EIJ.lii dupontsergio75@gmail.

com naHenb l'IHCTpyMeHTOB Bbtfirn

U&)H6VSE

7/28/2015 SlogArchlve

► 2017 (1)
E2E VoLTE call setup(1 /4) Initial attach and default EPS
► 2016 (5)
bearercreation
... 2015 (18)
When the UE is turned on, it establishes a PON connection with a default APN. In this test ► October (1)
for VoLTE call setup, the operator provides two APNs, i.e., "Internet" APN and the "IMS"
► September (1)
APN. The default APN is an "Internet" APN that is used for internet data traffic and its
► August (5)
default EPS bearer has a QCI value of '9'. After the PON connection is established with the
internet APN, the UE attempts additional PON connection with the IMS well known APN, ..- July (5)
i.e., "IMS APN ". The IMS APN is preconfigured in the UE and its default EPS bearer has a QCI E2E VoLTE call setup(2/4) : IMS registration
value of '5' being used for SIP signaling. Once the PON connection with the IMS APN is E2E VoLTE call setup(l/4) : Initial attach
completed and the default EPS bearer is successfully created, the UE is able to communicate and def...
with the IMS Core for VoLTE call service. VoLTE: Tracking Area Update and
combined attach

VoLTE: Traffic Flow Templates

Introduction
VoLTE: PON connectivity request vs
handover
The UE's initial attach procedure consists of two routines. One is to establish a signaling path on RRC, SlAP
and GTP-C interfaces and the other one is to establish the bearer path including Data Radio Bearer (DRB) ► June (6)

and GTP-U (i.e., Sl and SS bearer). The following diagram show overall LTE architecture and different
► 2014 (4)
signaling and media paths with multiple PDNs.

Popular Posts
NOTE In this diagram, the SS interface between the SGW and the PGW has been omitted for simplicity.
ICII
""' E2E VoLTE call setup(l/4) :
Cl
Initial attach and default EPS
~ ICII cc • bearercreation
When the UE is turned on, it
establishes a PON connection
with a default APN . In this test for VoLTE call
setup, the operator pro ...

E2E VoLTE call setup(2/4) : IMS

registration
Once the UE attaches to the
LTE network and the default
EPS bearer is created
successfully with the IMS APN, the UE
registers t.. .

E2E VoLTE call setup(3/4) - Voice call setup

Once the IMS registration is successfully done
between the UE and the IMS network, the
user can make a VoLTE call. Upon request ...
1/31
 •••• Signaling Path ••••
- Beare r Pat h -
- c
Diameter (S6a)

-
~ •
Diameter (G~)

·······GTP-C (Sll) -·········i

q
VoLTE: Understanding of GTP
: : TEID to use in LTE trouble
S1-AP (St -MME)
:
i
: ! ..,
/ $ shooting
: : : r--( Internet PDN

mll== ~~~==- --
-···The GTP{GPRS Tunneling
Protocol) is a communication
GTP-U (S1) - -- = d~i)L '
I IMS PDN
protocol used by the LTE to deliver IP packets
within the EPC. The GTP-C is used to de ...

Default EPS Bearer [QQ = 9-) for Internet VoLTE: Tracking Area Update
and combined attach
Default EPS B..,rer (QCI = 5) for SIP A telecommunication network
IMSPDN provides the way of identifying
Dedicated EPS 8..,r,,,- (QCI =1) for RTP
and tracking the location of the
UE to maintain the UE mobility. The UE regis ...
Figure 1. PDN Connectivity
VoLTE : Traffic Flow Templates
The service data flow template
The signaling connection procedure involves LTE authentication, NAS security procedure and the UE's is a set of packet filters applied
to IP packets to identify the
location update procedure. Therefore, when the signaling connection is completed, the UE comes to have a service data flow belonging to
secured connection to communicate with the network and the network becomes aware of the UE's context a specific a...
as to its location, subscriber's information, QoS requirements, etc. Along with the signaling connection,
E2E VoLTE call setup{4/4) -
there comes a default EPS bearer established from the UE to the PGW, which covers the DRB, 51 bearer and
dedicated EPS bearer creation
55 bearer. -=-
While SIP signaling is in
progress in VoLTE call setup, a
I. Initial attachment dedicated EPS bearer is created
for voice media transfer. The dedica ...

AUE establishes an RRC connection with an eNB and the eNB creates an SlAP session with an MME for ~ VoLTE : Service Request
signaling. The NAS messages are exchanged between UE and the MME once the RRC and SlAP connection is scenario in IDLE mode
established and it is composed of two layers, i.e., EPS Session Management (ESM) layer and EPS Mobility ;;;.~ The IDLE state is defined as the

Management (EMM) layer. The ESM message is used to control PDN connectivity, bearer resource
J state when both RRC state (i.e.,
eNB and UE signaling
allocation/modification, activation/deactivation of a default/dedicated EPS bearer. The EMM message is connection state) and ECM state (i.e., NAS
used to maintain the mobility of the UE using e.g., Attach, Detach, Tracking Area Update (TAU). The NAS signaling ...

message transparently goes through the eNB contained in RRC and SlAP messages.
a r- VoLTE : Bearer binding and
Session binding
EJ BG The LTE supports the
PCC{Policy and Charging
Control) architecture for QoS
control applied to service data flow. In the
PCC architecture, t. ..

E2E VoLTE call flow : detach

(UE-initiated)
G The UE initiated detach
procedure may occur when the
UE is turned off or the UE
needs to fall back from EPS services to non-
EPS services or...

2/31
 UE eNB MME SGW/PGW PCRF IMS

1. RRC Conne
E~tablishmenl u,e, Predefined c figuration status
lnformallon, D main Indicator, lnlll I UE•ID ::i7!1=
- - - - - -· - - - - - - - -
gt:orion
2. RRC Conne
Predefined Co figurat ion Identity, Defaull Configu rat i n
Mode, Def~ ult nfiguralion Iden IV, f'hyCH Informal on
el-ements

ity Request]

rf--- - - -
1 RRC Cannectfon S..t p Compleh> i
I RRC tra n~•ction
id, UE radio
>-----------+ I
E nadio
1 • m ,.., <aPabrnty access capabil ity, T , £CGI
I - - - - - - - - - - - - - - - - -- - - - l

Request)

l TE Authentic.a ion

NAS Securfr~ Se p {Integrity pro ectlon &: clpherln )

H 2] RRC H (3] S1AP~

:< NAS S~curity '
'I

Figure 2. Initial Attach flow

(1-2] The UE in idle mode requests the eNB to establish a signaling connection by sending RRC Connection
request. The eNB allocates the network resource based on the received radio configuration and initiates an
RRC connection towards the UE by sending RRC Connection Setup.

(3) The UE configures a radio bearer and transport channel based on predefined parameters identified by a
received predefined configuration identity and confirms RRC connection by sending the RRC Connection
Setup Complete to the eNB. Meanwhile, the NAS messages (i.e., Attach Request at EMM layer and the PON
Connectivity Request at ESM layer) is transparently delivered to the MME via eNB being contained in the
RRC and SlAP messages (i.e., RRC Connection Setup Complete and lnitia/UEMessage, respectively) .

The following snapshot shows the NAS part of lnitia/UEMessage captured on S1AP interface.

3131
 NA - POU : 0741. 72 011-1 950 780<I OO<I0990805eOeOc0/4 01 900270209d0 31 ...
,11 NOO- ACCCSS • Sl:.r at u n> (NAS) POU i
0066 . .. . -= se, ur , ty h ader type : P l.a i n N ,,. m ssage , not secur ity pr ot ected ( 0)
01-1 t = Pro t o c- ol d i ~i;.r i mi n a tor ; EPS mobil i ty man;i gement mi;'ss dg (Ox07)
NAS EP"i N9h1J 1tv r:,;anareme or Me-as ,-m e rype · errarb cecw esx {0X1D
o . , . , . . . - i ype of s ecu rity con-cext f l ag (TSt ): Nacive s ecuricy c om c u (fo r KSlasme )
. ll.1 - NA5 key :'.iCt: ident ifier : NO key is avai l a.b1 c O')
. . . . O.. ; Sp a r e b it (~) : OxOO
· • · · .010 = f P"' an df h rvve· combi ned EPS / l'M51 QI t d£h ( 2)
..i ef' S mob"il i den clt y
IJ UE net.work ca~abi l i ty
~ ESM me s sa ne C nrtai oerl
I eng t h: 39
s E:SM mes ag cont a i n r tlfU@nts : 0 209d0 31d1 27 20 8 0 80 2.1.l 001 00001 081 0600000000830600 . .
0000 . . . , - CPS b e a r e r i denr i cy : ~o ~PS bear er iden<ity ass i gned ( O)
.. . . 001.0 - Pr ot ocol discr i minat:or: ~PS sessi on l!l'lanagemc.nt messages (Ox02 )
Pr ocedur e t r an:s a i on identity : 9
NAS EP~ ses:. i on -m~nagement me~ age:;. : PON CHOPU t jy j fy (' f9MPS t· (O~dO)
OOl.l .... ; PDN i:y pe : IP v ~ v 6 (3)
. , . . 0001 - R.equc st: type: i ni t ial re quest (1 )
ft! ES.'-1 irrfor 11Jation t.ransfer fl ag
CB Pr otoc ol Conf i9ur ation opt i ons
DRX Par c1.me te r
M~ Networ k capabi l i ty
TM.SI Statu s
~ Mobi 7e s ation class ma r k 2
Mohi le s t;nt ion c;la.$s mrl r k 3
Support ll code.c L 'i st - supvor- tell codecs
:J voi ce. domain prefer enc and uc •s usag secri ng
E1i,ment IO : Ox d
L eng t h: l .
0000 0 .. . ; sp ar· e bh(s) : O
. o .. ,., u~ · s usag@: :;~t ci ng : voi ce c~ m:l"ic
. • 1.1 - voi ce doroil i □ orcfrccocr f or r t□-BeN · fMS cs voice oc rfccccd r e; Voi cr a:; '1 cconduc v
1J MS net:wor k teat ure suppor t

Figure 3. lnitialUEMessage

In case the UE wants to use both LTE and non-LTE, the EPS Attach type will be set to "Combined EPS/IMSI
attach" and the Voice domain preference set to "IMS PS voice preferred, CS voice as secondary".

• EPS Attach Type : EPS attach/combined EPS/IMSI attach/EPS emergency attach

• Voice domain preference : a preferred network for voice call

The Protocol Configuration Option (PCO) is used by the UE to request a certain information like UE IP
address, DNS IP address, etc.

The following snapshot shows an example of PCO configuration included in the initia/UEMessage.

