X2 handover

Handover is a process for a UE to transfer its sessions from the current network to another one while it is moving towards a neighbor cell. So, the handover procedure ends up with a new connection between the UE and the new eNB. The intra E-UTRAN handover indicates the case where the SGW and/or MME is not relocated whereas the inter E-UTRAN handover is the case where the SGW and/or MME shall be relocated. In this post, the intra E-UTRAN will be described.

It is a serving eNB that determines whether to initiate the handover procedure or not based on measurement reports received from the UE periodically. When handover is to happen, the serving eNB also chooses the target eNB from the list of neighbor eNBs and the type of handover, i.e., X2 handover or S1 handover. If there is an established X2 connection with the target eNB and it is available at the moment, the source eNB performs X2 handover. Otherwise the eNB will perform the S1 handover.

I. Overall scenario

The X2 handover procedure involves signaling transactions among two eNBs and the MME. The following diagram shows the conceptual flow of X2 handover procedure.

Fig 1. overall scenario - X2 handover

(1) UE periodically sends measurement reports to the source eNB.
(2) The source eNB determines X2 handover and requests X2 handover to the target eNB. The target eNB establishes uplink S1 bearer with the same SGW with which the source eNB has been connected. The source eNB establishes a direct tunnel with the target eNB.
(3) UE handover is successfully performed. Hencefortjh, the buffered media is transferred to the UE from the target eNB.
(4) The target eNB informs the SGW of the fact that the handover has been completed successfully. The SGW establishes downlink S1 bearer with the target eNB.
(6) The SGW switches the media path from the source eNB to the target eNB and releases the old S1 bearer.

II. X2 handover flow

Fig 2. X2 handover call flow

[1] The UE periodically sends a measurement report to the serving eNB. This reporting mechanism is intended for the UE to find out the best cell to communicate with the network. The measurement report may contain the list of neighbor cells, their signal strength and its current condition.

[2] Based on the received report, the serving eNB determines whether the handover is required and if it is required, the serving eNB selects a target eNB among the list of neighbor eNBs with which X2 connection is established. The source eNB requests the target eNB to prepare for handover by sending Handover Request. The message contains the target Cell ID and the UE Context. The following shows some of parameters included in the UE Context.

• UE-AMBR indicates aggregated maximum bit rate for all the bearers of the UE.
• E-RABsToBeSetupList indicates a list of radio access bearer. Each E-RAB is defined by E-RAB ID and corresponding QoS parameters like ARP, QCI, GBR, etc.
• UL GTP TEID indicates the SGW endpoint of the S1 bearer for delivery of uplink packets. It is delivered to the target eNB so the target eNB can establish the UL S1 bearer with the same SGW as like the source eNB. 

Upon receiving the Handover Request, the target eNB allocates required resources to proivde the same quality of service to the UE as the source eNB. The required resources will include resources for RRC to communicate with the UE and resources for S1 bearer to communicate with the SGW. Additionally, the target eNB also allocates a new DL GTP TEID that will be delivered to the source eNB in step#3 and used for direct GTP Tunnel between two eNBs.

[3] The target eNB informs the source eNB about the prepared resources by sending Handover Request Acknowledge.

• E-RABs Admitted List contains the list of E-RABs for which the resources have been allocated. It also contains the DL GTP TEID that identifies the X2 transport bearer that shall be used by the source eNB to forward the downlink packets towards the target eNB.
• E-RABs Not Admitted List contains the list of E-RABs for which resources won't be allocated.
• Target eNB to source eNB transparent container is used by the target eNB to deliver the message to the UE through the source eNB transparently. In this case, it contains the Handover Command which is a command to the UE for handover execution.

Upon receiving the acknowledgement, the source eNB establishes the X2 direct tunnel with the target eNB. Henceforth, the traffic received by the eNB is forwarded to the target eNB and will be buffered until the UE handover is completed.

[4] The source eNB requests the UE to reconfigure the RRC connection by sending RRC Connection Reconfiguration, which also contains Handover Command that was received from the target eNB.

• C-RNTI (Cell Radio Network Temporary Identifier) is a temporary UE identifier assigned by the serving eNB. It is persistent while the UE is connected to that eNB and re-assigned whenever the serving eNB changes.
• DRB-ID (Data Radio Bearer Identifier) is an identifier of the data bearer between UE and the eNB to be established with the target eNB. 

