opType: 'OPC'

amf: '8000'

# gNB Connection

gnbSearchList:

- 127.0.0.1

# Requested Network Slice

configured-nssai:

- sst: 1 # eMBB Slice

default-nssai:

- sst: 1

# Session Configuration

sessions:

- type: 'IPv4'

apn: 'internet'

slice:

sst: 1

09

5G Registration Procedure

Intermediate

Execute UE registration and trace the complete 5G-AKA authentication flow per 3GPP TS 23.502.

5G Registration Flow

1. UE → AMF: Registration Request (SUCI, Requested NSSAI)
2. AMF → AUSF → UDM: Authentication (5G-AKA)
3. AMF → NSSF: Slice Selection
4. AMF: Security Mode Command
5. AMF → UE: Registration Accept (5G-GUTI, Allowed NSSAI)

UE Registration

# Start UE (gNB must be running first)

$ cd /opt/UERANSIM && ./build/nr-ue -c config/open5gs-ue.yaml

[2024-01-15 10:35:00] [ue] UE is starting...

[2024-01-15 10:35:00] [rrc] Selected cell plmn[999/70] tac[1]

[2024-01-15 10:35:00] [nas] Sending Registration Request

[2024-01-15 10:35:00] [nas] Requested NSSAI: sst[1]

[2024-01-15 10:35:00] [nas] Authentication Request received

[2024-01-15 10:35:00] [nas] Security Mode Command received

[2024-01-15 10:35:00] [nas] Security context established

[2024-01-15 10:35:00] [nas] Registration Accept received

[2024-01-15 10:35:00] [nas] 5G-GUTI: 99970-1-1-1-1

[2024-01-15 10:35:00] [nas] Allowed NSSAI: sst[1]

[2024-01-15 10:35:00] [rrc] RRC Connected

10

PDU Session Establishment

Intermediate

Establish PDU session for data connectivity and verify IP assignment and GTP tunnel creation.

PDU Session Types

IPv4/IPv6: Standard IP connectivity.
Ethernet: Layer 2 tunnel for enterprise/IIoT.
Unstructured: Raw packet forwarding.
Each PDU Session is associated with a specific S-NSSAI (slice) and DNN (APN equivalent).

PDU Session & Data Test

# PDU Session output (from UE logs)

[nas] PDU Session Establishment Request sent

[nas] PDU Session Establishment Accept received

[nas] PDU Session ID: 1

[nas] PDU Address: 10.45.0.2

[nas] DNN: internet

[nas] S-NSSAI: sst[1]

# Check TUN interface created

$ ip addr show uesimtun0

uesimtun0: inet 10.45.0.2/32 scope global uesimtun0

# Test data connectivity

$ ping -I uesimtun0 8.8.8.8 -c 3

64 bytes from 8.8.8.8: icmp_seq=1 ttl=116 time=12.3 ms

64 bytes from 8.8.8.8: icmp_seq=2 ttl=116 time=11.8 ms

64 bytes from 8.8.8.8: icmp_seq=3 ttl=116 time=12.1 ms

# Verify GTP tunnel on UPF

$ tcpdump -i any port 2152 -c 5

IP 127.0.0.1.2152 > 127.0.0.7.2152: GTPv1-U, teid 0x1

5G Network Slicing (S-NSSAI)

Deploy eMBB, URLLC, and mMTC slices with traffic isolation and QoS differentiation

11

S-NSSAI & NSSF Configuration

Intermediate

Understand S-NSSAI structure and configure NSSF for slice selection per 3GPP TS 23.501.

S-NSSAI Structure (3GPP TS 23.501)

SST (8 bits): Slice/Service Type - defines slice behavior.
• SST=1: eMBB (Enhanced Mobile Broadband)
• SST=2: URLLC (Ultra-Reliable Low Latency)
• SST=3: mMTC (Massive Machine Type Comm)
• SST=4: V2X (Vehicle-to-Everything)
SD (24 bits): Slice Differentiator - operator-defined subdivision.