El E:SM mess age conta i ne r

Length : 39
8 SM mes s age conca i ner concen cs ; 020 9d03ldl2 7208080 21100100001081060000 000083 0600 .
0000 . . , . ; £PS bear er id enc it y ; o EPS bear er i dent i t y as s i gned ( O)
, .. . 0010 ; Pr otocol di s cri mi nator: EPS sess i on management mes sages (Ox02)
Proc edur e t r ansact i on i dentity : 9
AS EPS session mana ement ,messages : PON conneci::i vity reqliest (OxdO)
0011 .. . . ; PON type : I Pv4v6 ( 3)
. . . . 0001 ; R que y p : i ni i al r qu t (1)
@ ESM i nf or mation t ransf er f l a
Pr ot ocol corrf i gu r at i on opt i ons
El ement I D: Ox 27
Lengt h: 32
[L. nk di re cti on : MS co networ k (O) ]
1. . . , . , . ; xt ens i on: Tr lle
con i gur ation Prot ocol : PPP for use it h I P POP t ype or I P PO t ype (0)
Pr ot oco l or contai ner r o : Int ernet Prot oco l cont r ol Protocol ( Ox8021)
aJ Pr ot oco l or contai ner I O: o s s er ver I Pv4 Addr ess Request (OxOOOd)
aJ Pr ot ocol or c ontai ner IO : o s ser ver I Pv6 Addr ess Reque st (Ox0003)
~ Pr o eco l or cont ai ne r IO : I P addr s s al l ocat ion vi a A s i gna l l i ng ( OxOOOa)
Pr o ocol or c ontai ner IO: I Pv4 i nk MT Reus (OxOOlO)

4/31
 Figure 4. PCO for initial attachment

The following snapshot shows other parameters of initia/UEMessage, which contains the UE's location
information (i.e., Tracking Area Identifier, E-UTRAN Cell Global Identity) and RRC establishment cause.

B S1AP-PDU: i nitiatingMessage (0)

B i niti at i ngMessage
procedurecode: id-initialUEMessage (12)
critical i ty: ig nore ( 1 )
B value
B InitialUEMessage
B protocolIEs: 5 ite ms
1±1 Item O: i d-eNB-UE-S1AP- I D
J • i ~ NAS Pou
!B BItem
@
Item 2: i d -TAI !
Protoco IE- Field
id: id-TAI (67)
critical i ty: reject (0)
B value
B TAI
pLMNidentity:
Mobile country code (MCC): India ( Republic of) (, )
Mobile Network code (MNC): Unknown ( )
tAC: 1016
B It em 3: i d-EUTRAN- CGI !
EJ Prot oco i!E- F,e id
id: id-E UTRAN-CGI (100)
criticality: ignore (1)
B value
B EUTRAN-CGI
pLMNidentity:
Mobile cou ntry code (MCC): India (Republic of) ( )
Mobile Network code (MNC): unknown (: )
- - - - -.lolii.L.1.;;.i....,..11.1,1,ai,"""""'-"'....i.1o.1..._&..1,~ th 28, 4 LSB pad bits, 0000
B ite.m4:

id: i d-RRC-Establ i shment-cause (134 )

critical i ty: ignore (1)
B val ue
RRC-Establishment-Cause: mo-signalling (3)

Figure 5. Parameters in initialUEMessage

(4-5] Upon receiving the Attach Request, the MME requests the authentication vector to HSS by
sending Authentication Information Request (AIR) to authenticate the subscriber.

5/31
 s o;ameter Proco~ol
vers i on: 0x0l
Length : 416
Fl ags : 0xc0
convnand code : 318 3GPP - Authcnt i cat i on- I nformation
Appli cat i on.Id: 3G PP S6a/ s6d ( 167772 51 )
Hop- by- Hop Identifie r : OxJ.6810d18
End- to- ~nd Identifier: OxJ.6810d18
[ Ans~ er I n : 41 76 ]
AVP : sess i on-! 263 =65 T=-M- v a = mmext)Ol. epc . mnc . mcc . 3 gppn t •,•or . org; o ; 14 8
AUt h-session -su (2 77 ) l=l f =-M- v ;, l =NO_ AT .Y1A-1NTAIN !;;O (l)
or i g i n-H s (2 4) 1= 'i7 f=-M- val = nm ~001 . p . mnc . mcc . gpJ)n n,•ork. org
, AVP: or i gin - R 31m(2 ) 1=11 f=-M- v;1l=epc.m11 . mcc . 3gppne wo rk. or g
o l inat ion-Hos (293) 1=5l f= -M- val= dr aaoo3 . pc .mnc .m .3g ppnecwork . org
o st: inati n- 1{ a lm(2 8 3) 1=41 f= - M- val = pc.nmc · "'''· . 3gppne work. o rg
U f'-Nd1n (1) 1=23 'f =-M- 1= 000049980
AVP: supported-Fedt ures(628) 1=56 f= -- vnd=TGPP
.,; AVP: Requested-E UTRAN-Authen·t i ca t ion-In fo(1408) 1=2 8 f=VM- \/ rtci=TGPP
er AVP : Vi s; ted- PLMN - Id 1407 1=1'> f =~ - nd~TGPP val =

Figure 6. Authentication Information Request

The HSS responds with the Authentication Vector in the Authentication Information Response (AIA) as
shown in the following snapshot.

B AVP: Authentication-Info(1413) 7=160 f=VM- vnd=TGPP

AVP code: 1413 Authentication-Info
00 AVP Flags: 0xco
AVP Length: 160
AVP vendor Id: 3GPP (10415)
B Authent ication-Info: 00000586c0000094 000028af0000058bc0000010000028af
B AVP: E-UTRAN-Vector(1414) 7=148 f=VM- vnd=TGPP
AVP Code: 1414 E-UTRAN-Vector
00 AVP Flags: 0xc0
AVP Length: 148
AVP vendor Id: 3GPP (10415)
B E-UTRAN-vector: 0000058bc0000010000028af00000001000005a7c00000lc
00 AVP: Item-Number(1419) 7=16 f=VM- vnd=TGPP val=l
00 AVP: RAND(l447) 7=28 f=VM- vnd=TGPP val=4af7a483 79b76fc27aea0b ~
00 AVP: XRES(1448) 7=20 f=VM- vnd=TGPP val=7beae63b8488e365
00 AVP: AUTN(1449) 7=28 f=VM- vnd=TGPP val=b9190340a3fe8000a21f7 S~
r+l AVP: KASME(1450) 7=44 f=VM- vnd=TGPP val=49f4eda504 bf6446 dc 7 5r

Figure 7. Authentication Information in AIA

The following diagram shows a conceptual data flow of LTE-AKA authentication. The MME delivers the
AUTN and RAND to the UE among the received parameters. (2) The UE authenticates the network by
running the authentication algorithm which uses the received RAND and local parameters as input and then
(3) verifies if the output of the calculation is matched with the received AUTN . The UE sends the RES which
is another output of the authentication algorithm to the MME so that (4) MME can verify the RES by
comparing it with the XRES received from the HSS in (1).

6/31
 A
.----------- - G B
Rlll~l'l:..authentication ~
A Fetch authentication &m,
V algorrtryn ... v vectt>r --
''

A
W
Autttenticariondthe
network: 0 Authenticacionof"the UE

Figure 8. LTE authentication

As such the UE and LTE network performs the mutual authentication. After successful authentication, there
comes the NA5 security establishment procedure between the UE and the LTE network in order to provide a
secured data transfer and data integrity.

II. Location update and GTP-C session creation

In this part of the flow, the MME updates the UE's location information stored in the H55 and creates GTP-C
session with the 5GW. The GTP-C session is used to control GTP-U (i.e., 51 and 55 bearers) media session
belonging to the same APN.

7/31
 UE I I eN B I I MM E I l sGW/PGw l I POI F I I IMS

6. Update Locati , n Request

IMS\ IMEI, RAT r vP~ PLMN-ld

HSS
fPS ~arer ID aid GTP-C
7. Updat e Locati :>nAn.sw er
----- -- -· ------
moaJJowtfon
--- MSISDN, APN-C : nfguration(APN Ii, ,
QoS profile, PGW all:Jca:ion mode),
Conte><t Id

8 . Crea t e SessiQ.r Request

IMS! MSISON,· 1 PN=lnternet;PCO,
Bearer Conte><t Bearer ID, Bearer C oS - GBR, MBR),
ECGI, TAI

~E_ ~ ~/~~~!'..,:: 9. CCR (Credit-Cc nt r oJ- Requestl

Initial Request; & bscription-ld( e.g., I ~SI),
UE-IP,APN, Event- eport, QoS lnfo(AP~ -
AMBR(Ul/Dl)), E S Been,- QoS(QCI, RP ),
3GPP-U,.,,- -Locati ,n( ECG\ TAI)

Policy dea"!;ion _
--- ------------
10. CCA (Cr ed it-<ont rol- An5\verl
I
-.................... ..
clicy Erlforamen t
Default EPS Bear< QoS (QCI, ARP), I'< C rule
name

1_1. c , ea t e Sessic n Response

AMBR(Ul/Dl), El ~ bearer ID, PCO, 5( W GTP-C TEID, Bea er
Conte><t(EPS bear ;r ID, SGW Sl -U TEI J, QCI)

E:---[ 2] RRC---+--[ 3] S1AP------;1e-[ 8] GT P-C~ [9] Gx~

NAS security
,
:
: ; :

Figure 9. Location update and GTP-C session creation flow

(6-7] The MME registers the UE's location to the network by sending Update Location Requestto the HSS.
The following lists some of parameters as shown in the snapshot.

• User-Name AVP: IMSI

• Terminal Information AVP: IMEI, Software version
• Visited PLMN-ld AVP: MCC and MNC of a visited network
• RAT-Type AVP : EUTRAN

8/31
 s Di ameter Pr o't"ocol
ver~1 on: Ox01
1..ength: 492
l!J lags: o co
Com:nanr1 Corie : 31 lGPP- Update-Loca.t ion
Appl ication!d: 3GPP S6a/ S6d (16 7772 >1)
Hop- by-tfop tdent i f i er: O>C16810dl ;:i
lnd- to - Cnd r deoc i ficr: OX16610dl a

Session 1 - '.l ---M va - nr.1 x , epc. mnc . mcc , -gppn-et\oK:lr , o g;

A.ut h-sess i on-Stale ( 277) 1=12 f=-~- v al=NO_STATEJ,4AINTAIN£0 (1)
11 AVP: Ori gin oSl: ( 264) 1-;2 f -· M val - ... cxoo1 . cpc .mn~ . mcc . 3gppnetwork. org
El AVP : Ori gin- Rea lm(296) 1=41 f = --iH- va l =ept. mnc . c:c . 39ppnetwork . org
AVP: oc..stinarion- Hos:r (293) 1- 2 f -· '1 - val- dr aaO03. e.pc. mnc , m.cc. . 3gppne t wor lc. or g
AVP : o st.i nal ion- Rea 1 m(283) 1=4 1 f=-M- va l=epc . rnnc. . mcc . 3g,ppnet.wor k. org
user - Name(l.) 1~2J f _ • .,, val- 000049980
supported-featute1-(62 S) l =5 6 r=-V-- vnd=TGPP
Tcrminal - Ioforo,at ion (l.401) 1-,6 f-~ - vnd-TGPP
RAT-Typ0(1032) l=.16 f=V-- vnd=TC.PP val=EIITRAN (1004)
ULR- Flags(l40~) 1-l f ~'M- v nd-TGPP v a l~34
AVP: vlsi [ ed-PLMN-Id(1407) 1- 5 f-VM- vrld: TGPP V dl -
AVP ~ Homogc.neous-support - of' -. IMS-Voice.- ove.r - P5-Sess i ons(149 3) 1-16 f-V -- vnd-TGPP v al --SUPPORTE D (1

Figure 10. Update Location Request

In return, the MME receives the Update Location Answer from the HSS and it contains the APN list as shown
in the snapshot below.