Upon receiving the Handover Command, the UE executes handover from the current eNB to the target eNB.

[5] The source eNB informs the target eNB of the current status of packet transmitter and receiver by sending SN Status Transfer. The message includes the uplink/downlink PDCP SN and HFN.

• PDCP(Packet Data Convergence Protocol) SN indicates the sequence number assigned for each packet data unit.
• HFN (Hyper Frame Number) is used to limit the actual number of sequence number bits that's needed to be sent over the radio. When the PDCP SN reaches the maximum value, the PDCP SN is restarted from zero and HFN is incremented by one. This value shall be synchronized between the UE and the eNB.

[6] After the UE has successfully synchronized to the target cell, it sends a target eNB a Handover Confirm informing that the handover has been completed. The buffered data at the target eNB is forwarded to the UE through the DRB. The uplink data from the UE can also be sent hereafter.

[7] The target eNB creates the S1 eNB GTP TEID and sends the MME the Path Switch Request to inform that the UE has changed the cell.

• ECGI (E-UTRAN Cell Global Identifier) is a globally unique cell identifier to which the UE is camping on.
• TAI (Tracking Area Identity) is a globally unique tracking area identifier.
• E-RAB to be switched indicates the list of EPS bearers to be switched.
• S1 eNB GTP TEID indicates the end point of the GTP Tunnel that will be used by the SGW to identify the target eNB.

[8] Upon receiving the Path Switch Request, the MME requests the SGW to modify EPS bearers by sending Modify Bearer Request per PDN connection. The Modify Bearer Request contains the list of EPS bearers to be modified.

The PGW may need to inform the PCRF of the fact that the UE's location has been updated based on the request from the PCRF when the Gx session was established. Refer to "Bearer level event and VoLTE call setup failure" for basic understanding as to how the bearer level event reporting mechanism is realized within the PCC architecture.

[9] The SGW establishes the downlink S1 bearer with the target eNB and responds with the Modify Bearer Response, which includes the list of successfully modified EPS bearers.

[10] The SGW acknowledges the target eNB by sending Path Switch by sending Path Switch Acknowledge.

[11] The target eNB informs the source eNB that the handover has been completed successfully by sending UE Context Release. Upon receiving the UE Context Release, the source eNB releases all the resources associated with the received UE context.

***

As a result of X2 handover, the UE context that was maintained by the source eNB is moved to the target eNB. The UE's location will be updated (e.g., ECGI, TAI) and the UE's C-RNTI will be re-assigned by the target eNB. The target eNB shall also assign a new eNB S1AP UE ID which will be updated at MME. The S1 bearer between the SGW and the source eNB will be replaced by another S1 bearer between the same SGW and the target eNB, which requires updates of eNB S1 GTP-U TEID. The PCRF may need to update UE's location.

Please note that all these changes does not affect the existing VoLTE session. All the EPS bearers being used to transfer VoLTE signaling and data moves to the target eNB. In case there is an existing voice media session, the voice data arriving at the source eNB while the UE handover is in progress will be transferred to the target eNB through the direct tunnel between two eNBs and buffered at the target eNB. The buffered data is eventually transferred to the UE when the handover is completed. Assuming that the handover takes less than a few milliseconds, the user won't notice a voice cracking.

Red Mouse

REFERENCES

[1] GPP TS23.401, "General Packet Radio Service (GPRS) enhancement for Evolved Universal Terrestrial Radio Access Network (E-UTRAN) access", v12.4.0, Mar 2014
[2] 3GPP TS36.423, "Evolved Universal Terrestrial Radio Access Network (E-UTRAN); X2 application protocol (X2AP)", v13.1.0, Sep 2015
[3] 3GPP TS25.331, "Radio Resource Control (RRC) Protocol specification", v10.0.0, Jun 2010
[4] 3GPP TS36.331, "Evolved Universal Terrestrial Radio Access Network (E-UTRAN); Radio Resource Control (RRC) Protocol specification", v12.7.0, Sep 2015
[5] 3GPP TS25.323, "Packet Data Convergence Protocol (PDCP) specification (release 9)", v9.0.0, Dec 2012
[6] 3GPP TS36.300, "Evolved Universal Terrestrial Radio Access (E-UTRA) and Evolved Universal Terrestrial Radio Access Network (E-UTRAN); Overall description; Stage 2", v10.0.0, Jun 2010
[7] EventHelix.com, "LTE X2 handover sequence diagram", 20th Apr 2013
[8] Netmannias, "EMM Procedure 6. Handover over without TAU - Part2. X2 handover", Mar 21th 2014

