[free5GC] UE registration failed: UE security capabilities mismatch.

[s5uishida]

Hi,

It worked in Open5GS v2.7.0, but I got an error registering the UE in the main branch of free5GC v3.3.0.

config.yml)

gnodeb:
  controlif:
    ip: "192.168.66.130"
    port: 9487
  dataif:
    ip: "192.168.13.130"
    port: 2152
  plmnlist:
    mcc: "001"
    mnc: "01"
    tac: "000001"
    gnbid: "000001"
  slicesupportlist:
    sst: "01"
    sd: "010203"

ue:
  msin: "0000000000"
  key: "8baf473f2f8fd09487cccbd7097c6862"
  opc: "8e27b6af0e692e750f32667a3b14605d"
  amf: "8000"
  sqn: "00000000"
  dnn: "internet"
  routingindicator: "0000"
  hplmn:
    mcc: "001"
    mnc: "01"
  snssai:
    sst: 01
    sd: "010203"
  integrity:
    nia0: false
    nia1: false
    nia2: true
    nia3: false
  ciphering:
    nea0: false
    nea1: false
    nea2: true
    nea3: false
amfif:
  ip: "192.168.66.141"
  port: 38412
logs:
    level: 4

error messages)

# ./packetrusher ue
INFO[0000] PacketRusher version 1.0.1                   
INFO[0000] ---------------------------------------      
INFO[0000] [TESTER] Starting test function: Testing an ue attached with configuration 
INFO[0000] [TESTER][UE] Number of UEs: 1                
INFO[0000] [TESTER][UE] disableTunnel is false          
INFO[0000] [TESTER][GNB] Control interface IP/Port: 192.168.66.130/9487 
INFO[0000] [TESTER][GNB] Data interface IP/Port: 192.168.13.130/2152 
INFO[0000] [TESTER][AMF] AMF IP/Port: 192.168.66.141/38412 
INFO[0000] ---------------------------------------      
INFO[0000] [GNB] SCTP/NGAP service is running           
INFO[0000] [GNB] Initiating NG Setup Request            
INFO[0000] [GNB][SCTP] Receive message in 0 stream      
INFO[0000] [GNB][NGAP] Receive NG Setup Response        
INFO[0000] [GNB][AMF] AMF Name: AMF                     
INFO[0000] [GNB][AMF] State of AMF: Active              
INFO[0000] [GNB][AMF] Capacity of AMF: 255              
INFO[0000] [GNB][AMF] PLMNs Identities Supported by AMF -- mcc: 001 mnc:01 
INFO[0000] [GNB][AMF] List of AMF slices Supported by AMF -- sst:01 sd:010203 
INFO[0000] [GNB][AMF] List of AMF slices Supported by AMF -- sst:01 sd:112233 
INFO[0001] [TESTER] TESTING REGISTRATION USING IMSI 0000000000 UE 
INFO[0001] [UE] Initiating Registration                 
INFO[0001] [UE] Switched from state 0 to state 1        
INFO[0001] [GNB][SCTP] Receive message in 0 stream      
INFO[0001] [GNB][NGAP] Receive Downlink NAS Transport   
INFO[0001] [UE][NAS] Message without security header    
INFO[0001] [UE][NAS] Receive Authentication Request     
INFO[0001] [UE][NAS][MAC] Authenticity of the authentication request message: OK 
INFO[0001] [UE][NAS][SQN] SQN of the authentication request message: VALID 
INFO[0001] [UE][NAS] Send authentication response       
INFO[0001] [UE] Switched from state 1 to state 2        
INFO[0001] [GNB][SCTP] Receive message in 0 stream      
INFO[0001] [GNB][NGAP] Receive Downlink NAS Transport   
INFO[0001] [UE][NAS] Message without security header    
ERRO[0001] [UE][NAS] Receive Registration Reject        
ERRO[0001] [UE][NAS] UE received a 5GMM Failure, cause: UE security capabilities mismatch 

Could you know the cause?

Best regards,

--Shigeru

[linouxis9]

Hi @s5uishida!