Ila AVP: s ssi on-Id( 263) 1=6 5 f =-M- va l = mm xOOl. pc . nine .mcc, . 3gppm~ work. or ,
Auth-sess ion-state( 77) 1=12 =-M- va7=NO_STATE...MAI NTAI NEU ( 1)
o r ig in -ttos t (264 ) 1=52 f =- - val= hs s xOOl . epc. mnc

subsc r ipt io n- oat a (14 00) 7= 732

AVP cod : 40 0 Sub. ri p·ti on- oat a
ffi AP Fl ag s: OxcO
AVP ng t h : 7 2
AP Vend or I d : 3GPP (1 0415)
a subsc r ipti on- oa a : 00000590c0000010000028af00000000000 002b dc0000012 . . .
ru AVP: Sub scr i b r - t t u (14 4) , _ 6 - VM - nd- TGPP v 1- s RVI RANT 0 ( 0)
ffi AVP : MSISDN( 701 ) 7=18 f=VM- vnd=TGPP val=.
AVP: APN - 01 - R pl ac ni nt(l4 7) l 5 f • VM - vnd TGPP v l pc . mnc . ni c g
ffi AVP : AM BR(14 35) 7=44 f=VM - vnd=TGPP
El AVP : APN - Conf ig ur a ion- Pr of ile(142 ) 1= 592 ·f =\JM - vnd~TGP P
AVP code : 142 9 AP N- c onfigur at i on-Profi l e
AVP Fl ags : OxcO
AVP L ngrh : 59
AVP ve ndor rd : 3GPP (1 0415)
AP - Ca nfigu ration- Pr of il : 00000 58fc0000010000028af 0000000a00000 594cOOOO

(2 0 01 )

Figure 11. Update Location Answer

Upon receiving the list of APN in the Update Location Answer (ULA), MME determines the default APN. In
this example, there are two APNs received as shown in the following snapshot.

9/31
 B ub cripri on-O;,ca: 000005 OcOOOOOlOOOOO 8af00000000000007bdc00 12 ..
AVP : ub cr i bPr- r il tUS(\4 24 ) l =l f=IIM- vnd=TGPP va l = FRVT t _GRANTFO CO)
l 0 ~( 701) 1=1 8 f =IIM- vnd=TGP P val =1907l 109603
APN - Ol - Replacem n (1 4 27) 1=45 f=VM - vnd=l PP va l =epc.mnc 74.mc 40 . 3gppne work . or!
A 6R(l435) l=44 f=VM - vnd= GPP
AVP : APN - onfi gurat:ion- Prof i l (1429) l= 92 f=W - vnd=1 pp
AVP cod : 1429 APN - onf i gurat i on-P r o f i le
AVP 1.. gs : Oxco
AVP L ength: 592
AVP v ndor Id : 3GPP (10415 )
A APN-Conf ·i guration-Profile : 0000058 f c0000010000028dfOOOOOOOa00000594 0000010 ...
AVP : Context-IdentHie.r (1423) 1=1 6 f =IIII'- vnd=TGPP vdl =lO
All -Af'N-Co nf i ur at i ons-Incl uded-Indicdtor(1428) 7=16 f=VM- vnd=TGPP val=ALL_AI
AP - con 19u1·at1on 1430 =272 =VM- vn =TGPP
APN - Confiquration(1430) 1= 276 f =~ - vnd=TGPP

Figure 12. APN list

The following snapshot shows the detailed APN configuration. One of APNs (bottom one) is an "Internet"
APN as indicated by Service-Selection AVP. The other APN (upper one) is an "IMS" APN. The default APN is
determined by comparing the Context-Identifier AVP under the APN-Configuration-Profile AVP with another
Context-Identifier AVP in the APN-Configuration AVP. In this case, the context identifier value of "10" in the
APN-Configuration AVP for " Internet" is matched with the context identifier value in the upper layer. Given
this, the MME will select the "Internet" APN as a default APN.

El AP N- conf i gu r ation - Profi le: oooooss·fc oo ooo10 00 0 02sa-fOOOOO aooooos94 coo o oo10 . ..
W AVP: ~~,1;,Q.i,.;:,1,1,1~...uu.J.U...:l.....i..L...~1,i,1,..J.,==~==.u.u;.c_~~ ~-J
fil AVP : A 17 -APN-Conf igur at: ions-In cluded-Indi ca t or (1428) f =lll-1- vnd=TGPP va l = ALL,
6 AVP '. AP N-Conf i gu r at ion(1430) 1=272 f=IM - vnd=TGP P
AVP code: 1430 AP - conf ig ur ation
Ill A P Fl ags : 0 co
A P Length: 27
A P ven dor Id: 3GPP (10415)
s APN - co 1gurat1on: oooooss coooo o1000002sa 0 00 00 00 o oooo s ,ocooooo10 ...
AVP '. con x - Id n i f ier ( 142 ) 7- 16 f = VM - v nd TGP P val = l l
l+l AVP: PDN - Typ e(1 4 56) 7=16 f = VM- v n d=TGPP v al =I Pv4v6 (2)
AVP: service-se l ect:ion ( 493 ) 1=11 f=--M - val =i Rt5
ffi AP: EPS - Subscr ib ed - QOS- Profile(1431 ) 1 = 8 f =VM - n d=TGPP
[lJ AVP : VPLMN - Dynami C- Address - A l l o·.~e d(l432) I =16 t=VM - v nd=TGPP v a l =AL LOWED (1
!±J AIIP : MIP6-Agent -Inf o ( 486 ) 1=36 f=-M-
A P: PDN - W- Al l oc tion - rype(14 8) 7=16 f =VM - vnd=TGPP val=DYNAMIC (1)
AVP: AMIIR{14 5) l 4 f • VM - v n d TGPP
AVP: IPA- P r mi s sio n ( 1 61 8 ) 1• 16 f - v -- v n d- TGPP v.il LIPA- PROH ;rnrTED (0)
El AVP: AP N- Con 1 gu rat1011 1 430 = 276 = VM - vn =TGP P
AVP code: 1430 AP -conf i u ratio n
AVP Flags : 0 co
AVP L en gth : 276
A P ven dor Id : 3 PP 1 041 5
6 APN --<: on f i gur· cion : ooooo ssf coo oo o1000002safoooooooaoooo~cooooo10 .. .
AVP: c ontext - Iderrti ·f ier ( 1423) l 1 6 f - VM - vnd TGPP val e ;
AVP: PDN - l)'pe(1456) 1 16 f • VM - v n d TGPP val • IPv4v6 (2J
AVP: s rvi - sel c-tion ( 4 93) l = t 4 f = - - v~1 = ;111ernet
AVP: EP S-Subsc r ibed -QoS-P rofi le(l431) 1=88 f =IIM- v n d=TGPP
AVP: VP LMN-oynami c - Address - A1 1 01, e d(l432) 1=16 f=VM - v n d=TGPP v a l =AL LOWED (1
00 A P: MI P6- Agent - Info(486 ) 1= 36 f = - M-
ffi AIIP: PDN-GW-A1 1oc ac ion-Type(1438) 1=16 f=VM- v n d= GPP v a l = DYNAMIC ( 1 )
AVP: AMBR(l435) l -=44 f = VM - v nd= 'GPP
,1 AIIP: L IPA- Per mi s s i on 1 618 1~16 f ~v -- v n d TGPP val ~Li l'A- PROIUSITED 0

Figure 13. APN Configuration Profile

(8) The MME requests Sll (GTP-C) session creation by sending the Create Session Request to the SGW.
The Create Session Request contains the following parameters along with subscriber's information like
10/31
MSISDN, IMEI and IMSI.

• APN : the access point name to which the GTP-C session is to be established .
• PDN Address Allocation (PAA) : UE IP address. It is empty at this moment in time as no IP
address has been allocated for the UE.
• Serving Network: the MCC and MNC of the serving network which the UE is attached to.
• User Location Info: TAI, ECGI
• MME GTP-C TEID : Identifier of the MME as an end point of the GTP-C tunnel
• EPS Bearer ID (EBI) of the default EPS bearer
• QoS Class Identifier (QCI) : '9'

In this case the QCI value of "9" for the default EPS bearer has been allocated as th is is a PDN connection
with the " internet" APN .

NOTE The UE can have up to 11 EPS bearers in total and assign the same amount of EPS Bearer Id (EBI) from
5 to 15.

NOTE The SGW will also establish the GTP-C session with the PGW on SS interface which is not shown in this
flow.

s c r eat s e s ion Reque t

[±I Fl ags : Ox48
s ag Typ : Cr ea s ss ion Requ s ( 32 )
Message Length : 288
TUnn 1 ndpoint Id n ifi r : 0
sequence umber : 1487143
S ar e : 0
Int er na cional Mobi le su bscriber Ident i ty ( I SI ) : '.)0004 9980
~ Ace s Poi n am (A P ) : . mn . mcc . gpr
[±I Agg regate Maxi mum Bit Rate (A~ BR)
Mobi l qu ipm n I d nt ity (M[I ) : sio1 060 5914 506
[±I SISD, : 7021076930
Indi a i on :
[±I Pr ot ocol conf i guration options (PCO ) :
rn PON Ad ci r s Al loca i on ( PM)
1±1 RAT Type : EUTRA (6 )
s r ving e work : M c (R pub l ic of ), M
1±1 user Locatio n I nf o ( ULI) : TAI cCGI
ul l y Qual if i d Tu nn 1 &: dpoint Id •n i'fi r ( -T IO) S:U MM GTP - C in t rf.lc
[±I Ful l y Qual i f i ed Tunne l Endpoint I dent i f ier ( F-TEIO) 55/ 58 PGW GTP-C i m:erfa
Bar r con t : [Gr ou ped I£]
i±I PON Type : IPV4 / IPV6
1 uE 1·ime one :
ffi APN Restr i ct ion : val ue 0
:E Sel e t io n Mo de : s or n t wor k provided AP N, s ub sc r i bed ve r if·ied

Figure 14. Create Session Request

(9) Upon receiving the Create Session Request, the PGW assigns an IP address for the UE from an IP pool.
The PGW sends the Credit-Control-Request (CCR) to the PCRF indicating that this is an initial request and
requests the PCC rule for the default EPS bearer. The Credit-Control-Request ( CCR} conta ins the following
parameters in this example.