VoLTE: Service Request scenario in IDLE mode

The IDLE state is defined as the state when both RRC state (i.e., eNB and UE signaling connection state) and ECM state (i.e., NAS signaling connection state) are IDLE while the EMM state maintained by the MME is still REGISTERED. This indicates that the UE is logically attached to the LTE network but the physical connection and the corresponding resources have been released from the UE up to the SGW (i.e., DRB and S1 bearer). The UE may fall into the IDLE mode when there hasn't been any activities for a while between the UE and the LTE network or when it is regarded the UE connection is lost.

In order to transfer any data to the UE in the IDLE mode, the MME has to wake up the UE in the first place so the UE can reconnect to the network. While reconnecting to the network, the UE and the network shall recover required resources and connections over RRC, S1AP and S1 interfaces. Once the EPS bearer is recovered, the data buffered in the SGW can be transferred to the UE. The following shows the conceptual sequence of the data transfer to the UE in the IDLE mode.

Fig 1. Conceptual diagram of network initiated service request

I. Network Initiated Service Request

The following flow shows the detailed procedure of how the application payload is delivered to the UE in the IDLE mode. As a precondition, the UE stays in the IDLE mode and the payload (i.e., SIP Message) has arrived at SGW.

Fig 2. VoLTE call flow - network initiated service request 

[1] Upon receiving the data when there is no available S1 bearer at the moment as the UE is in IDLE mode, the SGW sends the Downlink Data Notification (DDN) to the MME to request for paging the UE. The DDN includes the EPS Bearer ID (EBI) stored in the EPS bearer context of the bearer on which the downlink data packet was received over S5 interface.

[2] The MME acknowledges the request by sending Downlink Data Notification Acknowledge.

[3] The MME initiates the paging procedures by sending PAGING message to each eNB that serves cells belonging to the tracking area in which UE is registered.

The following shows paging messages distributed across multiple eNBs that belong to the target TA List.

NOTE As the paging procedure itself can cause heavy traffic in the air, the MME may need to have an optimized paging scheme to minimize the side-effect. After having been awaken, the UE performs RRC connection establishment procedure with the eNB from which the paging was sent.

[4] Once the RRC connection is established, the UE requests the network to establish NAS Signaling connection, radio connection and S1 bearers by sending Service Request towards the MME. The Service Request is delivered wrapped in RRC Connection Complete and Initial UE Message on RRC and S1AP interfaces. The RRC state transits from the RRC-Idle to RRC-Connected.

[5] The MME requests to establish the E-RAB connection by sending the Initial Context Setup Request to the eNB.

• UE-AMBR indicates the maximum aggregated bit rate for non-GBR bearers for the concerned UE.
• E-RAB To Be Setup Item includes the E-RAB information for each EPS bearers to be setup. 

In this example, there are three E-RABs to be setup which is the list of non-GBR bearers. Each E-RAB information contains the E-RAB ID, ARP and the SGW GTP-U TEID.

Upon receiving the Initial Context Setup Request, the eNB executes the E-RAB configuration and creates UE context based on the received parameters. In the meantime, the MME may perform the security setup procedure with the UE for integrity protection and ciphering of signaling data.

[6-7] The eNB requests the UE to establish the DRB by sending RRC Connection Reconfiguration. Once the DRB is established successfully, the UE responds with the RRC Connection Reconfiguration Complete to the eNB.

[8] After the DRB is successfully established, the eNB responds with the Initial Context Setup Response to the MME. The ECM state transits from ECM-Idle to ECM-Connected.

• E-RAB Setup List is a list of E-RABs that has been successfully established, which contains each E-RAB ID and eNB GTP-U TEID.
• E-RAB Failed Setup List is a list of E-RABs that has failed to establish.