Nice to see you using PacketRusher :-)
The error "UE security capabilities mismatch" happens when the AMF and the UE do not have any integrity or ciphering algorithms enabled in common.
In your current configuration, you only have NIA2/NEA2 enabled, but on ciphering's side you probably only have NEA0 enabled in your AMF to be able to see the unencrypted NAS messages in the pcap. If, I were you, I would try to set NEA0 at true in PacketRusher :-)

Thanks a lot for trying PacketRusher!
Best regards,
Valentin

[s5uishida]

Hi @linouxis9

Thank you for your quick reply. It worked with free5GC.

When I executed iperf3 between UE-VM (PacketRusher) and Data Network GW-VM on Virtualbox, the result was as follows.
The scenario is below.

https://github.com/s5uishida/free5gc_ueransim_vpp_upf_dpdk_sample_config

TCP)

# ip vrf exec vrf0000000000 iperf3 -c 192.168.16.152
Connecting to host 192.168.16.152, port 5201
[  6] local 10.60.0.1 port 44774 connected to 192.168.16.152 port 5201
[ ID] Interval           Transfer     Bitrate         Retr  Cwnd
[  6]   0.00-1.00   sec   173 MBytes  1.45 Gbits/sec   99    353 KBytes       
[  6]   1.00-2.00   sec   170 MBytes  1.42 Gbits/sec   54    288 KBytes       
[  6]   2.00-3.00   sec   172 MBytes  1.44 Gbits/sec   66    243 KBytes       
[  6]   3.00-4.00   sec   176 MBytes  1.48 Gbits/sec   93    251 KBytes       
[  6]   4.00-5.00   sec   175 MBytes  1.47 Gbits/sec   29    354 KBytes       
[  6]   5.00-6.00   sec   172 MBytes  1.45 Gbits/sec   86    346 KBytes       
[  6]   6.00-7.00   sec   174 MBytes  1.46 Gbits/sec  138    254 KBytes       
[  6]   7.00-8.00   sec   172 MBytes  1.44 Gbits/sec   86    263 KBytes       
[  6]   8.00-9.00   sec   175 MBytes  1.47 Gbits/sec   29    359 KBytes       
[  6]   9.00-10.00  sec   172 MBytes  1.44 Gbits/sec  102    262 KBytes       
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Retr
[  6]   0.00-10.00  sec  1.69 GBytes  1.45 Gbits/sec  782             sender
[  6]   0.00-10.00  sec  1.69 GBytes  1.45 Gbits/sec                  receiver

iperf Done.

Accepted connection from 10.60.0.1, port 44768
[  5] local 192.168.16.152 port 5201 connected to 10.60.0.1 port 44774
[ ID] Interval           Transfer     Bitrate
[  5]   0.00-1.00   sec   171 MBytes  1.43 Gbits/sec                  
[  5]   1.00-2.00   sec   169 MBytes  1.42 Gbits/sec                  
[  5]   2.00-3.00   sec   172 MBytes  1.45 Gbits/sec                  
[  5]   3.00-4.00   sec   175 MBytes  1.47 Gbits/sec                  
[  5]   4.00-5.00   sec   176 MBytes  1.47 Gbits/sec                  
[  5]   5.00-6.00   sec   172 MBytes  1.44 Gbits/sec                  
[  5]   6.00-7.00   sec   174 MBytes  1.46 Gbits/sec                  
[  5]   7.00-8.00   sec   172 MBytes  1.44 Gbits/sec                  
[  5]   8.00-9.00   sec   175 MBytes  1.47 Gbits/sec                  
[  5]   9.00-10.00  sec   172 MBytes  1.45 Gbits/sec                  
[  5]  10.00-10.00  sec   128 KBytes   401 Mbits/sec                  
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate
[  5]   0.00-10.00  sec  1.69 GBytes  1.45 Gbits/sec                  receiver

UDP)