• CC-Request-Type AVP: "INITIAL REQUEST"

• Subscription-Id AVP: IMSI, MSISDN
• Framed-IP-address AVP : the allocated UE IP address
11131
 • QoS-Information AVP: APN-AMBR (UL/DL)
• 3GPP-User-Location-lnfo AVP: TAI, ECGI
• Call-Station-Id AVP: APN (Internet)
• Default-EPS-Bearer-QoS AVP: QCI, ARP

The following snapshot shows the CCR captured on Gx interface.

l!l AVP: sessi on I d (263) 1 - 73 f --M- v a 1- ,acxOOl. . c pc. mnc . mcc . 3gppnet wor k. erg; 143040-14 3
@ AVP: Auth - Applicat i on - Id(258) 1=12 f =-M- val =3GP P GX ( 16777238)
1-1 AVP: orig i n- Host(ZM) 1=52 f=-M - va l =, .~ aexOOl.ep .nine -.mc c ,. 3gµpner,o,·k.org
l'1 AVP : o rig1n- Re.alm(296) 1=41 f =-M- va7=e.p .mnc . mcc, . 3gppn@rwork. org
l!l AVP: Dest i nat i on- Realm(283) 1"'11 f --M- va l epc.mnc . mcc . 3gppnetwork .or g
l!l AVP: CC - Request -Type(416) 1~12 f --M val • I NITLAL_REQUEST tl)
AVP: cc-Request-Number(415) 1=12 f=-1<- val=O
i,J AVP: en,otk - Reque t - . ur1> r'C(.l02d) 7=16 f=IM - vnd=1 PP al=N . n,.()R K QU UPPOnEO (l)
1B VP: Subscr i pt i on - rd(443) l ...!14 f =-M -
[E AVP: Sub script io n- Id(44 3) l 0 f M-
@ AVP: supported-Features(628) 7=56 f=VM - vnd=TGPP
lrJ AVP: r am d - [P - Addre~ ( ) 1=12 f= - M- val=l00 .64. 50 . G (100. . 50 .86 )
CE AVP: Framed-IPV6-Prefix(9) 7=18 f=-IY.- val=240S : 204 : 0 : 3~eo , : / 64
l!J AVP: IP - CAN - Typ c(1027) 1-16 f - VM - vnd• TGPP v al - 3GPP - ~PS (5)
@ AVP: RAT- T}'pe(l032) 7=16 f mV-- vnd=TGPP val =EUTRAN (1004)
Fl AVP: r-Equ i pment - 1nf o(458) l=d4 f=- --
AVP: Qo -mformarion(\0-lo) 7=44 f=v,.,- vnrl=TGPP
c.J AVP: lGPP - SGSN- MCC I/C(l8) 1= 1 8 f = V -- v n d- TGPP va l=
l!l VP: 3GP P- User - Location- Info(22) l - 25 f Mv -- vnd• TGP P val - MCC (Rep ublic of) , ~~
~ AVP: called-station-id(30) l =ll f= -M- val=IMS
W AVP: V n - Repor - H1di a ion( OH) l =4A f=V -- vnd= GPP
l±l A\IP: Access - Nen10rk - Charging - Address(50l) 1=;0 f =VM - vnd=TGPP al=240 : 00 · 31.0: 7 : : lO (2405
l!l ,WP : Defau'lt - EP S- Bearcr Qo5(1 049) 1- 88 f - v - vnd TGPP
1B VP: 3GPP~~s-Timezone(23) 1=14 f =v-- vnd=TGPP val=Timezone : CMT + hours minutes o ad
AVP: AN - G' - Addr s (LOSO) 1=30 f=v-- vnd=TG PP val=2405 : 200:31 0 : 7 : :10 (2405:200 : 310 : 7 : :10)

Figure lS. Credit Control Request

(10] Upon receiving the CCR, the PCRF determines the PCC rule based on the received subscriber's
information and responds with Credit-Control-Answer {CCA} including a PCC rule(s) . When it comes to a
default bearer, the PCRF may include only a PCC rule name which indicates the predefined PCC rule locally
stored in the PGW. Henceforth, the PCC rule is applied to all the traffic by the PGW.

fiJ AVP: Sessfon - Id(Z6 3) 1~73 f- - ~ - val- 1 saex001.epc.mnc .mcc .Jgppnet:<orlc:.org;14 JO..o•• JI ; D4>91 ; 32
l!J AVP : •esul c - code(268) 1-12 f- -M- val -01mnrn_succrss (2001)
AVP : Orig-in-ttos t (264) l= S2 f = -M- val= pcr f OOLepc.mnc .mc c .3gppnetwork.org
AVP: or ig in-Real m( 2. Q6) l=-41 f = - M- val = e-pc . mnc . mcc: . 3g,rpnecwork . or~
ill AW: Auch Appl icac1on Id(2>8) 1- 12 f - M val - 3Gl'I' GX (16777238)
AVP : CC-ROquest-ry~e(416) 1=12 f =-M- val =INITIAL_REQUE.5T (1)
AVP : C:l-Rf:'fj1Je-=;-r-Number(41. ~ ) l=l } t=-M- va l=O
1,1 VP: harg i n9- Ru lc Ins all(lOOl) 1- 60 f - SN- v nd- -rGPP
AVP : E\f(!l'L [ - Tr imJg;f"(1006) l ,.,16 f,..VM - \llld=TGPP Vd.l ~E:VAL..ID.i.\ T ION_TIKEOUT (17)
Iii AVP: Even -Tr i gger(l006) 1=16 f=\.M- vnd=TGPP va l =tl SAGE___RE PORT (H)
fiJ AvP: [venc -Trigger(l006) 1-16 f-"" - vn(!"TGPP val -t.OSS OF BEA~ER (1 001)
t+I AVP; QOS - toforma.c.1on(.1016) 1-44 f-~1 - vnd-TGPP
el AVP : 6earer-Control-r.-.ode(1023) l o::16 f =\lt~- vnd=TGPP val=UE:_t,,"W (2)
AVP: Default: - FP~-oea r er - QQ5 (1049) l "RS f-V -- v nd-TGPP
l!J A'VP; So pporced - FCil(Ure:s.(628) 1- 56 f - V· vnd- lGPP
AVP : Revali datfoo-Time(10<12) 1=16 f•VM- vnd=TGPP va l =Jul 31 , 2015 1S:d2 . 30.000000000 UTC
IB AVP: bs agP -Monitor i ng-Tntor mar iQn (106 7) l:::.iifl t-v-- v nd=TG.P P

Figure 16. Credit Control Answer

(11] The SGW/PGW completes the GTP-C session creation procedure by sending the Create Session
Response. The Create Session Response conta ins the following parameters:

• AMBR : Aggregated maximum bit rate that is allowed for this APN
• EPS Bearer ID : 5
12/31
 • Protocol Configuration Options (PCO) : P-CSCF IP address, DNS IP address, etc, based on the
requested configuration information by the UE in the Attach Request
• PDN Address Allocation (PAA): UE's IP address
• SGW GTP-C TEID : Identifier of the SGW as the end point of the GTP-C tunnel
• Bearer Context: the information of the S1-U default EPS bearer to be created, which contains
EBI, SGW GTP-U TEID, QCI, etc

13 ,·e t e sess i on Res ponse

HJ !'lags: O 4 8
M ~s ag Typ : Cr ea s cs i on R sponse ( 3
Mes s age Leng h: 263
Tunne l Endpoi nt Identif i er : ld9ll8321 3
Sequence Number: 1487143

t,, c ause Requ es t a cep-r ed (16)

m Recover y (Re star t cou nt er) 12 7
m Aggr gat Maxi mum Ri t R.it (N•1BR)
ffi EPS Bar r I D ( BI) : 5
Pr o ocol c onfi gurat ion opt ions ( PCO)
PON Address Al l ocation (PAA) :
Ful l y Qual i f i ed Tunnel Endpoi nt I dent i ier (F -TE I D) SU/ 54 SGW GTP - C i m:er f ac
i,, u l l y Qu al i f i ed runr, el Endpoi nt i dent i f i er (f' - TE.ID) sS/58 P '" GTP- C i ncer f ce
a s earer conc exc ; (Gr ouped I E]
[l] APN Res·tr i ct: i on : valu e O
m Cha ng R por ting Action : s op Re por i ng

Figure 17. Create Session Response

Ill. Default EPS bearer creation

Once the signaling path is successfully set up, the MME requests the eNB to activate the default EPS bearer
with the SGW and the UE. The eNB establishes S1 bearer towards SGW and the Data Radio Bearer (DRB)
towards the UE. The SGW will also establish the S5 bearer with the PGW, which is not shown in this flow.

13/31
 ~
I UE I I MME I l sGW/PGwl I POff I I IMS I
12.Attach Accept [Activate Defa It [PS B"" rer Co text Request]
UE-AMBR, Timej- [T3412, T3402, T3 24), TAI-list, GUTI, 'SI~ m essage cont , ner
(EPSQCl=9, APN PDN address, PCC APN·AMBR, QoS)
r- -------- - ------ - -- --- ---- - ----
Initia: I O>ntext Set:1.4> R~;_;n-:
' , EBI, SGW Sl-U GTI TEI D :
' ,
RRC C<nn..ection flea nfig1.nation
J
''
' ------------,t -- --------------- ''
·--
_.,_..
8 • ~

'
' nfiguration CompletE

.
RRC C:OOnection Reo
~ ULS1 beare established
•
l nitia I C.Ontext sec:~ Response

13. Attach Come Jete [Activate De au lt EPS B"" rer <ont extAcc ept]
- ---------- -------- -------- ----
U RRC Upiil'lk Di"ectTransfer ·;
: Up~nk NAS TaMport ''
,. .......... ---- '"'""""'" .................................. '
14. Modify Bear rRequest
Bearer Centex [EBI, GTP-U TEID)
DL S1 bean r e stab/is hed
..
"
15. Modify Bear rResponse
Bearer Centex (EBI, GTP-U TEID), ause

EPS default bearer for the default APN (\

•
• J '
- [ 2] RRC-4t---[3] SlAP---¥---(8] GTP-C-¾--[9] Gx~
·. --- -NAS Security- -~

,r [ 12] DRB~ [14 ] S1/55 bearer(QCl=9 ~

Figure 18. Default EPS bearer creation flow

(12] The MME accepts the initial attach request by sending the Attach Accept and requests to activate the
default EPS bearer to the UE which contains Activate default EPS bearer context request in the ESM
message container. The NAS message (i.e., Attach Accept in EMM layer, Activate default EPS bearer context
request in ESM layer) contains the following parameters.

