Transparent network function discovery and addressing

A method, in a first edge security node of a first Public Land Mobile Network, PLMN, the method comprising:

• receiving, from a first network function, NF, a request for a second NF;
• determining whether the second NF is within the first PLMN;
• and
• responsive to the second NF not being within the first PLMN, generating a first address request for the second NF;
• and
• transmitting the first address request to a split-horizon domain name system, DNS, within the first PLMN from an external interface of the first edge security node located outside of the first PLMN.

A Network Function Discovery Orchestration, NFDO, node, for configuring a Service Based Architecture, SBA, of a first Public Land Mobile Network, PLMN, for discovery of a Network Function, NF, the NFDO node comprising processing circuitry configured to:

• transmit an indication of a first domain name to be used by the NF;
• initiate registration of the NF in a Network Repository Function, NRF such that the NF is associated with the first domain name in the NRF;
• determine at least one NF Internet Protocol, IP, address;
• determine at least one edge security node IP address;
• configure, in a domain name system, DNS, a first DNS entry associating the first domain name of the NF with at least one NF, IP address of the NF, and a second DNS entry associating the first domain name with the at least one edge security node IP address of an edge security node in the first PLMN;
• and
• the first DNS entry being configured to be used for resolving requests for the NF which originate from within the first PLMN, and the second DNS entry being configured to be used for resolving requests for the NF which originate from outside the first PLMN.

A first edge security node of a first Public Land Mobile Network, PLMN, the first edge security node comprising processing circuitry configured to:

• receive, from a first network function, NF, a request for a second NF;
• determine whether the second NF is within the first PLMN;
• and
• responsive to the second NF not being within the first PLMN, generate a first address request for the second NF;
• and transmit the first address request to a split-horizon domain name system, DNS, within the first PLMN from an external interface of the first edge security node located outside of the first PLMN.