IPv6 and QoS Policy Design for Multi-Agency Tactical 5G Roaming and Handover

Tactical 5G roaming across military, interagency, and expeditionary domains introduces a class of design problems that general 5G architecture guidance does not fully address. When a device moves from one administrative domain to another, the network must preserve session continuity, enforce the correct subscriber policy, maintain traffic priority, and route packets correctly, all without requiring the user or the mission system to intervene. Getting that right demands deliberate design decisions at the addressing layer, the policy layer, and the routing layer before the first device ever moves.

IPv6 is not optional in this context. DoD and federal mandates have pushed IPv6 adoption for years, but the more immediate driver in tactical 5G is functional. IPv6 prefix delegation, stateless address autoconfiguration, and the address space available in a 128-bit scheme make it practical to assign stable, routable identities to subscriber equipment across disaggregated radio access networks and multiple core instances. Without a coherent IPv6 prefix strategy, roaming handover becomes an addressing problem before it becomes anything else.

Quality of service behavior compounds the challenge. Each administrative domain typically maintains its own traffic classification scheme, its own DSCP markings, and its own enforcement policies. When a device crosses a domain boundary, those policies do not automatically translate. Mission-critical voice, command and control traffic, and sensor feeds can lose their priority treatment the moment they traverse a partner network segment that does not recognize the originating domain’s markings.

This article addresses the implementation decisions that govern how subscriber identity, IPv6 addressing, route advertisement, QoS class mapping, and session continuity should be designed for tactical 5G environments where devices move between cells, partner networks, and temporary coverage zones. The focus is on what happens at the boundary between domains, not on general 5G core architecture or slice design.

IPv6 Prefix Strategy for Tactical Roaming Environments

The first design decision in any multi-domain tactical 5G roaming architecture is how IPv6 prefixes are assigned, delegated, and anchored. This decision cascades into routing, session continuity, and policy enforcement. Getting it wrong early means rearchitecting under operational pressure later.

In a single-domain deployment, prefix delegation is relatively straightforward. The 5G core assigns a prefix to the user equipment through the PDU session establishment process, and the UPF anchors the session. In a multi-domain environment, the question becomes which domain owns the prefix, where the anchor lives, and what happens when the device moves to a visited network that does not control the home prefix space.

Two broad approaches exist. The first is home-routed addressing, where the device retains its home-domain prefix regardless of which radio access network it is attached to. Traffic routes back through the home UPF, which maintains session continuity but introduces latency and creates a dependency on the backhaul path between the visited and home domains. In expeditionary environments where that backhaul is a constrained SATCOM or tactical radio link, this approach can degrade mission-critical application performance.

The second approach is local breakout, where the visited domain assigns a prefix from its own address space and routes traffic locally. This reduces latency and backhaul dependency but requires the visited domain to enforce the home domain’s subscriber policy, which demands a federated policy framework that many tactical deployments do not yet have in place. It also means the device’s IP address changes on handover, which breaks stateful application sessions unless the application layer or a session border function handles the transition.

A hybrid model, where control plane signaling remains home-routed but user plane traffic breaks out locally through a visited UPF, offers a middle path. This is architecturally consistent with the ULCL and multi-homed PDU session concepts in 3GPP Release 16 and later. The practical challenge is that the edge infrastructure in most tactical deployments is not yet mature enough to support dynamic UPF insertion and traffic steering without manual configuration.

Prefix aggregation discipline matters as much as the delegation model. Each domain should advertise a summarized prefix block at its boundary rather than leaking host routes or per-subscriber prefixes into the interdomain routing fabric. Failure to enforce this creates route table bloat that degrades convergence time and complicates troubleshooting during handover events.

Subscriber Identity and Policy Enforcement Across Domains

Subscriber identity in 5G is anchored to the SUPI, the Subscription Permanent Identifier, which the network resolves to a SUCI during authentication to protect the subscriber’s identity over the air. In a single-operator environment, the UDM holds subscriber profile data and the PCF enforces policy based on that profile. In a multi-agency tactical environment, neither the UDM nor the PCF is necessarily shared across domains.