[9] The MME requests the SGW to resume the suspended S1 bearer by sending the Modify Bearer Request. If there were multiple APNs to which the UE was connected before falling into IDLE state, there can be multiple Modify Bearer Request sent, one for each APN.

The Bearer Context IE contains the EBI and the eNB GTP-U TEID with which the SGW will establish the S1 bearer towards the eNB. In this example, there are two EBIs one for the default EPS bearer and the other one for dedicated EPS bearer.

[10] The SGW responds with the Modify EPS bearer response containing the resulting cause value for each requested EBI. The Bearer Context IE contains the EBIs and the SGW GTP-U TEID which is the same value that was contained in the Initial Context Setup Request at step #5. 

Once the S1 bearer is recovered, the SGW starts sending buffered data towards the UE. This procedure happens seamlessly without necessarily user interaction.


II. UE Initiated Service Request
In the same way, the UE may initiate the service request procedure in the IDLE to perform the VoLTE call initiation or location update procedures in the IDLE mode.

[1-10] Same as [4-10] in the figure 2. During this procedure, the RRC connection and NAS signaling connection is re-established. The UE context is recovered in MME. The EPS bearer including DRB and the S1 bearer is also re-established.

[11-12] The UE may trigger the TAU procedure by sending Tracking Area Update (TAU) request following the criteria as defined in TS23.401. The TAU contains the UE's current Tracking Area Identifier (TAI) and the ECGI. The last visited TAI is included if the UE has a valid TAI of the last visited tracking area and used by the MME to make a good list of TAI(i.e., TAL) for the UE. The TAL is contained in the TAU Accept.

Please refer to "VoLTE: Tracking Area Update and Combined Attach" for the detail.


Once the EPS bearer is recovered, the UE is able to initiate a voice call setup procedure by sending SIP INVITE. If there is no service data flow for a while, the UE and the network may again fall into the IDLE state.

***

In order to optimize the transactions between the UE and the network, the eNB shall be optimized as to criteria based on which the UE state falls into the IDLE mode. Furthermore the MME shall also provide the optimized scheme for paging schedules considering user experiences. If the paging scheme (i.e., timer values) is too loose, it will aggravate user experiences. If it is too frequent, it will cause heavy traffic in the air.

Red Mouse

REFERENCES

[1] 3GPP TS29.274, "3GPP Evolved Packet System (EPS); Evolved General Packet Radio Services (GPRS) Tunneling Protocol for Control Plane (GTPv2-C); stage 3", v13.0.0
[2] 3GPP TS36.413, "Evolved Universal Terrestrial Radio Access Network (E-UTRAN); S1 Application Protocol (S1AP)", v12.3.0
[3] Netmanias, "LTE EMM and ECM States", Sep 2013

Updated: Sep 2015

E2E VoLTE call setup(1/4) : Initial attach and default EPS bearercreation

When the UE is turned on, it establishes a PDN connection with a default APN. In this test for VoLTE call setup, the operator provides two APNs, i.e., “Internet” APN and the “IMS” APN. The default APN is an “Internet” APN that is used for internet data traffic and its default EPS bearer has a QCI value of ‘9’. After the PDN connection is established with the internet APN, the UE attempts additional PDN connection with the IMS well known APN, i.e., “IMS APN”. The IMS APN is preconfigured in the UE and its default EPS bearer has a QCI value of ‘5’ being used for SIP signaling. Once the PDN connection with the IMS APN is completed and the default EPS bearer is successfully created, the UE is able to communicate with the IMS Core for VoLTE call service.

Introduction

The UE's initial attach procedure consists of two routines. One is to establish a signaling path on RRC, S1AP and GTP-C interfaces and the other one is to establish the bearer path including Data Radio Bearer (DRB) and GTP-U (i.e., S1 and S5 bearer). The following diagram show overall LTE architecture and different signaling and media paths with multiple PDNs.

NOTE In this diagram, the S5 interface between the SGW and the PGW has been omitted for simplicity.

Figure 1. PDN Connectivity

The signaling connection procedure involves LTE authentication, NAS security procedure and the UE's location update procedure. Therefore, when the signaling connection is completed, the UE comes to have a secured connection to communicate with the network and the network becomes aware of the UE's context as to its location, subscriber's information, QoS requirements, etc. Along with the signaling connection, there comes a default EPS bearer established from the UE to the PGW, which covers the DRB, S1 bearer and S5 bearer.

