WiFi to LTE Handover
The following illustration describes the WiFi to LTE handover call flow.

| Step | Description |
|---|---|
| 1 |
N4 Session is established for WiFi between SMF/IWF and UPF. The MME sends Create Session Request (relocating to 4G) to the SGW-C/cnSGW. |
| 2 | The SGW-C/cnSGW sends Sx Session Establishment Request (No F-TEID) to the UPF. |
| 3 |
IMSI-based lookup is done at SxDemux for SessMgr ID. The UPF sends Sx Establishment Response to the SGW-C/cnSGW. |
| 4 | The SGW-C/cnSGW sends Create Session Request to the SMF/IWF. |
| 5 | The SMF/IWF sends Sx Modify Request with new Uplink RB PDR to the UPF. |
| 6 | The UPF sends Sx Modify Response to the SMF/IWF with new TEID for Uplink data. |
| 7 | The SMF/IWF sends Create Session Response to the SGW-C/cnSGW. |
| 8 | The SGW-C/cnSGW sends Sx Modify Request to the UPF with updated Uplink FAR. |
| 9 |
Uplink path is established. The UPF sends Sx Modify Response to the SGW-C/cnSGW. |
| 10 | The SGW-C/cnSGW sends Create Session Response to the MME. |
| 11 | The MME sends Modify Bearer Request to the SGW-C/cnSGW. |
| 12 | The SGW-C/cnSGW sends Sx Modify Request to the UPF with eNodeB TEIDs. |
| 13 | The UPF sends Sx Modify Response back to the SGW-C/cnSGW. |
| 14 | The SGW-C/cnSGW sends Modify Bearer Request to the SMF/IWF. |
| 15 | The SMF/IWF sends tunnel switch Sx Modify Request to the UPF. |
| 16 |
Collapsed datapath with Sxa session is established at UPF. The UPF sends Sx Modify Response to the SMF/IWF. |
| 17 | The SMF/IWF sends Modify Bearer Response to the SGW-C/cnSGW. |
| 18 | The SGW-C/cnSGW sends Modify Bearer Response to the MME. |