When a device from Agency A roams into a network operated by Agency B, Agency B’s network needs enough information about that subscriber to apply appropriate policy. This requires either a federated identity model, where a shared or interconnected UDM can respond to subscriber queries from the visited network, or a pre-provisioned roaming agreement where subscriber profiles are replicated or summarized in the visited domain’s policy infrastructure before the device arrives.

Pre-provisioning is operationally simpler but creates a synchronization problem. If the home domain updates a subscriber’s policy, the visited domain’s copy may be stale. In a mission environment where traffic priority assignments reflect current operational roles, a stale policy can mean that a subscriber who has been elevated to a command-priority tier is still being treated as a standard user in the visited network.

Federated identity lookup solves the synchronization problem but requires network connectivity between the visited PCF or SMF and the home UDM at the time of session establishment. In degraded or disconnected environments, this dependency becomes a single point of failure for roaming session setup. The design must account for what happens when that lookup fails: does the visited network deny the session, apply a default policy, or cache the last known profile?

Handover Continuity and Session Anchor Design

Handover continuity in a single-domain 5G network is managed through the Xn interface between gNBs for intra-AMF handover, or through the N2 interface with AMF coordination for inter-AMF handover. Both paths are well-defined in 3GPP specifications. The problem in multi-domain tactical environments is that those interfaces typically do not extend across administrative boundaries. The visited network’s AMF and the home network’s AMF are separate systems, often operated by different organizations with different software versions and different configuration baselines.

This means that what looks like a handover from the device’s perspective is actually a detach and reattach sequence from the network’s perspective. The device loses its PDU session, re-authenticates, and establishes a new session in the visited domain. For applications that maintain persistent connections, this is disruptive. For mission systems that rely on continuous data feeds, it can cause data loss or require manual reconnection procedures.

Session Anchor Placement

Reducing the impact of inter-domain handover requires deliberate session anchor placement. If the UPF anchor is positioned at a point in the network that both domains can reach without traversing the domain boundary, the user plane session can survive the control plane transition. This is the principle behind the N9 interface between UPFs in a home-routed architecture. The visited UPF forwards traffic to the home UPF, which maintains the session anchor and the assigned prefix.

The practical constraint is that this architecture requires the N9 tunnel between UPFs to be established and maintained across the domain boundary, which requires IP reachability, firewall policy coordination, and often a dedicated transport path that is not always available in expeditionary environments. When that path is unavailable, the fallback is a full session re-establishment, and the design must ensure that re-establishment happens quickly enough to avoid mission impact.

Minimizing Re-establishment Latency

Re-establishment latency is driven by authentication round-trip time, UDM lookup time, PCF policy retrieval time, and UPF resource allocation time. In a well-designed deployment with local authentication caching and pre-provisioned subscriber profiles, re-establishment can complete in under a second. In a deployment where every step requires a round-trip to a centralized core over a high-latency link, re-establishment can take several seconds, which is operationally significant for real-time applications.

Designs that support tactical 5G roaming should include explicit latency budgets for session re-establishment and should validate those budgets under realistic link conditions, including degraded backhaul scenarios, before declaring the system operationally ready.

QoS Policy Mapping at Domain Boundaries

5G defines QoS through the 5QI framework, where each QoS flow is assigned a 5G QoS Identifier that maps to a set of characteristics including packet delay budget, packet error rate, and priority level. Within a single operator’s network, 5QI values are consistently interpreted. Across administrative domains, that consistency cannot be assumed.

When traffic crosses from one domain to another, the receiving domain’s network elements may not recognize the originating domain’s 5QI assignments, may map them to different internal priority queues, or may apply a default treatment that does not reflect the traffic’s mission priority. Command and control traffic marked as 5QI 1 in the home domain may arrive at the visited domain’s UPF and be treated as best-effort if no mapping agreement is in place.