I. Initial attachment 

A UE establishes an RRC connection with an eNB and the eNB creates an S1AP session with an MME for signaling. The NAS messages are exchanged between UE and the MME once the RRC and S1AP connection is established and it is composed of two layers, i.e., EPS Session Management (ESM) layer and EPS Mobility Management (EMM) layer. The ESM message is used to control PDN connectivity, bearer resource allocation/modification, activation/deactivation of a default/dedicated EPS bearer. The EMM message is used to maintain the mobility of the UE using e.g., Attach, Detach, Tracking Area Update (TAU). The NAS message transparently goes through the eNB contained in RRC and S1AP messages.

Figure 2. Initial Attach flow

[1-2] The UE in idle mode requests the eNB to establish a signaling connection by sending RRC Connection request. The eNB allocates the network resource based on the received radio configuration and initiates an RRC connection towards the UE by sending RRC Connection Setup.

[3] The UE configures a radio bearer and transport channel based on predefined parameters identified by a received predefined configuration identity and confirms RRC connection by sending the RRC Connection Setup Complete to the eNB. Meanwhile, the NAS messages (i.e., Attach Request at EMM layer and the PDN Connectivity Request at ESM layer) is transparently delivered to the MME via eNB being contained in the RRC and S1AP messages (i.e., RRC Connection Setup Complete and InitialUEMessage, respectively).

The following snapshot shows the NAS part of InitialUEMessage captured on S1AP interface.

Figure 3. InitialUEMessage

In case the UE wants to use both LTE and non-LTE, the EPS Attach type will be set to "Combined EPS/IMSI attach" and the Voice domain preference set to "IMS PS voice preferred, CS voice as secondary".

• EPS Attach Type : EPS attach/combined EPS/IMSI attach/EPS emergency attach
• Voice domain preference : a preferred network for voice call

The Protocol Configuration Option (PCO) is used by the UE to request a certain information like UE IP address, DNS IP address, etc. 

The following snapshot shows an example of PCO configuration included in the initialUEMessage.

Figure 4. PCO for initial attachment

The following snapshot shows other parameters of initialUEMessage, which contains the UE's location information (i.e., Tracking Area Identifier, E-UTRAN Cell Global Identity) and RRC establishment cause.

Figure 5. Parameters in initialUEMessage

[4-5] Upon receiving the Attach Request, the MME requests the authentication vector to HSS by sending Authentication Information Request (AIR) to authenticate the subscriber. 

Figure 6. Authentication Information Request

The HSS responds with the Authentication Vector in the Authentication Information Response (AIA) as shown in the following snapshot.

Figure 7. Authentication Information in AIA

The following diagram shows a conceptual data flow of LTE-AKA authentication. The MME delivers the AUTN and RAND to the UE among the received parameters. (2) The UE authenticates the network by running the authentication algorithm which uses the received RAND and local parameters as input and then (3) verifies if the output of the calculation is matched with the received AUTN. The UE sends the RES which is another output of the authentication algorithm to the MME so that (4) MME can verify the RES by comparing it with the XRES received from the HSS in (1).

Figure 8. LTE authentication

As such the UE and LTE network performs the mutual authentication. After successful authentication, there comes the NAS security establishment procedure between the UE and the LTE network in order to provide a secured data transfer and data integrity.

II. Location update and GTP-C session creation

In this part of the flow, the MME updates the UE's location information stored in the HSS and creates GTP-C session with the SGW. The GTP-C session is used to control GTP-U (i.e., S1 and S5 bearers) media session belonging to the same APN.

Figure 9. Location update and GTP-C session creation flow

[6-7] The MME registers the UE's location to the network by sending Update Location Request to the HSS. The following lists some of parameters as shown in the snapshot.

• User-Name AVP: IMSI
• Terminal Information AVP: IMEI, Software version
• Visited PLMN-Id AVP: MCC and MNC of a visited network
• RAT-Type AVP: EUTRAN

Figure 10. Update Location Request

In return, the MME receives the Update Location Answer from the HSS and it contains the APN list as shown in the snapshot below.

Figure 11. Update Location Answer

Upon receiving the list of APN in the Update Location Answer (ULA), MME determines the default APN. In this example, there are two APNs received as shown in the following snapshot.

