The BNG UPF always enables the IPoE and PPPoE BBF function features. A compatible BNG CPF uses this as an indication to set up a default IBCP tunnel to send control plane packets, such as DHCP discover or PADI, that do not match an existing session. The default tunnel is signaled as a special PFCP session without a PDN type. The special PFCP session can apply traffic-matching rules the same as any other PFCP session for which the BNG UPF applies rules.
See In-band control plane for more information about IBCP.