┌─────────────────────────────────────────────────────────────────────────────┐ │ S-NSSAI STRUCTURE │ ├─────────────────────────────────────────────────────────────────────────────┤ │ │ │ ┌───────────────────────────────────────────────────────────────────┐ │ │ │ S-NSSAI (32 bits total) │ │ │ ├───────────────────┬───────────────────────────────────────────────┤ │ │ │ SST (8 bits) │ SD (24 bits) - Optional │ │ │ │ Slice Type │ Slice Differentiator │ │ │ └───────────────────┴───────────────────────────────────────────────┘ │ │ │ │ SST=1 (eMBB) High throughput, video streaming, web browsing │ │ SST=2 (URLLC) Ultra-low latency (<1ms), factory automation, surgery │ │ SST=3 (mMTC) Massive IoT, sensors, smart meters (1M devices/km²) │ │ SST=4 (V2X) Vehicle communication, autonomous driving │ │ │ │ Example S-NSSAIs: │ │ • SST=1, SD=0x000001 → Consumer eMBB slice │ │ • SST=1, SD=0x000002 → Enterprise eMBB slice │ │ • SST=2, SD=0x000001 → Industrial URLLC slice │ └─────────────────────────────────────────────────────────────────────────────┘

/etc/open5gs/nssf.yaml

# NSSF Slice Selection Configuration

$ cat /etc/open5gs/nssf.yaml

nssf:

sbi:

server:

- address: 127.0.0.14

port: 7777

nsi:

- s_nssai:

sst: 1 # eMBB

nsi_information:

nrf:

uri: /* SECURITY: Removed Direct IP:port connection */

- s_nssai:

sst: 2 # URLLC

nsi_information:

nrf:

uri: /* SECURITY: Removed Direct IP:port connection */

- s_nssai:

sst: 3 # mMTC

nsi_information:

nrf:

uri: /* SECURITY: Removed Direct IP:port connection */

12

eMBB Slice Deployment (SST=1)

Intermediate

Deploy enhanced Mobile Broadband slice for high-throughput applications like 4K video and gaming.

eMBB Characteristics

Target: 100 Mbps - 20 Gbps throughput.
Latency: 4-10ms acceptable.
Use Cases: Video streaming, AR/VR, cloud gaming, large file transfers.
5QI: Typically 5QI=9 (non-GBR, best effort) or 5QI=5 (IMS signaling).

eMBB UE Configuration

# Create eMBB UE config

$ cat > /opt/UERANSIM/config/ue-embb.yaml << EOF

supi: 'imsi-999700000000001'

mcc: '999'

mnc: '70'

key: '465B5CE8B199B49FAA5F0A2EE238A6BC'

op: 'E8ED289DEBA952E4283B54E88E6183CA'

opType: 'OPC'

amf: '8000'

gnbSearchList: [127.0.0.1]

configured-nssai:

- sst: 1 # eMBB

default-nssai:

- sst: 1

sessions:

- type: 'IPv4'

apn: 'internet'

slice: {sst: 1}

EOF

# Start eMBB UE

$ ./build/nr-ue -c config/ue-embb.yaml

[nas] Allowed NSSAI: sst[1]

[nas] PDU Address: 10.45.0.2 (eMBB Pool)

# Test throughput

$ iperf3 -c speedtest.example.com -B 10.45.0.2

[ ID] Interval Transfer Bitrate

[ 5] 0-10 sec 112 MBytes 94.1 Mbits/sec

13

URLLC Slice Deployment (SST=2)

Advanced

Deploy Ultra-Reliable Low Latency slice for mission-critical applications with sub-millisecond requirements.

URLLC Characteristics

Latency: <1ms end-to-end (target 0.5ms).
Reliability: 99.9999% (6 nines).
Use Cases: Industrial automation, remote surgery, autonomous vehicles.
5QI: 82 (delay-critical GBR), 83, 84, 85 for specific URLLC scenarios.

URLLC Slice Configuration

# Add URLLC subscriber

$ mongosh open5gs --eval '

db.subscribers.insertOne({

"imsi": "999700000000002",

"security": {

"k": "465B5CE8B199B49FAA5F0A2EE238A6BC",

"opc": "E8ED289DEBA952E4283B54E88E6183CA"

},

"slice": [{

"sst": 2,

"default_indicator": true,

"session": [{

"name": "urllc",

"type": 3,

"qos": {

"index": 82, // Delay-critical GBR

"arp": {

"priority_level": 1,

"pre_emption_capability": 1,

"pre_emption_vulnerability": 2

}

}]

})'

# Create URLLC UE config

$ cat > /opt/UERANSIM/config/ue-urllc.yaml << EOF

supi: 'imsi-999700000000002'

mcc: '999'

mnc: '70'

key: '465B5CE8B199B49FAA5F0A2EE238A6BC'

op: 'E8ED289DEBA952E4283B54E88E6183CA'

opType: 'OPC'

amf: '8000'

gnbSearchList: [127.0.0.1]

configured-nssai:

