diff --git a/src/smf/context.c b/src/smf/context.c
index e3a4dffaf..79efac178 100644
--- a/src/smf/context.c
+++ b/src/smf/context.c
@@ -2057,6 +2057,16 @@ void smf_sess_create_cp_up_data_forwarding(smf_sess_t *sess)
     ogs_pfcp_pdr_associate_far(up2cp_pdr, up2cp_far);
 
     up2cp_far->apply_action = OGS_PFCP_APPLY_ACTION_FORW;
+
+    if (qos_flow->qer && qos_flow->qfi) {
+        /* To match the PDI of UP2CP_PDR(from ff02::2/128 to assigned)
+         * Router-Solicitation has QFI in the Extended Header */
+        up2cp_pdr->qfi = qos_flow->qfi;
+
+        /* When UPF sends router advertisement to gNB,
+         * it includes QFI in extension header */
+        ogs_pfcp_pdr_associate_qer(cp2up_pdr, qos_flow->qer);
+    }
 }
 
 void smf_sess_delete_cp_up_data_forwarding(smf_sess_t *sess)
diff --git a/tests/common/gtpu.c b/tests/common/gtpu.c
index 96615e78b..4661ac821 100644
--- a/tests/common/gtpu.c
+++ b/tests/common/gtpu.c
@@ -149,7 +149,7 @@ void testgtpu_recv(test_ue_t *test_ue, ogs_pkbuf_t *pkbuf)
 found:
     ogs_assert(sess);
 
-    ip6_h = pkbuf->data + OGS_GTPV1U_HEADER_LEN;
+    ip6_h = pkbuf->data + ogs_gtpu_header_len(pkbuf);
     ogs_assert(ip6_h);
     if (ip6_h->ip6_nxt == IPPROTO_ICMPV6) {
         struct nd_router_advert *advert_h = (struct nd_router_advert *)
@@ -384,10 +384,11 @@ int test_gtpu_send_slacc_rs(ogs_socknode_t *node, test_bearer_t *bearer)
     if (bearer->qfi) {
         gtp_hdesc.teid = sess->upf_n3_teid;
 
-/* CHECK: I guess that Router Soliciation does not include QFI in 5G Core */
-#if 0
+/*
+ * Discussion #1506
+ * Router Soliciation should include QFI in 5G Core
+ */
         ext_hdesc.qos_flow_identifier = bearer->qfi;
-#endif
 
     } else if (bearer->ebi) {
         gtp_hdesc.teid = bearer->sgw_s1u_teid;