The translation layer between domains typically operates at the N9 interface between UPFs or at the transport layer using DSCP markings. DSCP provides a practical interdomain QoS signaling mechanism because it operates at the IP layer and does not require the receiving domain to understand 5G-specific constructs. The design challenge is establishing and maintaining a consistent mapping between 5QI values and DSCP markings across all participating domains.

This mapping must be documented, agreed upon by all domain operators, and enforced at the boundary. It should also account for the possibility that the visited network’s transport infrastructure does not honor DSCP markings, which is common in environments where traffic traverses commercial or partner-managed links. In those cases, the design may need to rely on application-layer priority signaling or accept degraded QoS treatment for roaming traffic on those segments.

For programs building out Tactical 5G and WWAN capabilities, the QoS mapping agreement between domains is as important as the radio access network design. A well-designed RAN that delivers low-latency air interface performance provides no operational benefit if the traffic loses its priority treatment the moment it enters the transport network.

Interdomain Route Control and Advertisement Management

Routing between tactical domains in a 5G environment involves both the underlay transport network and the overlay user plane. Both require explicit design and operational discipline. The underlay carries GTP-U tunnels between UPFs, N2 signaling between AMFs and gNBs, and management traffic. The overlay carries subscriber traffic within those tunnels. Routing problems in either layer affect roaming behavior, but they manifest differently and require different diagnostic approaches.

At the underlay layer, the primary concern is reachability between domain elements. Each domain’s UPF must be able to reach the other domain’s UPF to establish N9 tunnels. Each domain’s AMF must be able to reach the other domain’s AMF for N14 interface communication during inter-AMF handover. These reachability requirements should be documented as explicit routing requirements, not assumed to be satisfied by general network connectivity.

Route advertisement at domain boundaries must be controlled through prefix filtering. Each domain should advertise only its assigned prefix block to adjacent domains and should not propagate routes learned from one domain into another without explicit policy authorization. In practice, this requires BGP or equivalent routing protocol configuration with outbound and inbound prefix filters at every interdomain peering point. The filters should be reviewed as part of any change management process that affects the addressing plan.

Temporary coverage zones present a specific routing challenge. When a forward element deploys a portable gNB and connects it to a tactical core, that element’s prefix needs to be reachable from the rest of the network for the duration of the deployment and then withdrawn cleanly when the element redeploys. Failure to withdraw routes cleanly leaves stale entries in the routing table that can cause traffic to be forwarded to a location that no longer has a radio access network present.

Route summarization at the domain boundary reduces the blast radius of these events. If the forward element’s prefix is a subnet of a larger aggregate that the domain advertises, the withdrawal of the specific prefix does not affect reachability to other subscribers in the domain. This is a strong argument for allocating prefix space to forward elements from within a domain’s aggregate block rather than assigning arbitrary prefixes that require individual advertisement.

Common Mistakes

The most consequential mistake in multi-domain tactical 5G roaming design is treating the interdomain boundary as a transport problem rather than a policy problem. Teams spend significant effort ensuring IP reachability between domains and then discover during operational testing that subscriber policy, QoS treatment, and session continuity all fail at that boundary because no one designed the policy translation layer.

A related mistake is assuming that 5QI values carry meaning across domain boundaries. They do not. The 5QI is an internal construct within a 5G network. When traffic leaves the GTP-U tunnel and enters the interdomain transport, the only QoS signal available to the receiving domain is the DSCP marking in the outer IP header. If the sending domain does not set DSCP markings consistently, and if the receiving domain does not have a policy to honor them, mission-priority traffic receives no priority treatment.

Prefix delegation without aggregation discipline is another common failure. Programs that assign IPv6 prefixes to forward elements without ensuring those prefixes are subnets of the domain’s aggregate block create routing architectures that require individual host or subnet routes to be advertised across domain boundaries. This creates route table instability during handover and makes troubleshooting significantly harder.