- sst: 2 # URLLC

default-nssai:

- sst: 2

sessions:

- type: 'IPv4'

apn: 'urllc'

slice: {sst: 2}

EOF

# Start URLLC UE and test latency

$ ./build/nr-ue -c config/ue-urllc.yaml

[nas] Allowed NSSAI: sst[2]

[nas] PDU Address: 10.46.0.2 (URLLC Pool)

14

mMTC Slice Deployment (SST=3)

Advanced

Deploy massive Machine Type Communication slice for IoT devices with power-efficient small data transmission.

mMTC Characteristics

Density: 1 million devices per km².
Power: 10+ year battery life.
Use Cases: Smart meters, environmental sensors, asset tracking.
5QI: 79 (non-GBR, delay tolerant), small infrequent data bursts.

mMTC Slice Configuration

# Add mMTC/IoT subscriber

$ mongosh open5gs --eval '

db.subscribers.insertOne({

"imsi": "999700000000003",

"security": {

"k": "465B5CE8B199B49FAA5F0A2EE238A6BC",

"opc": "E8ED289DEBA952E4283B54E88E6183CA"

},

"slice": [{

"sst": 3,

"default_indicator": true,

"session": [{

"name": "iot",

"type": 3,

"qos": {

"index": 79 // Non-GBR, delay tolerant

}

}]

})'

# Create mMTC UE config (IoT sensor)

$ cat > /opt/UERANSIM/config/ue-mmtc.yaml << EOF

supi: 'imsi-999700000000003'

mcc: '999'

mnc: '70'

key: '465B5CE8B199B49FAA5F0A2EE238A6BC'

op: 'E8ED289DEBA952E4283B54E88E6183CA'

opType: 'OPC'

amf: '8000'

gnbSearchList: [127.0.0.1]

configured-nssai:

- sst: 3 # mMTC

default-nssai:

- sst: 3

sessions:

- type: 'IPv4'

apn: 'iot'

slice: {sst: 3}

EOF

# Start mMTC UE

$ ./build/nr-ue -c config/ue-mmtc.yaml

[nas] Allowed NSSAI: sst[3]

[nas] PDU Address: 10.47.0.2 (mMTC/IoT Pool)

15

Multi-Slice Testing & Isolation

Advanced

Run multiple UEs on different slices simultaneously and verify traffic isolation between slices.

Slice Isolation

Network slices must be isolated at multiple levels:
• Control Plane: Separate AMF/SMF instances per slice (optional).
• User Plane: Dedicated UPF or IP pools per slice.
• QoS: Different 5QI and ARP priorities per slice.
Verify isolation using separate IP pools and traffic monitoring.

Multi-Slice Verification

# Terminal 1: Start gNB

$ cd /opt/UERANSIM && ./build/nr-gnb -c config/open5gs-gnb.yaml

# Terminal 2: Start eMBB UE (SST=1)

$ ./build/nr-ue -c config/ue-embb.yaml

[nas] PDU Address: 10.45.0.2

# Terminal 3: Start URLLC UE (SST=2)

$ ./build/nr-ue -c config/ue-urllc.yaml

[nas] PDU Address: 10.46.0.2

# Terminal 4: Start mMTC UE (SST=3)

$ ./build/nr-ue -c config/ue-mmtc.yaml

[nas] PDU Address: 10.47.0.2

# Verify IP assignment per slice

$ ip addr | grep uesimtun

uesimtun0: inet 10.45.0.2/32 # eMBB

uesimtun1: inet 10.46.0.2/32 # URLLC

uesimtun2: inet 10.47.0.2/32 # mMTC

# Monitor slice traffic isolation

$ tcpdump -i ogstun -n 'net 10.45.0.0/16 or net 10.46.0.0/16 or net 10.47.0.0/16'

10.45.0.2 > 8.8.8.8: ICMP (eMBB traffic)

10.46.0.2 > 192.168.1.100: UDP (URLLC traffic)

10.47.0.2 > mqtt.example.com: TCP (mMTC/IoT traffic)

# Check NRF registered NFs by slice

$ curl -s /* SECURITY: Removed Direct IP:port connection *//nnrf-nfm/v1/nf-instances | \

jq '.[] | select(.nfType=="SMF") | {nfType, sNssais}'

{"nfType": "SMF", "sNssais": [{"sst": 1}, {"sst": 2}, {"sst": 3}]}