# ip vrf exec vrf0000000000 iperf3 -c 192.168.16.152 -u -b 300M
Connecting to host 192.168.16.152, port 5201
[  6] local 10.60.0.1 port 54043 connected to 192.168.16.152 port 5201
[ ID] Interval           Transfer     Bitrate         Total Datagrams
[  6]   0.00-1.00   sec  29.6 MBytes   248 Mbits/sec  21953  
[  6]   1.00-2.00   sec  30.1 MBytes   253 Mbits/sec  22371  
[  6]   2.00-3.00   sec  29.3 MBytes   246 Mbits/sec  21778  
[  6]   3.00-4.00   sec  30.1 MBytes   252 Mbits/sec  22320  
[  6]   4.00-5.00   sec  30.9 MBytes   259 Mbits/sec  22921  
[  6]   5.00-6.00   sec  30.7 MBytes   257 Mbits/sec  22770  
[  6]   6.00-7.00   sec  29.8 MBytes   250 Mbits/sec  22157  
[  6]   7.00-8.00   sec  29.6 MBytes   248 Mbits/sec  21977  
[  6]   8.00-9.00   sec  31.6 MBytes   265 Mbits/sec  23455  
[  6]   9.00-10.00  sec  30.6 MBytes   256 Mbits/sec  22693  
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Jitter    Lost/Total Datagrams
[  6]   0.00-10.00  sec   302 MBytes   253 Mbits/sec  0.000 ms  0/224395 (0%)  sender
[  6]   0.00-10.00  sec   302 MBytes   253 Mbits/sec  0.043 ms  85/224390 (0.038%)  receiver

iperf Done.

Accepted connection from 10.60.0.1, port 46108
[  5] local 192.168.16.152 port 5201 connected to 10.60.0.1 port 54043
[ ID] Interval           Transfer     Bitrate         Jitter    Lost/Total Datagrams
[  5]   0.00-1.00   sec  29.5 MBytes   248 Mbits/sec  0.016 ms  17/21947 (0.077%)  
[  5]   1.00-2.00   sec  30.1 MBytes   253 Mbits/sec  0.011 ms  0/22371 (0%)  
[  5]   2.00-3.00   sec  29.3 MBytes   246 Mbits/sec  0.018 ms  0/21777 (0%)  
[  5]   3.00-4.00   sec  30.0 MBytes   251 Mbits/sec  0.012 ms  67/22321 (0.3%)  
[  5]   4.00-5.00   sec  30.9 MBytes   259 Mbits/sec  0.016 ms  1/22920 (0.0044%)  
[  5]   5.00-6.00   sec  30.7 MBytes   257 Mbits/sec  0.018 ms  0/22771 (0%)  
[  5]   6.00-7.00   sec  29.8 MBytes   250 Mbits/sec  0.017 ms  0/22156 (0%)  
[  5]   7.00-8.00   sec  29.6 MBytes   248 Mbits/sec  0.011 ms  0/21978 (0%)  
[  5]   8.00-9.00   sec  31.6 MBytes   265 Mbits/sec  0.006 ms  0/23455 (0%)  
[  5]   9.00-10.00  sec  30.6 MBytes   256 Mbits/sec  0.025 ms  0/22692 (0%)  
[  5]  10.00-10.00  sec  2.76 KBytes  54.6 Mbits/sec  0.043 ms  0/2 (0%)  
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Jitter    Lost/Total Datagrams
[  5]   0.00-10.00  sec   302 MBytes   253 Mbits/sec  0.043 ms  85/224390 (0.038%)  receiver

Thank you very much!

[linouxis9]

Thanks for sharing your results @s5uishida!
Please note that you can run whatever you want through the tunnel, not necessarily only iperf3 traffic. In our testing, we even ran Firefox through tunnel and tried to watch Youtube videos and do online speed tests.
The speed you get is pretty much what to expect without the usage of PCI-E Passthrough, in our testing, we needed PCI-E passthrough of the N2/N3 device to reach 5 GB/s of TCP traffic per UE. It all depends on the UPF you use as well :-)
Another tip: To avoid writing ip vrf exec vrf0000000000 command everytime you want to run a command in the context of the UE/VRF, you can run ip vrf exec vrf0000000000 bash, and then all the commands in the new shell will use the tunnel.

[s5uishida]

Hi @linouxis9

Thank you for the very useful tips. From now on, I would like to try various things with this tool.

Thank you very much again for your excellent tool!