APN (Access Point Name)

An APN, or Access Point Name, is the name a device gives the mobile network when it starts a data connection. It tells the network which gateway to use between the device and the outside world. Everything about the connection follows from that choice.

What the APN decides

The gateway behind an APN controls:

• the IP address the device gets, and whether it’s IPv4, IPv6 or both;
• where the traffic goes, for example out to the public internet or into a company’s private network;
• what is filtered or blocked, such as inbound connections or certain destinations;
• which services apply, such as a fixed IP address or a VPN.

So two SIMs on the same mobile network can behave quite differently, simply because they use different APNs.

Default and configured APNs

Every SIM has a subscription that lists the APNs it’s allowed to use. One of them is the default. On 4G and 5G, if the device doesn’t ask for an APN, the network uses the default.

Many devices are set up with a specific APN instead. This is common where the SIM provider gives one APN name for all customers, or where a business uses its own private APN.

What goes wrong

If a device asks for an APN that its subscription doesn’t include, or that the network can’t find, the network will often refuse the data connection, unless the subscription allows any APN. On 4G this can stop the device registering at all, so it shows signal but isn’t registered. A spelling mistake in the APN is one of the most common reasons a new device won’t connect.

Some APNs also need a username and password. Others ignore them.

When the device is roaming

When a device roams abroad, its data is usually sent back to a gateway in the home network. The APN, the IP address and the rules stay the same in every country. The trade-off is that traffic travels further, which adds some delay.

To see how addresses and inbound access work behind the gateway, read CGNAT and static IP. For private networks, read Private APN and VPN.

Structure of an APN

TS 23.003 clause 9 defines an APN as two parts.

• The APN Network Identifier (APN-NI) names the external network the gateway connects to, and can also name a service. It is mandatory. It has at least one label and is at most 63 octets once encoded. It must not end in .gprs, must not start with rac, lac, sgsn or rnc, and must not be *.
• The APN Operator Identifier (APN-OI) names the PLMN whose packet core holds the gateway. It is optional in what the device sends. Its default form is derived from the IMSI as mnc<MNC>.mcc<MCC>.gprs, with the MNC padded to three digits. A UK operator with MNC 15 has the default APN-OI mnc015.mcc234.gprs.

The full APN is at most 100 octets. Labels follow DNS rules, and case is not significant. A device normally sends only the APN-NI, for example internet, and the network adds the operator identifier.

What the APN selects

In EPS (4G) the APN selects the PDN gateway (PGW). The MME builds a DNS name from the APN and resolves it to find the gateway. For EPC the name takes the form <APN-NI>.apn.epc.mnc<MNC>.mcc<MCC>.3gppnetwork.org (TS 23.003 clause 19.4.2.2), so internet.mnc015.mcc234.gprs becomes internet.apn.epc.mnc015.mcc234.3gppnetwork.org.

In 5GS the equivalent is the Data Network Name (DNN). TS 23.003 clause 9A states that the DNN is equivalent to an APN in EPS. The AMF uses the DNN, with the network slice, to select an SMF, and the SMF selects the UPF that carries the user traffic (TS 23.501).

The gateway then decides:

• how the IP address is allocated, from a pool, by fixed assignment against the subscription, or by an external server such as RADIUS;
• where traffic is routed, to the internet through NAT, or over a tunnel to a customer network;
• filtering, firewall rules and charging;
• the policy applied to the connection.

Default APN and subscription checks

The subscriber’s profile in the HSS (UDM in 5G) lists the APNs the SIM may use and marks one as default. A wildcard entry allows any APN.

On LTE the device gets a default bearer when it attaches, so it asks for a PDN connection as part of the attach. If it gives no APN, the MME uses the default APN from the subscription. TS 27.007 says the same at the device end: an empty APN in +CGDCONT means the subscription value is requested.

If the device asks for an APN the subscription doesn’t include, or one that cannot be resolved, the network rejects the PDN connection with ESM cause #27 “missing or unknown APN” (TS 24.301). Other causes point elsewhere. #33 “requested service option not subscribed” points to the subscription. Because the PDN connection is part of the LTE attach, the whole attach can fail. To the user this looks like a device that will not register. A device that supports attach without a PDN connection, an option added for cellular IoT in Release 13, can register and then fail only the data session.

Setting the APN on a module

TS 27.007 clause 10.1.1 defines +CGDCONT:

AT+CGDCONT=1,"IPV4V6","internet"

The three main arguments are the context identifier, the PDP type and the APN. TS 27.007 also defines an initial PDP context, <cid> 0, which some modules use for the LTE attach. Check which context your module uses at attach and set the APN there.

Usernames and passwords are set with +CGAUTH (TS 27.007 clause 10.1.31). The authentication protocol is 0 for none, 1 for PAP or 2 for CHAP. The credentials travel to the gateway in the protocol configuration options, and the gateway checks them, often against a RADIUS server. Public APNs commonly ignore them. A private APN can use them to identify the device. A failed check returns ESM cause #29 “user authentication or authorization failed”.

PDP types

If the device asks for IPV4V6 and the network supports only one version, it accepts the connection with ESM cause #50 “PDN type IPv4 only allowed” or #51 “PDN type IPv6 only allowed”. The device then works with the address it was given. TS 27.007 also lists Non-IP for EPS, used by some NB-IoT services that carry data without an IP stack.

APNs and roaming

When a device roams, the visited network’s MME or AMF selects the gateway. TS 23.003 describes two cases.

• Home routed. The default APN-OI points to the home network, so the gateway is in the home PLMN. Traffic is tunnelled back over the S8 interface in 4G. The address, routing and policy are the same in every country. This is the usual arrangement for IoT SIMs.
• Regional breakout. Some providers run gateways in several regions, so home-routed traffic leaves the mobile network near the device rather than in the home country.
• Local breakout. Where the subscription allows it, the visited network’s gateway is used and the APN-OI is built from the visited network’s PLMN ID. Latency is shorter, but the address and policy belong to the visited operator.

Home routing adds the round trip to the home gateway to every packet. Allow for it in timeouts where latency matters.

Practical points for IoT

• Set the APN on the context the module uses at attach, and read it back after a firmware update.
• Use the PDP type your provider specifies. IPV4V6 is the usual choice where both versions are offered.
• Log the ESM cause on failure. Causes #27, #29 and #33 point to the APN, the credentials and the subscription in turn.
• Keep the same APN across countries when the SIM is home routed.

For addressing behind the gateway, see CGNAT and static IP. For private networks, see Private APN and VPN and roaming.