Figure 12. APN list

The following snapshot shows the detailed APN configuration. One of APNs (bottom one) is an "Internet" APN as indicated by Service-Selection AVP. The other APN (upper one) is an “IMS” APN. The default APN is determined by comparing the Context-Identifier AVP under the APN-Configuration-Profile AVP with another Context-Identifier AVP in the APN-Configuration AVP. In this case, the context identifier value of "10" in the APN-Configuration AVP for “Internet” is matched with the context identifier value in the upper layer. Given this, the MME will select the “Internet” APN as a default APN.

Figure 13. APN Configuration Profile

[8] The MME requests S11 (GTP-C) session creation by sending the Create Session Request to the SGW. The Create Session Request contains the following parameters along with subscriber's information like MSISDN, IMEI and IMSI.

• APN : the access point name to which the GTP-C session is to be established.
• PDN Address Allocation (PAA) : UE IP address. It is empty at this moment in time as no IP address has been allocated for the UE.
• Serving Network : the MCC and MNC of the serving network which the UE is attached to.
• User Location Info: TAI, ECGI
• MME GTP-C TEID : Identifier of the MME as an end point of the GTP-C tunnel
• EPS Bearer ID (EBI) of the default EPS bearer 
• QoS Class Identifier (QCI) : ‘9’

In this case the QCI value of “9” for the default EPS bearer has been allocated as this is a PDN connection with the “internet” APN.

NOTE The UE can have up to 11 EPS bearers in total and assign the same amount of EPS Bearer Id (EBI) from 5 to 15.

NOTE The SGW will also establish the GTP-C session with the PGW on S5 interface which is not shown in this flow.

Figure 14. Create Session Request

[9] Upon receiving the Create Session Request, the PGW assigns an IP address for the UE from an IP pool. The PGW sends the Credit-Control-Request (CCR) to the PCRF indicating that this is an initial request and requests the PCC rule for the default EPS bearer. The Credit-Control-Request (CCR) contains the following parameters in this example.

• CC-Request-Type AVP: “INITIAL REQUEST”
• Subscription-Id AVP: IMSI, MSISDN
• Framed-IP-address AVP: the allocated UE IP address
• QoS-Information AVP: APN-AMBR (UL/DL)
• 3GPP-User-Location-Info AVP: TAI, ECGI
• Call-Station-Id AVP: APN (Internet)
• Default-EPS-Bearer-QoS AVP: QCI, ARP

The following snapshot shows the CCR captured on Gx interface.

Figure 15. Credit Control Request

[10] Upon receiving the CCR, the PCRF determines the PCC rule based on the received subscriber's information and responds with Credit-Control-Answer (CCA) including a PCC rule(s). When it comes to a default bearer, the PCRF may include only a PCC rule name which indicates the predefined PCC rule locally stored in the PGW. Henceforth, the PCC rule is applied to all the traffic by the PGW.

Figure 16. Credit Control Answer

[11] The SGW/PGW completes the GTP-C session creation procedure by sending the Create Session Response. The Create Session Response contains the following parameters:

• AMBR : Aggregated maximum bit rate that is allowed for this APN
• EPS Bearer ID : 5
• Protocol Configuration Options (PCO) : P-CSCF IP address, DNS IP address, etc, based on the requested configuration information by the UE in the Attach Request
• PDN Address Allocation (PAA): UE’s IP address
• SGW GTP-C TEID : Identifier of the SGW as the end point of the GTP-C tunnel
• Bearer Context: the information of the S1-U default EPS bearer to be created, which contains EBI, SGW GTP-U TEID, QCI, etc

Figure 17. Create Session Response

III. Default EPS bearer creation

Once the signaling path is successfully set up, the MME requests the eNB to activate the default EPS bearer with the SGW and the UE. The eNB establishes S1 bearer towards SGW and the Data Radio Bearer (DRB) towards the UE. The SGW will also establish the S5 bearer with the PGW, which is not shown in this flow.

Figure 18. Default EPS bearer creation flow

[12] The MME accepts the initial attach request by sending the Attach Accept and requests to activate the default EPS bearer to the UE which contains Activate default EPS bearer context request in the ESM message container. The NAS message (i.e., Attach Accept in EMM layer, Activate default EPS bearer context request in ESM layer) contains the following parameters.