• TAI list : the list of Tracking Area Identity within which the UE doesn't need to send Tracking Area
Update (TAU)
• EPS QoS : QCI (9)
• Access Point Name (APN) : Internet APN
• PDN address: the allocated UE IP address
• APN-AMBR: the maximum aggregated bit rate allowed for this APN
• Protocol Configuration Options (PCO) : DNS IP address, etc, based on the requested
configuration information by the UE in the Attach Request

14/31
 B •on-Acce.s s - s-cra1:um (l'IAS)PDU
00l0 .... = ~e.cu ril y h arier ryp I 11 te. gr-fty pr o r d and c1 p he r d (2)
.. . . 0111 - Pr otocol disc ri minator: [ PS mobil i ty management me.ss age.s (Ox07)
Me:ssa.ge aurhe.ncication cod!!: Ox.446cf003
seq L1 er,ce number: 2
0000 . . . . Security header t:ype: Plai n (0)

.. . . . 001 - At:tach r es ult: EPS on l y ( 1 )

PRS Ti
isl - TAT lis t
l3 [:SM rn0ssage contai ner
vng,h: 1<1
Fl ESM message containe r contents: 5209c101091a066a696f6e6574066d 6e6338J734066d6363 .. .
0101 .. .. - £PS bearer identi ty: £PS bear er i de nt icy val u e 5 (5)
0-010 = Proto o l di · c: rimina or : EPS :..e s. lon mo nr1,g e_m n m ~Sd:ges. (Ox02)

.
~ Access Point Name
PON ;:i d dress
Li nke d TI - Transaction ident if ier
~ Qu ality Of servic~ - Negotiated QoS
gr1 e mrax i mum b it f"~l
onf iaurati on o t.ions
e em ry - r.un
E M cause
;JJ GPRS Timer - T3402 val ue
al GPRS Ti m r - T 4l1 v ~l u
PU-\fN List - Eqviva.lent PLMNS - 7 PLM
;:n ~PS net'NOr k: f ea tur e su ppor t

Figure 19. Attach Accept (Activate default EPS bearer context request)

The above NAS message is contained in the Initial Context Setup Request message on SlAP interface. Other
than the NAS message, it also contains the following parameters.

• UE-AMBR : Aggregated maximum bit rates for the UE (UL/DL)

• E-RAB ID : identifier of the radio access bearer towards the eNB
• SGW GTP-U TEID : identifier of SGW as an end point of the GTP-U tunnel which was delivered in
Create Session Response (step#ll).

15/31
 B I nir i al comextSetupRequest
B pr orocolIEs: 8 ir."'11s
Cll nem 0: id- MME - U[ - Sl.AP- ID
Cll Item 1 : i d- e NB- UE- SlAP- ID
Fl I tem 2: i d- uEaggregat&.aximum6itrate
F ProtocolIE-Fie l d
id : i cl - u~dggrega.te111axi mumB ·ftrace (66)
cr i i ali y: r jec (0)
"' value
B UEAggregare~axi mumBi trate
uEaggr"{JateMax1mu~B1r.Ratelll.: 104857000
ucaggregate~axi mumBitRateUL: 524 28000
El I tem 3: i d- E- RABToBeSetupList c txtSLReq
B ProtocolI E-Fie l d
id: i d-E-RA.BTO!lesetu pl istctxtSUReq (24)
r i i l f y: reje (O)
- vnlu
B t-RABToBe erupLiSt CtXtS UR eq : l ir.em
B I t run o, i d- E- RABToBeSetupitemc r xr. SUReq
G Prot.oco ·1It.- si ngl {;!Cont.a i ner
i d: i d - E- RABToBeSetupit emct xtSUReq (52)
cr it i cal ity: rej ect (0)
El value
El E- RABTo6eSeLupitemctxtSUReq
e - ll.A6 - ID: S
e- RA6leve1Qo Paramer r
0 ... . _. _ i::x,::;ens i on Pre.sient Si : ~al se
B transportLayerAddress: 405020003100008000000000000001 0 [ bit leng,h 1:
rra.nsport Lay or Address(IPv6) : 2,105 : 200: 310: 8: : 10 (2405 :200: 310 : 8 :: 1 0:
gTP - TEIO: Of9b 502 2
nAS- POU: 2 44 6cf00)020742014 94 c4e0445780010044 5 800110445 ...
on-Access-St r a~um ( AS) PDU
J Item 4: 1d-uEsecur i tycapabi H ti es

Figure 20. Initial UE Context Request

Upon receiving the Attach Accept and RRC Connection Reconfiguration, the UE establishes a DRB with the
eNB and responds with RRC Connection Reconfiguration Complete to the eNB.

The eNB establishes the uplink 51-U bearer with the SGW. After successful GTP-U establishment, the eNB
responds with the initial UE Context Response to the MME. In this response, the eNB contains the eNB GTP-
U TEID, which will be routed to the SGW via the MME and used to identify the eNB as an end point of the
GTP-U by the SGW.

NOTE The SGW GTP-U TEID is generated by the SGW and transparently routed to the eNB via the MME
contained in Create Session Response and Initial Context Setup Request on 511 and SlAP, respectively. In
the same way, the eNB GTP-U TEID is generated by the eNB and transparently routed to the SGW via the
MME contained in the Initial Context Setup Response and Modify Bearer Request at step#l4.

16131
 El I ni t i a l c om e xcse tupRes ponse
prot oco l IEs: 3 i tems
~ I t m 0: id - MM - U - SlAP- 1 0
~ It em 1 : i d - eNB - Ue - S1AP- I D
Hem 2 : i d- -RABS e t upLi s t CtXt SURes
R Pr otocol I E- • i e l d
i d : i d - E- RABSet upL i s t CtxtS URes ( 51 )
c r i t i cal i ty : i gnore (1 )
a-~----------------------------------~
8 ~- RASSet up ListCtxt URes : i t em
El It em 0: i d- E- RAG Set upi t emctxt SU Res
El Pro cocol I E- i ng l e on t a i ne r
i d: i d- E- RABSecupi temctxtS URe s ( 50 )
cr iti ca l i y : ig nore (1 )
El val ue
l::l E- RAB ec upn e ex es Res
e- AAB- I D:
. __o 1;:xt e:ns i on Prese:nt Bi t: : i: a l sQ

.
El c r a n por t LayerAddr e s : 2405020001010 70000030 00201010 0fe [ bi t le
t r anspo r t Layer Addr ess ( I Pv ) : 2405 : 200 : 101 : 700: 3 : 2 : 101 : f e ( 24 5
:••··

Figure 21. Initial UE Context Response

(13] The UE confirms the Attach Accept and informs the MME of the fact that the default EPS bearer has
been activated by sending the Attach Complete, which contains the Activate Default EPS Bearer Context
Accept as a response to a corresponding request .

.:tl It em O: i d- f1 M( - UE'. - Sl AP- I O

'ii rum I ; i d - eN O- UE- SlAP - ID
3 It Pm 2 : i d- N.AS-P DU
13 PT Ot0C-Ol I E- J: 'i e l d
i d : i d - NAS PDU (26 )
c ri r i c ;i li t r e · ec t O
8 v c:1.l ue
NAS- PDU: 2785b0lb6e02 074 30003 5200c2
a No n- Access - st r at um ( NAS)PDU
0 010 _ . . . = se cur i ty heade r type : I nte gr ity prote c ted •m d ciJJ her ed (2)
.. . . ou 1 - Prornco l di scr imi nator: EPS mobi l l cy management mess ages (oxo7)
Mes sage au·chent i cat ion code : OxS b01b6e
sequence numbe r : ")
0000 . . . . - se: c: ur i ty heade r t ype : Pl ai n NAS mes sage , not s cur-1 t pr·ocect ed ( 0)
.. . , 0111 - r,rotoc ol di scrimi nator- : E:PS mob i l i t y manag-cmcnt mess ages (OxO/ )
NAS EP S Mobi 'li 1: y 1,1 3nagement Mess age Type : AT'tarh rom[ll er e ( O'X4 3)
E: !:.SM me:,,s.age cu nt a i ner
Lengt h : 3
G ESM mes sage conta i ner content s : 52 00c2
0101 . _ . = EPS be.r1r er ·i dent i ty : :F.: PS hea r- e r ident ·i t y val ue 5 (5)
. . . . 0010 - Pr ot oco 1 di scri mi nat or ·: 'E'. PS se.s sion management mess ages (oxoi)
Procedure t ransact i on ide nt ity : 0
NAS F?S 5e~sion management me ss ag e5 : Artivatf def au] t FPS bearer £2Dtf:Xt 9£CPPt (0X£2

1,w11@1r&Mi:Ot-•

Figure 22. Attach Complete {Activate default EPS bearer context accept)

(14] The MME sends the Modify EPS Bearer Request requesting the SGW to establish the downlink S1
bearer towards the eNB. The Modify EPS Bearer Request contains the following parameters:

• EPS Bearer ID : identifier of a default EPS bearer (5)

• eNB GTP-U TEID : identifier of the eNB as an end point of the GTP-U tunnel

17/31
 B Modify Bearer Request
1±1 Flags: Ox48
Message Type: Modify Bearer Req uest ( 34)
Message Lengt h : 49
Tu rmel Endpoi nt I de ntifier: 218304544
seq uence Number : 1487146
spare: O
1±1 I ndicatio n :
B Bearer context : [Grouped I E]
I E Type: Bearer conte xt ( 93)
I E Lengt h : 30
0000 .... = CR flag: 0
.... 0000 = Inst ance : 0
B EPS Bearer ID ( EBI ) : 5
I E Type: EPS Bear er I D ( EB I ) (7 3)
I E Length : 1
0000 = CR flag: 0
0000 Instance: o
0000 = Spare bit ( s ) : 0
0101 = EPS Bearer ID ( EBI ) : 5
B Full y Qualified Tunnel Endpoi nt Ide ntifier ( F-TEID) : Sl-U eNodeB GTP-U
I E Type: FUll y Qualified Tunnel Endpoi nt I de ntifier ( F-TEID) (87)
I E Length : 21
0000 = CR flag: 0
0000 = Instance: o
0. .. = V4 : I Pv4 address not prese nt
.1 . . = V6: IP v6 address prese nt
.. oo 0000 = Interface Type: sl-u eNodeB GTP-U interface ( O)
TEID/ GRE Key : Ox0380060c

Figure 23. Modify EPS bearer request

Upon receiving the Modify EPS Bearer Request, the SGW establishes the Sl bearer towards the eNB.

