Description
The Non-3GPP InterWorking Function (N3IWF) is a critical network function within the 5G Core (5GC) architecture, specifically defined to integrate untrusted non-3GPP access networks. Untrusted non-3GPP access refers primarily to access technologies not specified by 3GPP, such as Wi-Fi, which are considered untrusted from a 5G Core security perspective. The N3IWF serves as the secure point of entry for User Equipment (UE) connecting via such access, establishing itself as a termination point within the operator's trusted domain.
Architecturally, the N3IWF interfaces with the UE over the NWu reference point, which utilizes IKEv2 and IPsec protocols to establish secure tunnels. This ensures confidentiality and integrity for user plane traffic and signaling between the UE and the 5GC. On the network side, the N3IWF connects to other 5GC Network Functions via standard interfaces: it connects to the Access and Mobility Management Function (AMF) over the N2 interface for control plane signaling (e.g., registration, authentication) and to the User Plane Function (UPF) over the N3 interface for user data transfer. This allows the UE to be treated as if it were connected via 3GPP radio access, enabling consistent service continuity and policy enforcement.
The N3IWF's operation involves several key procedures. During initial attachment, the UE discovers an N3IWF and performs IKEv2 authentication and IPsec Security Association (SA) establishment, often leveraging 5G authentication credentials (e.g., from a USIM). The N3IWF then relays the UE's NAS messages (encapsulated within the IPsec tunnel) to the AMF over N2. For user plane, the N3IWF decapsulates incoming IPsec packets from the UE and forwards the inner IP packets to the UPF over a GTP-U tunnel on N3, and vice versa. It also plays a role in supporting mobility events, such as handovers between 3GPP and non-3GPP access.
Key components within the N3IWF's logical design include the termination points for IKEv2 and IPsec, the relay function for N1/N2 NAS signaling, and the GTP-U endpoint for the N3 interface. Its role is fundamental in realizing the 5G vision of access-agnostic service delivery, allowing operators to leverage existing Wi-Fi infrastructure to offload traffic, enhance coverage, and provide a seamless user experience without compromising 5G security and service standards.
Purpose & Motivation
The N3IWF was introduced in 3GPP Release 15 as part of the new 5G System (5GS) architecture to solve the critical problem of integrating non-3GPP access networks into the 5G core in a secure and standardized manner. Prior to 5G, integration of Wi-Fi with cellular networks was handled through separate, often proprietary gateways (like ePDG in EPS for untrusted Wi-Fi) that were not fully aligned with the cloud-native, service-based principles of 5GC. The motivation was to create a unified core that could deliver consistent services, security, and policies regardless of the underlying access technology (3GPP or non-3GPP).
Historically, non-3GPP access (especially untrusted Wi-Fi) presented security risks and management complexities. The N3IWF addresses these by providing a standardized, secure interworking function that applies the same robust 5G authentication and security mechanisms (like 5G-AKA or EAP-AKA') to non-3GPP connections. It solves the problem of access fragmentation, enabling seamless session continuity and service-based architecture exposure for devices connecting via Wi-Fi. This was driven by the industry need to leverage dense Wi-Fi deployments for capacity augmentation, indoor coverage, and fixed wireless access scenarios within the 5G service framework.
Furthermore, the creation of the N3IWF was motivated by the limitation of previous interworking solutions which were often bolt-ons to the core network. In 5G, the N3IWF is a first-class citizen within the SBA, interacting with the AMF and UPF via service-based interfaces. This allows for more flexible deployment, better scalability, and integrated policy control, fulfilling the 5G requirement for convergence of fixed and mobile networks.
Architecture
In the Network Map
- Mobile Network → 5G Core → N3IWF (Access Networks)
Classification
Release Timeline
Detected Changes Across Releases
from 3GPP Change RequestsSpecific changes extracted from the „Change history“ tables of 3GPP specifications (71 CRs across 6 releases). Complements the general historical overview above with the evidence-based evolution of this function.
In Release 15, the N3IWF was introduced as the new function to connect untrusted non-3GPP access networks, like WLAN, to the 5G Core Network. It interfaces with the core network via the N2 and N3 interfaces and establishes a secure IPsec tunnel (over the NWu reference point) with the UE for control and user plane traffic. The release also defined its selection procedures and its role in interworking scenarios, including architectures for roaming and interworking with EPC/E-UTRAN.
- Interworking between E-UTRAN/EPC and N3IWF/5GCN TS 24.501CR0176
- Corrections to Combined N3IWF/ePDG Selection TS 23.501CR0057
- UE unable to use N3IWF identifier configuration in stand-alone N3IWF selection TS 23.501CR0630
- Using TCP for reliable NAS transport between UE and N3IWF TS 23.501CR0692
- Resolution of editor's note on the information the N3IWF maintains for a registered UE TS 24.501CR0703
- Correction of N3IWF key TS 29.413CR0004
In Release 16, the N3IWF was enhanced to support new selection and access procedures for Standalone Non-Public Networks (SNPNs) and PLMNs, including the configuration of an N3IWF FQDN in the UE for such access. The release also introduced mechanisms for improved reliability, such as enabling the N3IWF to initiate a TCP connection establishment upon failure and extending congestion notification to cover N3IWF overload. Furthermore, it specified the construction of packet filters based on the N3IWF's IP address and the SPI for the IPsec security association.