• TAI list : the list of Tracking Area Identity within which the UE doesn't need to send Tracking Area Update (TAU) 
• EPS QoS : QCI (9)
• Access Point Name (APN) : Internet APN
• PDN address: the allocated UE IP address
• APN-AMBR: the maximum aggregated bit rate allowed for this APN
• Protocol Configuration Options (PCO) : DNS IP address, etc, based on the requested configuration information by the UE in the Attach Request

Figure 19. Attach Accept (Activate default EPS bearer context request)

The above NAS message is contained in the Initial Context Setup Request message on S1AP interface. Other than the NAS message, it also contains the following parameters.

• UE-AMBR : Aggregated maximum bit rates for the UE (UL/DL)
• E-RAB ID : identifier of the radio access bearer towards the eNB
• SGW GTP-U TEID : identifier of SGW as an end point of the GTP-U tunnel which was delivered in Create Session Response (step#11).

Figure 20. Initial UE Context Request

Upon receiving the Attach Accept and RRC Connection Reconfiguration, the UE establishes a DRB with the eNB and responds with RRC Connection Reconfiguration Complete to the eNB.

The eNB establishes the uplink S1-U bearer with the SGW. After successful GTP-U establishment, the eNB responds with the initial UE Context Response to the MME. In this response, the eNB contains the eNB GTP-U TEID, which will be routed to the SGW via the MME and used to identify the eNB as an end point of the GTP-U by the SGW.

NOTE The SGW GTP-U TEID is generated by the SGW and transparently routed to the eNB via the MME contained in Create Session Response and Initial Context Setup Request on S11 and S1AP, respectively. In the same way, the eNB GTP-U TEID is generated by the eNB and transparently routed to the SGW via the MME contained in the Initial Context Setup Response and Modify Bearer Request at step#14.

Figure 21. Initial UE Context Response

[13] The UE confirms the Attach Accept and informs the MME of the fact that the default EPS bearer has been activated by sending the Attach Complete, which contains the Activate Default EPS Bearer Context Accept as a response to a corresponding request.

Figure 22. Attach Complete (Activate default EPS bearer context accept)

[14] The MME sends the Modify EPS Bearer Request requesting the SGW to establish the downlink S1 bearer towards the eNB. The Modify EPS Bearer Request contains the following parameters:

• EPS Bearer ID : identifier of a default EPS bearer (5)
• eNB GTP-U TEID : identifier of the eNB as an end point of the GTP-U tunnel

Figure 23. Modify EPS bearer request

Upon receiving the Modify EPS Bearer Request, the SGW establishes the S1 bearer towards the eNB.

[15] The SGW responds with the Modify EPS Bearer Response.

Figure 24. Modify EPS bearer response

IV. PDN Connection to IMS APN

So far, the UE has performed the initial attachment procedure with the LTE network and as a result, the PDN connection has been established between the UE and the default APN, i.e., internet APN. After successful PDN connection with the default APN, if the default APN is not an IMS APN, the VoLTE UE initiates an additional PDN connection procedure with the “IMS” APN.

Figure 25. PDN connection with IMS APN flow

[16] The UE requests to establish an additional PDN connection with the IMS APN, which is typically used for VoLTE. There is no need of establishing RRC connection at this stage as it was already established at step#3. In this message, the Access Point Name (APN) is set to “IMS” and the UE may request the P-CSCF address and it is indicated by the Protocol Configuration Option (PCO) parameter. The following snapshot shows an example of PDN Connectivity Request which is contained by the uplinkNASTransport S1AP message.

Figure 26. PDN connectivity request for IMS APN

[17] Upon receiving the PDN Connectivity Request, the MME sends Create Session Request to the SGW. Refer to step #8 for overall description.

• APN : “IMS”
• MME GTP-C TEID: the same TEID that was allocated at step #8. The MME and the SGW use the same TEID for different PDNs.
• EPS Bearer ID (EBI): ‘6’ in this case as the EBI ‘5’ was already used in step#8. The EBI will be incremented along with a new EPS bearer.
• QoS Class Identifier (QCI): ‘5’ for IMS signaling.