(15] The SGW responds with the Modify EPS Bearer Response.

a Mod i fy searer Re ponse

1B Fl ags : Ox4
Message Type : Mod i fy s ar er Res pon e (35)
Me ssage Lengt h: 54
Tunnel Endpoi c Ident ifi er : 149118 3213
s eque ce umb er : 14871 4
s ar : O
m c aus : R ques t accept 16
8 Bear er Contex t [Group ed I E]
IE Type : Bearer com ext (93)
IE: Lengt h: 36
0000 . _. - CR flag : 0
. _. _ 0000 I nst ance : O
P Bear er IO (EB J. ) : 5
GJ ca use : Request accept ed (16)
DIFUl_ y Qua 1 1e Tunne En point I ent1 ,er F-TEID 1:1 s1 ~UI SGWl GTP-= Ul rnter,face

Figure 24. Modify EPS bearer response

IV. PON Connection to IMS APN

So far, the UE has performed the initial attachment procedure with the LTE network and as a result, the PON
connection has been established between the UE and the default APN, i.e., internet APN. After successful
18/31
PDN connection with the default APN, if the default APN is not an IMS APN, the VoLTE UE initiates an
additional PDN connection procedure with the "IMS" APN .

UE eNB MME SGW/PGW PCllf IMS

16. PDN Conn tivity Request

(APN=IMS, PC

: RRC Upli.nkOirect.Tra.Mfer
Uptink riLA.s Tansport :

17. CreateSessi Request

IMSI, MSISDN, PN =IMS,PCO, AMB , TAI ECGI, MM E
GTP-C TEID, B er Context (MBR, BR, QCI )

.. EJPalJoaJtKm ~~•' 1 - - - - ' - - -...i

lnitialReques_ bs<:ription- ld( e.g., I 151),
UE-IP,APN, Event- eport, Qo5 lnfo(AP -
AMBR(UL/DL)), E S Bea- erQoS(QCI, RP ),
3GPP-U9=r -locati (ECG I, TAI)

19. CCA ICred it- ntrol-Answer)

dic'y Enforamen r
s, PCC rule name,
QoS (QCI, ARP)

2Cl Create Sessi Response

AMBR(UL/ DL), E b earer ID, PCO, W GTP-C TEID, Bea er
Context(EPSb ear ID, SGWSl-U TEI , QCI )
21. Activate def ult EPS bearer c ntext request