- FQDN format of N3IWF in a standalone non-public network TS 23.501CR0841
- Packet filters based on N3IWF IP address and SPI for IPsec SA TS 24.501CR1231
- N3IWF FQDN configured in a UE to support access to PLMN/SNPN services via SNPN/PLMN TS 24.502CR0079
- Clarifying N3IWF access to SNPN TS 23.501CR1751
- N3IWF selection procedure when accessing SNPN via PLMN TS 23.501CR2521
- Update of requirements on UE to construct packet filters based on the N3IWF destination IP address and the SPI for the IPsec SA TS 24.501CR1364
+ 5 more changes
In Release 17, the enhancements for the N3IWF focused on refining its selection procedures. This included specific updates for emergency services access, for accessing SNPN services via a PLMN, and for scenarios involving N3SLICE. Additionally, the release provided an informative guideline for supporting session continuity between SNPN and PLMN when using N3IWF.
- Informative guideline on supporting session/service continuity between SNPN and PLMN when using N3IWF TS 23.501CR2563
- Update to N3IWF selection for N3SLICE TS 23.501CR2662
- N3IWF selection for emergency services TS 24.502CR0194
- FQDNs for N3IWF selection for emergency services TS 23.501CR2848
- Correction to the N3IWF selection procedure TS 23.501CR2723
- Layer below IPsec to enable NAT traversal for TNGF/N3IWF access TS 23.501CR3442
+ 2 more changes
In Release 18, the N3IWF was enhanced to support network slice-aware selection, allowing the UE and network to consider Single Network Slice Selection Assistance Information (S-NSSAI) during the N3IWF selection procedure. This included new mechanisms for the UE to indicate its support for this feature, for the network to reject a registration if the selected N3IWF is incompatible with the allowed or needed slices, and to protect N3IWF identifier information in Registration Reject messages. The release also introduced updates for selection based on prefixed identifiers, support for specific services like IMS and onboarding, and procedures for N3IWF relocation.
- N3IWF selection enhancement for support of S-NSSAI needed by UE TS 23.501CR3707
- N3IWF with slice capability TS 24.501CR4877
- UE to indicate its support for Slice-based N3IWF selection to the network TS 24.501CR4961
- Rejecting the UE Registration due to the selected N3IWF by the UE is not compatible with the used slices TS 24.501CR4963
- Aborting registration procedure when the selected N3IWF is not compatible with the allowed NSSAI TS 24.501CR5119
- Protecting the N3IWF/TNGF identifier information in the REGISTRATION REJECT message TS 24.501CR5932
+ 37 more changes
In Release 19, enhancements for the N3IWF included a specific procedure for handling an unprotected REGISTRATION REJECT message with certain cause codes related to NSSAI compatibility. Furthermore, the release introduced corrections to the N3IWF selection process that a UE performs when connecting via untrusted non-3GPP access.
In Release 20, the N3IWF was enhanced to support reselection procedures that consider energy-related information, allowing for more efficient network function selection based on power consumption or energy efficiency criteria. This new capability applies to the selection process between the N3IWF and the TNGF (Trusted Non-3GPP Gateway Function) when a UE connects via non-3GPP access. The update integrates these energy considerations into the existing independent selection mechanisms for the PLMN/SNPN and the interworking function.
- N3IWF/TNGF reselection considering energy related information. TS 23.501CR6493
Explore further
Broader topics and technologies where N3IWF plays a role.
Defining Specifications
3GPP specifications that define or reference N3IWF, with the latest known release. Sourced from the 3GPP document catalog — see methodology.
| Specification | Title | Release |
|---|---|---|
| TS 23.501 vk00 | 5G System Architecture Stage 2 | Rel-20 |
| TS 24.501 vj50 | 5G NAS Protocols Specification | Rel-19 |
| TS 24.502 vj20 | 5G Core Access via Non-3GPP Networks; Stage 3 | Rel-19 |
| TS 24.526 vj30 | UE Policies for 5GS; Stage 3 | Rel-19 |
| TS 24.890 vg00 | 5G NAS Protocol for 5GS Stage 3 | Rel-16 |
| TR 28.828 vi00 | Charging Aspects for Non-Public Networks | Rel-18 |
| TS 29.214 vj20 | Policy and Charging Control over Rx | Rel-19 |
| TS 29.413 vj00 | NGAP for Non-3GPP Access | Rel-19 |
| TS 29.518 vj50 | AMF Service Based Interface Protocol | Rel-19 |
| TS 29.525 vj40 | 5G UE Policy Control Service Stage 3 | Rel-19 |
| TS 29.561 vj30 | 5G Interworking with External Data Networks | Rel-19 |
| TS 32.255 vk10 | Telecom Management; Charging for 5G Data Connectivity | Rel-20 |
| TS 32.256 vj40 | 5G Connection & Mobility Charging Spec | Rel-19 |
| TS 33.127 vj50 | Lawful Interception Architecture and Functions | Rel-19 |
| TS 33.501 vk00 | 5G Security Architecture and Procedures | Rel-20 |
| TS 38.413 vj10 | NG Application Protocol (NGAP) | Rel-19 |
