The Inter-Public Land Mobile Network (Inter-PLMN) mobility feature allows the PLMN to change from home-PLMN to visited-PLMN when a UE moves from its home network to a visited network and vice-versa. This feature provides support for various types of inter-PLMN mobility scenarios.

For more information, refer to the UCC 5G UPF Configuration and Administration Guide > Roaming Support chapter.

UPF supports IP separation per interface to allow separate networks for N3 and N9 interfaces.

With this release, UPF supports different GTP-U ingress interfaces to allow N3, N9, S5u, and S8u interfaces. These interfaces share the same public IP. The associate gtpu-service CLI command in the User Plane Service configuration mode is enhanced to support multiple GTP-U ingress interfaces.

The supported GTP-U ingress interfaces include:

• N3—N3 is the interface between gNodeB and UPF.

• N9—The N9 interface connects two UPFs. It is the interface between intermediate I-UPF and UPF session anchor connecting different PLMNs.

• S5u—S5u is similar to the N9 interface that connects two UPFs. It is the interface between intermediate I-UPF and UPF session anchor.

• S8u—S8u is an inter-PLMN variant of the S5u interface.

For more information, refer to the UCC 5G UPF Configuration and Administration Guide > UPF Ingress Interfaces chapter.

UPF supports the Security Group Tag (SGT) to specify the privileges of a traffic source within a trusted network. Security Group Access (a feature of both Cisco TrustSec and Cisco ISE) automatically generates the SGT when a user adds a security group in TrustSec or ISE.

Note	Security Group Tag (SGT) is also referred to as Scalable Group Tag.

The Identity Services Engine (ISE) sends SGT values over the RADIUS interface that are propagated over the N6 interface. The SGT value must be checkpointed for both session recovery and ICSR/GR scenarios for availability to the peer session manager.

For more information, refer to the UCC 5G UPF Configuration and Administration Guide > Security Group Tag Support chapter.

UPF supports enabling the subscriber tracing based on the SMF configurations through a private IE.

For more information, refer to the UCC 5G UPF Configuration and Administration Guide > Monitor Subscriber chapter.

When you deploy cnUPF or cnMME, ensure that you create at least one user in the VPC Ops-center. The user credentials are mandatory for UPF deployment.

Previous Behavior: The username and password credentials were optional for UPF deployment.

New Behavior: To configure a UPF deployment, it is mandatory to enter the username and password or SSH public key.

UPF supports spoofing detection and provides protection against attacks, when an external portal is used for subscriber or content authorization.

This feature is disabled by default and can be enabled using the delete-existing CLI command in the Active Charging Service Configuration mode.

For more information, refer to the the UCC 5G UPF Configuration and Administration Guide > X-Header Insertion and Encryption chapter.