E-RAB Setup Request

RRCc.on.nection Remnfiguration.

~~~-~-n~:~•R•• nfiguranon~mp~r ....

UL S1 bean, [ established

22 . Activated a ult EPS bearer

RRC Uplink Di"ectTransfer ,

1 UplinkNASTansport :
I --------------- ------------ - - • _:

2] RRC----¥--[ 3] SlAP
- - - -NAS Securitv-- - - l [9 ]G x]
[12 ] DRBj [14] S1/S5 bearer (QCl=S)
[17] GTP-C [18 ] Gx
1
[21] DRB 1

Figure 25. PDN connection with IMS APN flow

(16] The UE requests to establish an additional PDN connection with the IMS APN, which is typically used for
VoLTE. There is no need of establishing RRC connection at this stage as it was already established at step#3.
In this message, the Access Point Name (APN) is set to "IMS" and the UE may request the P-CSCF address
and it is indicated by the Protocol Configuration Option (PCO) parameter. The following snapshot shows an
example of PON Connectivity Request which is contained by the uplinkNASTransport SlAP message.
19/31
 El , on-Access-strat um ( NAS ) PDU
0010 . . . . • ur i ty ha d r cyp . I nt gr i t y prote t: d and cipher ed ( 2 )
. . .. 0111 = Prat: ocol di scr imi nato r : EPS mobili t:y management: messages ( Ox07)
Mess age aut hent icati on code : Oxc6136555
equence number : 3
0000 . . . . = EPS bear er i dent i ty: o EPS bearer i de nt i t y ass i gned (O )
. . .. 0010 - Pr o ocol di cr imi nat or : ~PS sess i on manag m n messages (Ox0 2)
Pr ocedur e trans cc io n i dent: i t y : 10
NAS £PS s es s i on management messages : PD connect i vi ty r equ est (OxdO)
0011 . . . . = PO ype : IP V4V6 ( 3)
. . . . 0001 = Re quest t ype : ini t i al r eq uest (1 )
s Access Point Name
nt I D: 0 28

,.) Pt r m~l f i gura i •on Option

El ement ID : Ox 7
Lengt h : 38
[L i nk dire t ion : MS t o n t work (O )]
1.. . . .. . = Extens ion : True

rnet Prot o ol c ontr ol Proto

ser ver IPv4 Addr es s Request:
or container I D: DNS ser ver IP v6 Addr ess Req uest (0 0003)
or ontain r I D: P- s I PV6 Addr ess R que ·t (OxOO Ol)
or cont ainer I D: P-CSCF I PV4 Add ress Requ est (OxOOOc)
or on ai n r I D: I P addr es al l a i on via NAS s i gnal l i ng ( OxOOOa
or container I D: IPV4 Li nk TU Request (Ox0010)

Figure 26. PDN connectivity request for IMS APN

(17] Upon receiving the PON Connectivity Request, the MME sends Create Session Request to the SGW.
Refer to step #8 for overall description .

• APN : "IMS"
• MME GTP-C TEID: the same TEID that was allocated at step #8. The MME and the SGW use the
same TEID for different PDNs.
• EPS Bearer ID (EBI): '6' in this case as the EBI '5' was already used in step#8. The EBI will be
incremented along with a new EPS bearer.
• QoS Class Identifier (QCI): '5' for IMS signaling.

20/31
 B c reate ses ion Requesi:
@ Flags: Ox48
essage Type: reate e ion R quest (3)
Message Length : 291
T unnel Endpo i m: Ident i fi er: 21830454d
equenc Number: 1457149
spar e : 0
@ t n ernationa1 Mob i le subs cr iber raem:ity (IMST) 000 49980
r,;i Ace ss Point: Name (APN) : i m . mn . mcc . ypr
Agg r egate Maximum Bit Rate ( A"IER)
"lohile Equip.~ nr Idem: i ty (~ET) : 3S20710605 14506
i,J MSISON : 7021076930
@ Indication :
Pro ocol configuration op ions (PCO) :
PUN Address Allo atlon (PM)
E: RAT Type: EUTRAN (6)
rving N twork : MC (Republic of). MN
use r LOCdtion Info (ULI) : TAI ECG!
~ Full ualif i ed Tunnel End oint I denti f ier F- T ID 511 MME. GTP - C inte rfac e T[J D G
l+l Full y Qualit i d Tunnel Endpoint: Iden itier ( F- TE:ID) 55 ss P P- C int rface, TE.ID
B Bearer c on t ext : [ Group ed IE]
IE Type: sea r er context (93)
n
n . Length :
0000, .. . - CR flag: 0
.. . . 0000 = Instance: O
t ' EPS ~ea er IU (EBI) :
~ s earer L eve l Qua l 1ty of service (searer QoS)
' P[)N Typ : TPV4 / TPV6
u Time zone :
a:;- APN Restrict i on: val ue 0
1 eCT i on Mode : M or ne work provi d d APN, ub crib d ver i tied

Figure 27. Create Session Request

(18] Upon receiving the Create Session Request, the MME sends CCR to the PCRF. Refer to step #9 for
overall description.

[!] A\IP: session- Id(26 3) 1- 73 f -- - v al - mu1saex001.epc . mnc .mcc . 3gppnet Nork . org;14 304Q4,
[!] AI/P: Au t h - Appli cati on- Id(258) 1. 12 f --M- val - 3GPP GX (16777238)
1,1 AVP: o r igin- Host(264) l - 52 f --M- val ul.saexOOl. epc. mnc . mcc . 3gppnet wor k.or g
[!] AVP: o r igin - Realm(296) '1=41 f =~'4- val - epc. mn c . mcc . 3gppnetwor k. org
[!] AVP: Oestination- Real m(283) l -"l l f - =r yarepc mpc mcc 3gppnetl'/or· k. org
[!] AVP: CC - Reques t - Type(416) 1=12 f =-M _ val = ~NTTIAL RE.QUEST (1)
I,] AVP: CC - Request - Number(415) 1 =12 f =-M- va .,<J
!
Iii A\IP: Network -Request - Support:(1024) '1=16 f =VM - v nd=TGPP val = N£Th,'ORK_R!;:QU£ST S PPORT[D ( 1 )
r,J AVP: subscript ion-Td(443) 1=-1 f=..,.-
[!] AVP: Subscription -Id(4 <13) 1=<10 f=-,M-
I,] A\IP: suppor t ed-~eatures(628) 1=56 f=VM- v nd=TGPP
Iii AVP: "ramed-IP-Address ( 8 ) 1=17 f=-M- val=l . 4 . 50.8 (100 . 64. 0.8
13 AVP : Framed-TPv6-Prefix ( 97 ) l =U f=-M- va1=240 : 204 : 0 : Be0 : :/ 4
Iii AVP: lP-CA -Typ<>(1027) l =l.6 f =VM - vnd=TGPP val =3GPP-~P (;)
H A\IP: RAT-Type(103) l=l6 f =V-- vnd=TGPP val = oUTRAN (100~)
Iii AVP: user-Equipm<>nt-lnfo (4 ) '1=44 f=~--
r±J AVP : Qo - I nform.ition(1 016) 1=44 f =VM- vnd=TGPP
hi AVP: 3GPP - G N-i'< < - (1.8) 1=18 f=V -- vnd=TGPP val=
I AVP: 3GPP- l}S r - Location - rnfo(n) 1= 2~ f =V- - v nd= GPP val =M (R public f), M
AVP: Call d - ation - Id(30) l =l l f = - M- va l=IMS
[•l AVP: tven - Report - 1nd rcat1on ( I033) 1=44 t =V - - vnd=I PP
H AvP: Acee S- NHwork - .hargi ng - Add<" s (~Ol) 1=30 f=VM- vr•d=oGPP va1 = 2405:200:310; 7 : :10 (24(
I AVP: D~ f ;i,Jl r - •P - 1\e:irPr - oo Cl049 ) l =!!B f =V-- vn<l=l GP ~
hi AVP: 3 PP - MS - Timezon (23) 1=14 f =v-- vnd=1GPP val =,irnezone : GMT + hours 30 mi nvtes No :
C•l AVP: AN- GW- Addre (1050) 1= 30 f =V-- vnd=TGPP val = 2405 : 200 : 310 : 7 : :10 (240 5 :200: 310:7 : : 10)

Figure 28. Credit-Control-Request

• CC-Request-Type AVP: "INITIAL REQUEST"

21/31
 • Framed-IP-address AVP: The UE IP address is different from what was allocated at step #9. The
UE is allocated with different IP address per PDN.
• Call-Station-Id AVP: IMS APN
• Default-EPS-Bearer-QoS AVP: In case of IMS APN, the default EPS bearer has a QCl=S.

(19] Upon receiving the CCR, the PCRF responds with CCA containing the PCC rule of the default EPS bearer
for IMS APN . Refer to step #10 for overall description .

r;:i AVP: S"-Ssion- Id(263) l - 73 f • M- val • saexO Ol . epc. mnc . mcc . 3gppnecwork. org;l
~ AVP : Res ul - c ode(268 ) 1=12 f =-1 - val =DIAMETI. SUCCESS (2001)
ltl AVP : o r 1g1n- Ko (264) 1=5 2 f =-M- va l= pc rf OOl. pc. rnnc . cc . 3gppn t:work . or
AVP: origin- Realm ( 296 ) 1=41 f =-M- val =epc.mnc . mcc . 3g ppnet:wor k.org
@ AVP: AUt h- Appl i cation- Id( 2S8) 1=1 2 f =- - va l =3GP P GX (1 677 72 3 )
AVP: CC-Req uest --rype(41) 1=1 2 f=-M- val =I NITIAL_ REQUE ST (1 )
..i AVP: cc - Requ - Number (415) 1=12 --M- v 1~0
8 AVP: charging- Ru l e- In5tal l (l OOl) l 32 f \IM - vnd TGPP
AVP code: 1001 c hargi ng - Rule- Insta ll
00 AVP Fl a gc: OxcO
AVP Lengt h: 32
AVP vendor I d : 3GPP (10415)
c ar gi ng-Ru e-Insra e c
13 AVP: Chilr gi ng - Rul e- Name (lOO S) 1- 20 4 55f4 94d5
AVP c ode : 1005 charging - Rul e- am
13) AVP Fl ags : Oxco
AVP Leng h: 20
AVP Ve ndor I d : 3GPP
Char i n -Ru l e-N ame:
r;:i AVP : venc - Tr , gger l OOb va =QO _CttANG 1
r;:J AVP: vent - Tr i g.ger (1006) 1• 1 6 •f - vr-1- vnd- TGPP val RAT_CHANGI'- ( 2)
@ AVP: oven - Tr i gg r(1006) 1• 16 f - VM - vnd• TGPP val TFT_CHANG~ ( 3)
~ AVP: ven - Tr i gg r(l 006) 1=16 f =VM - vnd=TGPP v~l=PLM _CHANGE (4)
AVP : Event-Tr i gge,(1006) 1=16 f=IIM- vnd=TGPP va l =IP-CA _CHA GE (7)
~ AVP: QOS - Inf ormat i on(l016) 7=44 f =VM- vnd=TGPP
AVP: Bear er-c onc rol-Mode ( l 023) 1=16 f =VM- nd=TGP P va·l=u[_N'il (2)
AVP: oefaul t - E'.PS-aearer - Qo5 (1049) 1=88 f =V- - vnd = GPP
m AVP: Su ppor ·ted - Fea t ures(628) l 56 f v-- v nd TGPP

Figure 29. Credit-Control-Answer

(20] Upon receiving the CCA, the MME responds with Create Session Response containing the PCC rule of
the default EPS bearer for IMS APN . Refer to step #11 for overall description.

• EPS Bearer ID: '6'

• Protocol Configuration Options (PCO) contains P-CSCF IP address and will be del ivered to the UE.
• PDN Address Allocation (PAA): UE's IP address and will be delivered to the UE.
• SGW GTP-C TEID: The same TEID that was allocated at step #11. The MME and the SGW use the
same TEID for different PDNs.
• Bearer Context contains the SGW GTP-U TEID for the default EPS bearer which is different from
what was used in step #11.

22/31
 1±1 cause : Request accepted (16)
1±1 Recovery (Restart counter) : 127
1±1 Aggregate Maximum Bit Rate (AM BR)
1±1 EPS Bearer ID ( EBI ) : 6
El Protoco l cont 1gurat1on options (PCO)
IE fype: Protocol configuration Opt io ns ( PCO ) (78)
IE Length: 41
0000 .... = CR flag: 0
.... 0000 = Instance: o
[Link direction: Network to MS (1)]
1 ....... = Extension: True
configuration Protocol: PPP for use wit h I P PDP type or IP PDN type ( O)
1±1 Protocol or container ID: DNS ser ver IPv6 Address (Ox0003)
1±1 Protocol or container ID: DNS ser ver IPv4 Address (OxOOOd)
Container I D: P-CSCF I PV
P-CSCF IPV4
ress oca 1on
IE fype: PDN Address Al locat io n ( PAA) (79)
I E Lengt h: 22
0000 = CR flag: 0
0000 = Instance: O
.011 = PDN fype: IPV4/ IPV6 (3)
IPv6 Prefix Length: 64
PDN Address and Prefix(IP V6) : 24050204000033e00000000012dfOOaO
PDN Address and Prefix(IP v4) : 100.64 . 50.86 (100 . 64 . 50.86)
1±1 Fully Qualified Tunnel Endpoint I dent1 f 1er ( F-TEID) Sl l / S4 SGW GTP-C int
1±1 Full y Qual ified Tunnel Endpoi nt Ident ifier (F-TEID) : S5 / S8 PG\• GTP-C inte
1±1 searer context : [Grouped I E]
1±1 APN Restriction : value o
1±1 change Reporting Action : Stop Reporting

Figure 30. Create Session Response

(21] Upon receiving the Create Session Response, the MME requests to activate the default EPS bearer by
sending Activate default EPS bearer context requesttowards the UE, which is contained in E-RAB Setup
Request on SlAP interface. The E-RAB Setup Request is used to assign resources on Uu (i.e., air interface
between UE and the eNB) and 51 for one or several E-RABs. The following shows parameters contained in
the E-RAB Setup Request.

• UE-AMBR (UL/DL): The aggregated maximum bit rate of the UE associated with the same PDN.
• E-RAB to be setup parameters contains E-RAB ID=6 and SGW GTP-U TEID which was delivered at
step #20.

The following shows parameters contained in the Activate default EPS bearer context request

• EPS QoS QCI = 5

• Access Point Name {APN): "IMS"
• PDN address: The newly allocated UE IP address
• Protocol Configuration Options (PCO) contains the P-CSCF address which was delivered in step
#20.
• APN-AMBR: aggregated maximum bit rate for the same APN.

23/31
 ~ E- RABTo6eSetupLis tBear e~SURe q ~ 1 i tem
E3 Item O: i d-E-RABToeesernprremBearer·su Req
5 Pro·t oco1IE-Si ngl econ-ta i ner
i d: i d- E- RABToBeSetu pi t <!IIIBeare r SUReq ( 1 7)
r i l i 3 l l y: r j Cl ( 0)
G valu e:
d F. - RAti,l' s seru pn : emf:l.t:-a n w ~UR@g
e - RAB- ID : 6
If. e-RABl e e l QoSPa r amecer.s
O. , . . .. . Ext:ens i on Pre.sent Git; False
t r ans ponL.iyert,ddre.ss: 24050 000310000aOOOOOOOOOOOOo010 (bi t 1 engch 128]
gTP -TEIO : (Tf 9b S422
MS - POU: 75 aa9020804620ac101091 703696d73066d6e 6338373406 . . .
8 N n - ACC s - si:ra,um ( S) PDV
0010 . .. . - s ec uri cy head er type: I ntegri t y procected and ci pher ed (2)
