5G Registration flow fails after UE sends 'Security Mode Complete/Registration Request', using an external 5G RAN/UE

Hi free5GC,
I’m using a external 5G RAN/UE. free5gc (all other core NFs except UPF) (IP is 192.168.218.32) and UPF (IP 192.168.218.33) are on separate machines. RAN IP is 192.168.215.10.

From AMF interface (192.168.218.32) pcap log, Registration flow fails after UE sends ‘Security Mode Complete/Registration Request’ to AMF, after this message, from pcap log, there is no ‘Registration Accept’, and later AMF sends ‘shutdown’ message.
From free5gc AMF log, it says there an error after AMF sends ‘initial Context Setup Request’ on NGAP protocol. But on pcap log, there is no ‘Registration Accept’ and there is no ‘initial Context Setup Request’ message. Detailed logs pls see attachment.

2020/09/21 07:40:02 map[$and:[map[nfType:PCF] map[$or:[map[allowedNfTypes:AMF] map[allowedNfTypes:map[$exists:false]]]] map[$or:[map[pcfInfo.supiRanges:map[$elemMatch:map[end:map[$gte:2089300007487] start:map[$lte:2089300007487]]]] map[pcfInfo.supiRanges:map[$exists:false]]]]]]
[GIN] 2020/09/21 - 07:40:02 | 200 | 3.54076ms | 127.0.0.1 | GET /nnrf-disc/v1/nf-instances?requester-nf-type=AMF&supi=imsi-2089300007487&target-nf-type=PCF
[GIN] 2020/09/21 - 07:40:02 | 200 | 588.099µs | 127.0.0.1 | GET /nudr-dr/v1/policy-data/ues/imsi-2089300007487/am-data
[GIN] 2020/09/21 - 07:40:02 | 201 | 1.536111ms | 127.0.0.1 | POST /npcf-am-policy-control/v1/policies
INFO[2020-09-21T07:40:02Z]/src/amf/gmm/message/send.go:211 free5gc/src/amf/gmm/message.SendRegistrationAccept() [NAS] Send Registration Accept AMF=Gmm
INFO[2020-09-21T07:40:02Z]/src/amf/ngap/message/send.go:340 free5gc/src/amf/ngap/message.SendInitialContextSetupRequest() [AMF] Send Initial Context Setup Request AMF=NGAP
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x58 pc=0x969b5b]

goroutine 40 [running]:
free5gc/src/amf/ngap/message.BuildIEMobilityRestrictionList(0xc000a66000, 0xc000b917d8, 0x3, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0)
/home/smartedge/free5gc/src/amf/ngap/message/forward_ie.go:77 +0xbb
free5gc/src/amf/ngap/message.BuildInitialContextSetupRequest(0xc000a66000, 0xdaa054, 0xb, 0xc000ad8b70, 0x29, 0x30, 0x0, 0x0, 0x0, 0x0, …)
/home/smartedge/free5gc/src/amf/ngap/message/build.go:1066 +0x1be3
free5gc/src/amf/ngap/message.SendInitialContextSetupRequest(0xc000a66000, 0xdaa054, 0xb, 0xc000ad8b70, 0x29, 0x30, 0x0, 0x0, 0x0, 0x0)
/home/smartedge/free5gc/src/amf/ngap/message/send.go:354 +0x131
free5gc/src/amf/gmm/message.SendRegistrationAccept(0xc000a66000, 0xdaa054, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, …)
/home/smartedge/free5gc/src/amf/gmm/message/send.go:218 +0x23c
free5gc/src/amf/gmm.HandleInitialRegistration(0xc000a66000, 0xdaa054, 0xb, 0x2, 0x2)
/home/smartedge/free5gc/src/amf/gmm/handler.go:951 +0x93c
free5gc/src/amf/gmm.register_event_3gpp(0xc000a47e60, 0xdaa11a, 0xb, 0xc00079d770, 0xd53500, 0xc0007e46c0)
/home/smartedge/free5gc/src/amf/gmm/sm.go:75 +0x432
free5gc/src/amf/gmm.Registered_3gpp(0xc000a47e60, 0xdaa11a, 0xb, 0xc00079d770, 0xc000a634e0, 0x0)
/home/smartedge/free5gc/src/amf/gmm/sm.go:24 +0x49
free5gc/lib/fsm.(*FSM).SendEvent(…)
/home/smartedge/free5gc/lib/fsm/fsm.go:57
free5gc/src/amf/gmm.HandleSecurityModeComplete(0xc000a66000, 0xdaa054, 0xb, 0x2e, 0xc000c2ac60, 0xc0007e4503, 0x2c00000000d535c0, 0xc00073b738)
/home/smartedge/free5gc/src/amf/gmm/handler.go:2193 +0x751
free5gc/src/amf/gmm.SecurityMode_3gpp(0xc000a47e60, 0xdaa11a, 0xb, 0xc00079d680, 0xc000a634f0, 0xeeaa80)
/home/smartedge/free5gc/src/amf/gmm/sm.go:116 +0x31f
free5gc/lib/fsm.(*FSM).SendEvent(…)
/home/smartedge/free5gc/lib/fsm/fsm.go:57
free5gc/src/amf/nas.Dispatch(0xc000a66000, 0xdaa054, 0xb, 0x2e, 0xc000c2abc0, 0x31, 0x39)
/home/smartedge/free5gc/src/amf/nas/dispatch.go:19 +0x2b5
free5gc/src/amf/nas.HandleNAS(0xc000a24120, 0x2e, 0xc0007c2d80, 0x38, 0x40)
/home/smartedge/free5gc/src/amf/nas/handler.go:41 +0x11a
free5gc/src/amf/ngap.HandleUplinkNasTransport(0xc000a94000, 0xc0007afaa0)
/home/smartedge/free5gc/src/amf/ngap/handler.go:239 +0x731
free5gc/src/amf/ngap.Dispatch(0xc000a8c040, 0x12, 0xc000b1a000, 0x63, 0x2000)
/home/smartedge/free5gc/src/amf/ngap/dispatcher.go:45 +0x51a
free5gc/src/amf/handler.Handle()
/home/smartedge/free5gc/src/amf/handler/handler.go:35 +0x1db
created by free5gc/src/amf/service.(*AMF).Start
/home/smartedge/free5gc/src/amf/service/amf_init.go:150 +0x518

Thanks a lot!
Br,
Andrew920-reg8-AMF-log.txt (14.4 KB) 920-amf-interface-reg8.pcap (46.8 KB)

hi free5GC,
FYI that I solved my issue by adding ue data in UDM/mongodb, thanks. Pls close it.