Designing only for the planned roaming population is a mistake that surfaces during actual operations. Exercises and deployments routinely involve unplanned attachments from partner units, coalition forces, or interagency elements whose subscriber profiles are not pre-provisioned in the visited network. The policy framework must define a default behavior for unknown subscribers that is both operationally safe and mission-appropriate, rather than simply denying the session or granting unrestricted access.

Testing only the success path during operational validation is a persistent problem across federal technology programs, and tactical 5G roaming is no exception. Handover continuity, session re-establishment latency, and QoS enforcement all need to be validated under conditions that include link degradation, domain element failures, and simultaneous handover events from multiple devices. A system that works correctly when everything is functioning normally but fails silently under stress provides false confidence to mission owners.

Finally, ownership of the interdomain policy agreement is frequently unclear. The home domain’s network team believes the visited domain is responsible for enforcing the correct policy. The visited domain’s team believes the home domain is responsible for communicating the policy requirements. Neither team has documented the agreement or assigned a responsible party for keeping it current. This ownership gap is not a technical problem. It is a program management problem that technical design cannot solve on its own.

Recommended Federal Approach

Start with a current-state assessment of each domain that will participate in the roaming architecture. Document the IPv6 prefix blocks in use, the subscriber identity infrastructure, the PCF and policy enforcement capabilities, the QoS classification schemes, and the routing protocol configurations at each domain boundary. This assessment will surface gaps and inconsistencies that need to be resolved before any roaming capability can be designed.

Establish a roaming architecture working group that includes network engineers, cybersecurity personnel, and program representatives from each participating domain. The working group’s first deliverable should be a roaming policy agreement that defines prefix ownership, subscriber policy handling for both known and unknown roaming devices, QoS mapping between domains, route advertisement rules, and the process for updating these agreements when the network changes. This document should be treated as a configuration-controlled artifact, not an informal understanding.

Select the session anchor model based on the operational requirements of the mission, not on what is easiest to implement. If the mission requires continuous application sessions during handover, the design must support home-routed or hybrid UPF anchoring with a validated N9 path between domains. If the mission can tolerate brief session interruptions and prioritizes low latency over continuity, local breakout with fast re-establishment may be the appropriate choice. Document the tradeoffs and get mission owner concurrence before committing to an architecture.

Implement the subscriber policy synchronization mechanism before deploying roaming capability. Whether the approach is pre-provisioning, federated UDM query, or a default policy with override, the mechanism must be in place and tested before devices begin roaming. Define the failure behavior explicitly: what happens when the UDM is unreachable, when a subscriber profile is not found, or when the policy enforcement point cannot reach the PCF. These failure modes are not edge cases in tactical environments. They are expected operating conditions.

Configure and validate route filters at every interdomain boundary before connecting the domains. Use a prefix filter test procedure that verifies both that permitted prefixes are advertised correctly and that unpermitted prefixes are blocked. Run this test after any change to the addressing plan or routing configuration. Assign a named owner for the route filter configuration in each domain and include filter review in the change management process.

Conduct operational validation that includes deliberate failure scenarios. Test handover continuity with the N9 path unavailable. Test session re-establishment latency with the backhaul link at 20 percent of nominal capacity. Test QoS enforcement with simultaneous high-priority traffic flows from multiple roaming devices. Test the behavior of the network when an unknown subscriber attempts to attach. Document the results and compare them against the mission’s operational requirements. Where the results do not meet requirements, resolve the gap before declaring the capability ready.

Plan for sustainment from the beginning. The roaming policy agreement, the prefix allocation plan, the QoS mapping table, and the route filter configurations all require ongoing maintenance as the network evolves. Assign ownership for each artifact, define a review cadence, and include roaming architecture review in the program’s configuration management process. A roaming capability that works at initial deployment but degrades over time as the network changes without corresponding updates to the policy framework is a common and avoidable outcome.