OHl = Pr otocol d1scr1•1i nacor : EPS mobil i ty m~ na9eM1 nt messag s (Ox07)
Message a ut:hentication code: OxSaa9020 8
s~qu nee number: 4
QUO . . = EPS b earer identi ty : EPS b ear er ident i y va l ue 6 (6)
0010 - Pr oTo co1 discrimi na~or: [ PS session management. mes sag e~ (Ox02)
Procedi.H"e. tr.a n _t.._tion i denr ity : to
NAS 'EP S sessi on manag ement mes sages : Act:ivate def aul t EP'S bear er cont.e x1: rc guc~st
eP~ qua 11 y pf ,er·vi
Ac cess Poi nt Name
PON ad dress
"1 Link d TI - Tr ansact ion i tle ntif i r
m Qual i.:y Of ser vice - •e gociaced QoS
f'iJ AP N 4ggr gal m~x i murn bi t r -tile
m Pr ot:oco I configu ra ti on Opt i ons

Figure 31. E-RAB Setup Request (Activate default EPS bearer context request)

The eNB delivers the Activate default EPS bearer context request transparently to the UE, which is contained
in RRC Connection Reconfiguration. Refer to step #12 for UE behavior after receiving RRC Connection
Reconfiguration.

(22] ] The UE informs the MME of the fact that the default EPS bearer has been activated by sending
the Activate Default EPS Bearer Context Accept as a response to a corresponding request.

3 up ·1i nkNASTr ans pon

13 protocol lEs : 5 it~ms
~ 1 m 0 : i d- MM£ - UE-S I AP- ID
I t:em 1: i d- e B- UE - 51.AP - ID
5 I tem 2 : i d - NAS - PDU
a Proco ol1 - Field
i d; i d- ,SA5- PDU (26)
c r it i cal ity : rej ect (0)
61 va l ue
NAS - POU : 2/ df4 , ~d0/046200ci
B on - Acc e s s - str atum ( NAS) POU
0010 . . . . = e ur- i cy h ade ype: Irll gri w prot ' ced and i p h red (2)
. ... 0111 = Pro.:ocol di scriminator: EPS mob i li.:y managem nc messa ges ( Oxol)
Mc.ssa.gc aut hn.m i ca.t i on code: Oxdf4 S4d07
sequence number ; 4
0110 . . . = EP ., h arer ident i ry: ePS bearer 1<1enc i cy va l ue 6 (6)
. .. . 0010 - ProLoc ol di scriminator : EPS s. e_s; :si on management mcs;sagcs (Ox02)
Procedur e transaction ident i ty : 0
NA . P session ma.nag Pm nr messages : Activate default hearer con'te>rt .:1ccept
~ I t: e.m 3: i d- EUTRAN CGI
~ I t em 4 : i d-TAI

Figure 32 . Activate default EPS bearer context request

24131
 UE I I eNB I I MME I lsGW/PGWI I PCRF I I IMS

23. Modify Bear r Requert

Bearer Conte, (EBI, GlP-U TEID)
, DL 51bear. r e stab/is l,ed

'
24. Modify Bear rR esponse
Bearer Conte, (EBI, GlP-U TEID), ause

•
•
EPS default bearer

I I
" .I
SIP fl ws
•
•
t=:[ 2] RRC- ¥ -[3) SlAP---t-[8] GTP-C- t - -[9] Gx-----i
NAS Security l
H 12] DR ~ [14 ] S1/ SS bearer(QCl=5 ~
+-(17] GTP-C~ [ 18] Gx- +
~ [21] DRB---X-..-[ 23] S1/S5 bearer (QC1 =5 )➔
' :

Figure 33. EPS bearer creation flow

(23] The MME sends the Modify Bearer Request requesting the SGW to establish the downlink S1 bearer
towards the eNB. Refer to step #14 for overall description. The message contains eNB GTP-U TEID that shall
be used by the SGW to identity the end point of the GTP-U of default EPS bearer.

B Bear er c ontex t : [ Gr oupe d IE]

IE lyp : Be ar r cont x ( 3)
IE Length: 3 0
0000 ... . = CR f l ag: 0

Ii' EP B : 6
a Ful l y el ndpoi nt I dem i i r (F - T D) : s1 - u ,mod a P- U i nte
I E Type: Ful ly Qu al i fi ed Tunnel Endpoint I dem: ifier ( F-TEID) ( 87)
I E Length : 21
00 00 R fl;, : 0
0000rnstanc
~ o
0.. . = 4 : I Pv4 address not pr esent
.1.. = v 6 : I Pv6 addr ess pres ent
. . 00 0000 - In erfac Type : 51- U Nod B GTP- U irrt rfc1ce ( 0 )
T ID/ GRE Key: oxo 80460c
F- TEIO I Pv6: 240 5:200 : 101 : 700 : 3 : 2 :101: f e 24 05 : 200:101: 700 : 3: 2 :101 :fe

Figure 34. Modify Bearer Request

(24] Upon receiving the Modify Bearer Request, the SGW establishes a downlink S1 bearer and responds
with Modify Bearer Response.

25/31
 B Modi't y 6ear er- Res ponse
@ fl ags : 0x48
Mes a ge rype : Modi f y ~•ar er R s pon se (35)
• ess a ge Lengt h : 54
TU nne l Endpo i nt I de nt i f i e r : 14\\11 83213
equeri e Numb er : 1487150
spare: O
a.cce r ed 1 6
- Sear e r Co nt e xt [ Grou ped I E]
re Typ e: Boar er c ont ex-r ( 93)
I E I ng t h : 36
0 00 0 . .. . - C R f l ag : 0
0000 = Ins t anc e: o
EPS 6e a r·er ID (EB I ) : 6
:,i Caus e : Re quest a ccepte d (1 6)
ull y Qual H i ed runnel " '" !poi nt I d nt i f i er ( ~- 1-n n ) 1 - u GW <,rP- U i n t er f ac e , ·r n o / GRE
I E Type : Ful l y Qua l i f i ed Tun ne l Endpo i n t I de nt i fi e r ( F - TEIO) (87)
I E Le ngth : l
0 000 = R fl a g : 0
. . . . 0000 - I ns ance : 0
o. _ = v4 : 1Pv4 addr 2ss noL pr es2n r
. 1 .... . . = V6 : I Pv6 ad dr es s p r es e nt
. . 00 0001 - Int erf ace Typ e: s1 - u SG• GTP - U i nt er f ac e ( 1 )
T F JD/ GRFKey: 0 x0f 9b5422
F- TEID I Pv6 : 2405 : 200 : 310 : a : : 1 0 240 5 : 20 0 : 310: a : : 10

Figure 35. Modify Bearer Response

Consequently, the default EPS bearer with QCI value of '5' between the UE and the IMS APN is established.
Hereafter all the SIP traffic goes through the default EPS bearer.

RedMouse

REFERENCES

(1) 3GPP TS25.331, "Radio Resource Control (RRC); protocol specification", vl2 .3.0, Sep 2014
(2) 3GPP TS24.301, "Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); stage3", vl2.4.0,
Mar 2014
(3) 3GPP TS36.413, "Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); stage3", v12.4.0,
Mar 2014
(4) Red Mouse, "Tracking Area Update and Combined Attach ", Jul, 2015
[SJ Red Mouse, " Understanding of GTP TEID to use it in LTE troubleshooting", Jun, 2015
(6) Netmanias, "LTE Security II : NAS and AS security", Aug 5th 2013
(7) Netmanias, "LTE IP Address Allocation Schemes I: Basic", Feb 13th 2015

Last Update: Dec 30th 2015

~{1 Xf : REO MOUSE A li'..]-: 16:27

26/31
2f~: EPS bearer, GTP-C, GTP-U, Initial attach, LTE, VoLTE

28 comments:

Unknown 20/12/15 20:02

Great Explanation Hong. I need to understand more about how RRC connection get established between UE and
EnodeB it would be great if you can share a link where its explained. and more silly question P-GW assigns IP to UE
later so from which IP first UE sends Attach request and PDN connectivity request.

Thanks in Advance

Reply

Replies

0
RED MOUSE 21/12/15 17:28

I'm afraid I couldn't find a web link where RRC interface has been clearly explained aside from the
specification (TS 25 .331) . As for an Identifier, "eNB UE SlAP ID" and "IMSI" are contained in the
initialUEMessage (SlAP layer) and Attach Request (NAS layer) respectively. I GUESS the identifier
between UE and the eNB could be MAC address considering the protocol structure between them.
However, I'm not a radio expert. Hope you can find a better one for radio.

Unknown 22/12/15 13:48

Thanks Hong

Reply

Unknown 29/2/16 15:44

Detailed explanation fortified with PCAP trace. Well done. Thanks a lot.

Reply

Unknown 20/6/16 12:24

Great explanation, thanks a lot Hong.

I need to know if the steps 9 & 18 have the same Session-Id or not (... 14304044....)?
Thanks.

Reply

Replies

~ RED MOUSE 20/6/16 13:08

\iiil They are different as the APN is different.

Reply

Unknown 9/8/16 22:04

27/31
0
Do you know why some smartphones supporting VoLTE in the market, but they are sending "CS Voice Only" in the
attach request (e.g Galaxy SS, Galaxy SG, Galaxy SG Edge, iPhone GS, ..)
Is there any limitation from Samsung or Apple on specific operators?
How we can solve this problem?
Thanks a lot.

Reply

Replies

0 RED MOUSE 10/8/16 09:36

In my understanding, it's up to operators. Some operators may use LTE as a data network but still use CS
for voice.

0
KK 19/10/17 12:39

Hi, what happens in case of LTE capable but non-VoLTE handsets, do we see a Homogenous-support-of-
lMS AVP included or not?

0
Nakul Garg 20/11/17 19:16

No, you need to upgrade your phone or by using app u can make your phone volte ... Like jio voice app ..

Reply

0
Hanmant 1/8/17 00:38

Nice article,
Instead of MME, SAEGW need to be mentioned in in CCR & CCA explanation.

Reply

0
Unknown 7/8/17 05 :38

I guess there is a mistake in the step 18, actually PGW should send CCR to the PCRF :

(18] Upon receiving the Create Session Request, the MME sends CCR to the PCRF. Refer to step #9 for overall
description.

Reply

Replies

~ Unknown 17/10/1711:33

\iiil yes it looks like typo error...

Reply

0
Unknown 5/10/17 20:03

undoubtedly the best blog available on lte!

Reply
28/31
0 Nakul Garg 20/11/17 19:14

Best blog ever for lte

Reply

0
N-Joy Life 4/7/18 14:25

Hello

Good Information
I would like to know more about SIP information for IMS registration

Canu help me?

Reply

Replies

0 Unknown 7/5/19 20:15

What information you need on IMS Registration. Do you have any specific questions of you need to
understand the overall procedure of IMS registration ..?

Reply

o durai 30/7/18 21 :12

Thanks for the Explanation .

Once the EPS default bearer created then the traffic will be flow from UE to PCSCF directly for both registration and
voice calls?

Will MME/PGW/SGW play any role during registration and voice call between UE to PCSCF ? If its play any role,
could you please clarify in detail.

Reply

Replies

Unknown 7/5/19 20:31

Once the EPS default bearer created then the traffic will be flow from UE to PCSCF directly for both
registration and voice calls ?

BR» Once the 2nd Default bearer (IMS) is created, the REGISTER/INVITE (calls) uses the UL TEIDs (GTP-
U:: from UE to eNB to SAEGW) and then reach the PCSCF.

Will MME/PGW/SGW play any role during registration and voice call between UE to PCSCF ? If its play
any role, could you please clarify in detail.

BR» Refer to VOICE call flow from Hong in the same blog. U will understand.

Reply

29/31
0 Unknown 26/9/18 16:46

hi Hong,

Can u please let me know the flow, What will happens if data w ill exhaust in VoLTE.

As i know call will be working properly but data speed got reduced like unable to browse . As i understand speed
will degraded but internet bearer will not released in CCR U.

hope u understand my query, please help me to understand the flow properly like you expla in complete volte flow.
Thanks in advance.

Reply

0 Unknown 1/10/18 03 :54

Dear
In my case :
RRC request-> RRC Connection setup-> RRC Connection setup complete.
Then RRC Reconfiguration -> RRC Reconfiguration Complete in UL.
Then i get "DL ESM Modify EPS Bearer Context Request".
Does anyone have any ideas on this "Modify EPS Bearer Context Request" message ? Thank you in advance.

Dir: D,
Protocol : EMM,
Msg Type : 201,
Msg Name: Modify EPS bearer context request,
M sg Body: 5200C95B010630100B911F7196FEFE7
EPS Bearer Id: 5,
Protocol discriminator: EPS Session Managment
Procedure transaction identity: O
Message Type: Modify EPS Bearer Context Request
EPSQoS
- .QoSQCI : 6
IE: Quality of Service:
- .Delay Class: Delay class 1,

Reply

0
Unknown 7/5/19 20:19

Hi,

Step-18; IMS bearer creation procedure, there is a TYPO. Its PGW sends CCR to PCRF not 'MME seds CCR to PCRF'

(18) Upon receiving the Create Session Request, the MME sends CCR to the PCRF. Refer to step #9 for overall
description.

Reply

0 Unknown 24/7/19 13:29

who is giving p-cscf address to UE? who is assigning ip addresss to UE?

30/31
 Reply

0
Anil 15/12/19 15:25

Pgw assigns pcscf address to in pcscf discovery procedure

Reply

0
Sumit 16/9/20 13:48

very nice explanation

Reply

Pilot-Pooja 20/11/20 15:23

EXCELLENT BLOG, I REFER IT OFTEN

Reply

r""7 TMIS 19/10/22 15:11

t ,TMI~
~ ... Flow Speed Test

Reply

r""7 TMIS 3/11/22 15:40

( '™'~
...._ _... EPB Speed Test

Reply

To leave a comment, click the button below to sign in with Blogger.

SIGN IN WITH BLOGGER

Newer Post Home Older Post

Subscribe to: Post Comments {Atom)

Simple theme. Powered by Blogger.

31/31