This post continues my blog series “Building a Telco Test Lab Using srsRAN”. In the previous chapter I verified the RAN setup using Testmode. Now we take the next step and attach a real UE using Open5GS as the core network. After that I’ll show the basics of how to optimize the RF parameters under load.
Set Up Open5GS
For this blog post I use Open5GS as the core network. It is FOSS and available on GitHub.
Installation
The easiest way to install Open5GS on Ubuntu is via apt. You can also build from source if you want the latest updates. We install both the base package and the WebUI. Follow the official documentation for the installation steps.
Configuration
If you installed Open5GS via apt, the default config paths are:
/etc/open5gs/amf.yaml/etc/open5gs/upf.yaml
Make sure the AMF and UPF configuration matches your gNB config. You must adjust the PLMN and TAC. Set them to 00101 and 7 respectivly. The rest can remain at their default values.
After updating the config restart the services:
sudo systemctl restart open5gs-amfd
sudo systemctl restart open5gs-upfdAdd Subscribers
Next, I add the SIM card details through the WebUI. For this post I use Sysmocom SJA2 SIMs. For programming them I use pysim.
These SIMs come with SUPI concealment enabled by default. To avoid issues during attach I disable SUPI concealment and adjust the PLMN to match 00101.
Read the current configuration:
./pySim-read.py -p0Write the SIM credentials:
./pySim-prog.py -p0 -s <ICCID> --mcc=<MCC> --mnc=<MNC> -a <ADM-KEY> --imsi=<IMSI> -k <KI> --opc=<OPC>Example:
./pySim-prog.py -p0 -s 12345678901234567890 --mcc=001 --mnc=01 -a 1234567890ABCDEF --imsi=001010123456789 -k ABCDEF1234567890ABCDEF1234567890 --opc=ABCDEF1234567890ABCDEF1234567890Verify:
./pySim-read.py -p0Disable SUPI concealment:
./pySIM-shell.py -p0
pySIM-shell (MF)> select MF
pySIM-shell (MF)> select ADF.USIM
pySIM-shell (MF/ADF.USIM)> select EF.UST
pySIM-shell (MF)> verify_adm <ADM-KEY>
pySIM-shell (MF/ADF.USIM/EF.UST)> ust_service_deactivate 124
pySIM-shell (MF/ADF.USIM/EF.UST)> ust_service_deactivate 125
./pySim-read.py -p0Verify:
./pySim-read.py -p0Important: Ensure the ADM key is correct. After three wrong attempts the SIM becomes permanently locked.
External Connections
If you want the UE to access the internet you must enable forwarding/NAT. Open5GS explains this in the documentation.
Attach the UE
Start the gNB the same way as in the Chapter 6. Dont forget to disable the testmode before!
sudo ./build/apps/gnb/gnb -c ~/srsran-gnb.yamlNow it’s time to attach the UE. After powering up the UE I sometimes need to initiate a manual cell search to find the cell. Once attached, the UE should appear in the gNB terminal. If not, press t + Enter in the gNB console window to enable the UE stdout metrics.
Remember to disable testmode, either comment it out completly or set the rnti to 0x0! With testmode enabled you will not able to attach an UE.
If the UE does not attach or cannot see the cell
Here are some common cases:
UE sees the cell but cannot attach
- Wrong SIM credentials → check AMF logs
- Incorrect slice configuration
- UE does not support the band/frequency
- PLMN blocked (e.g., iPhone blocks many test PLMNs)
UE cannot see the cell at all
- Check whether the RU is radiating using spectrum analyzer
- Misconfiguration in DU or RU → check logs and KPIs
- PLMN blacklisted due to RLF (remove/reinsert SIM)
UE attaches but disconnects after 30/60/90 seconds
- Disable IMS attach in the UE
UE attaches but has no internet
- APN mismatch
- Missing forwarding/NAT on the core side
About 90% of issues come from DU/RU misconfigurations. Repeat the testmode step if the UE cannot see the cell. Always monitor the logs, new warnings often point directly to the root cause.
Debugging DU or RU configurations in detail is out of scope for this post. I will cover this in another series.
Ping Test
After the UE attaches, the first step is to test connectivity. In the AMF logs you’ll see the UE’s assigned IP. You can simply ping it from the DU server.
Use the Aruba Utilities app to ping the core on the address 10.45.1.1.
Prepare the UE for Testing
Next I install iperf on the UE. One easy way on Adroid is through the Aruba Utilities app, which includes iperf3.
On Ubuntu install iperf3 like this:
sudo apt -y install iperf3RF Optimization (UL Power Control)
In this section I show how to optimize the UL RF parameters to improve throughput and stability under load.
The goal is to observe the UE and network KPIs under traffic. This reveals how the UE calculates pathloss and helps adjust the p0_nominal_with_grant parameter to stabilize the UL.
It is essential that the SSB block power is correctly set for the RU you are using. Make sure you have followed the steps in Chapter 6 to calculate and set this value.
Running iperf
On the UE in Aruba I navigate to the iperf3 tab and start a server by entering -s and pressing RUN.
On the core side I run the iperf3 client using UDP traffic. The current setup should reach around 1 Gbit/s over the air. I run 1 Gbit/s bidirectional traffic with 4 streams. You can obtain the UE’s IP from the AMF logs or the UE.
Example:
iperf3 -c 10.45.1.20 -u -b 1G -P 4 --bidirProcedure
Now after pushing traffic I analyze the stdout metrics and adjust the gNB config. I follow these steps:
- Restart the network and verify everything is up
- Attach the UE
- Push traffic via iperf
- Observe stdout (PUSCH SNR and UL RSRP)
- Increase or decrease
p0_nominal_with_grant
*The default value for p0_nominal_with_grant is -76.
My goal is:
- UL RSRP between −10 dB and −20 dB
- PUSCH SNR above −25 dB
Finding the optimal value often takes some trial and error. It is critical that no interference is present during these measurements.
For more details on p0_nominal_with_grant refer to the srsRAN Config Reference.
Summary
After testmode verification and UE attach you now have a fully working end-to-end RAN using srsRAN and Open5GS.
A lot can go wrong in real-time telco setups, and many people run into tiny configuration issues that break the whole chain. This mini-series is meant to give you a stable baseline. In an upcoming blog series I will go deeper into debugging methods and what to look for when the system refuses to behave. Stay tuned!
is there a way to check ue does not support specific frequent in the bands ?
A UE always supports all frequencies inside the supported bands. But sometimes you have to be careful because there are different ROMs and versions that are for example only for EU or US but would not work in China for example. Unfortunately, there are no general instructions to check this. But if you google a little you will find what you need!