Figure 27. Create Session Request

[18] Upon receiving the Create Session Request, the MME sends CCR to the PCRF. Refer to step #9 for overall description.

Figure 28. Credit-Control-Request

• CC-Request-Type AVP: “INITIAL REQUEST”
• Framed-IP-address AVP: The UE IP address is different from what was allocated at step #9. The UE is allocated with different IP address per PDN.
• Call-Station-Id AVP: IMS APN
• Default-EPS-Bearer-QoS AVP: In case of IMS APN, the default EPS bearer has a QCI=5.

[19] Upon receiving the CCR, the PCRF responds with CCA containing the PCC rule of the default EPS bearer for IMS APN. Refer to step #10 for overall description.

Figure 29. Credit-Control-Answer

[20] Upon receiving the CCA, the MME responds with Create Session Response containing the PCC rule of the default EPS bearer for IMS APN. Refer to step #11 for overall description.

• EPS Bearer ID: ‘6’
• Protocol Configuration Options (PCO) contains P-CSCF IP address and will be delivered to the UE.
• PDN Address Allocation (PAA): UE’s IP address and will be delivered to the UE.
• SGW GTP-C TEID: The same TEID that was allocated at step #11. The MME and the SGW use the same TEID for different PDNs.
• Bearer Context contains the SGW GTP-U TEID for the default EPS bearer which is different from what was used in step #11.

Figure 30. Create Session Response

[21] Upon receiving the Create Session Response, the MME requests to activate the default EPS bearer by sending Activate default EPS bearer context request towards the UE, which is contained in E-RAB Setup Request on S1AP interface. The E-RAB Setup Request is used to assign resources on Uu (i.e., air interface between UE and the eNB) and S1 for one or several E-RABs. The following shows parameters contained in the E-RAB Setup Request.

• UE-AMBR (UL/DL): The aggregated maximum bit rate of the UE associated with the same PDN.
• E-RAB to be setup parameters contains E-RAB ID=6 and SGW GTP-U TEID which was delivered at step #20.

The following shows parameters contained in the Activate default EPS bearer context request:

• EPS QoS QCI = 5
• Access Point Name (APN): “IMS”
• PDN address: The newly allocated UE IP address
• Protocol Configuration Options (PCO) contains the P-CSCF address which was delivered in step #20.
• APN-AMBR: aggregated maximum bit rate for the same APN.

Figure 31. E-RAB Setup Request (Activate default EPS bearer context request)

The eNB delivers the Activate default EPS bearer context request transparently to the UE, which is contained in RRC Connection Reconfiguration. Refer to step #12 for UE behavior after receiving RRC Connection Reconfiguration.

[22] ] The UE informs the MME of the fact that the default EPS bearer has been activated by sending the Activate Default EPS Bearer Context Accept as a response to a corresponding request.

Figure 32. Activate default EPS bearer context request

Figure 33. EPS bearer creation flow

[23] The MME sends the Modify Bearer Request requesting the SGW to establish the downlink S1 bearer towards the eNB. Refer to step #14 for overall description. The message contains eNB GTP-U TEID that shall be used by the SGW to identity the end point of the GTP-U of default EPS bearer.

Figure 34. Modify Bearer Request

[24] Upon receiving the Modify Bearer Request, the SGW establishes a downlink S1 bearer and responds with Modify Bearer Response.

Figure 35. Modify Bearer Response

Consequently, the default EPS bearer with QCI value of ‘5’ between the UE and the IMS APN is established. Hereafter all the SIP traffic goes through the default EPS bearer.

Red Mouse 

REFERENCES

[1] 3GPP TS25.331, "Radio Resource Control (RRC); protocol specification", v12.3.0, Sep 2014

[2] 3GPP TS24.301, "Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); stage3", v12.4.0, Mar 2014

[3] 3GPP TS36.413, "Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); stage3", v12.4.0, Mar 2014

[4] Red Mouse, "Tracking Area Update and Combined Attach", Jul, 2015

[5] Red Mouse, "Understanding of GTP TEID to use it in LTE troubleshooting", Jun, 2015

[6] Netmanias, "LTE Security II: NAS and AS security", Aug 5th 2013

[7] Netmanias, "LTE IP Address Allocation Schemes I: Basic", Feb 13th 2015

Last Update: Dec 30th 2015