VoLTE S1 handover completion (3/3)

After the UE confirms the completion of the S1 handover in a new cell, the target eNB initiates the completion procedure by sending towards the network. The completion procedure involves the SGW and PGW replacing the downlink S1 bearer from the source eNB to the source eNB releasing the UE associated resources and lastly, the release of Indirect Forwarding Tunnels by the SGW.

Figure 1. S1 handover procedure - complete

[12] The target eNB sends the Handover Notify to the MME notifying that the UE has been identified in the target cell and S1 handover has been completed.

• E-UTRAN CGI: globally identifies a cell and composed of PLMN identity and Cell identity.
• TAI: uniquely identify a Tracking Area and composed of PLMN identity and TAC (Tracking Area Code). 

Figure 2. Handover Notify

[13] The MME sends the Modify Bearer Request to the SGW requesting to switch the media path from the source eNB to the target eNB. The switch of media path from the SGW is done by updating the S1 bearer tunneling end point.

• Indication: includes various application flags. Refer to section 7.2.7 “Modify Bearer Request” in [TS 29.274].
• Bearer Context: identifies the bearer to be modified. It is composed of EPS Bearer ID and S1 eNB F-TEID sub elements.

In this practice, there are three bearers, i.e., bearer id = 5,6,7. The bearer 5 and 6 belongs to the internet APN, meanwhile the bearer 7 belongs to the IMS APN. The MME sends multiple Modify Bearer Request for each APN.

Note that in the following message, the value of F-TEID is set to 0x018088ed. This value is the one that was sent by the target eNB in step [4] Handover Request Acknowledge where it represents the tunneling end point of the target eNB for the downlink S1 bearer. Now, the MME deliver this value to the S-GW so the S-GW can use this value as a new target end point for the media path. As such, the downlink media path on S1 bearer is switched from the source eNB to the target eNB.

Figure 3. Modify Bearer Request for bearer 7

The following message shows the Modify Bearer Request for the bearer 5 and 6. In the same as described in the above, the value of F-TEID is set to 0x018008ed and 0x018048ed for bearer 5 and 6, respective. They are the same values as were sent by the target eNB in step [4] Handover Request Acknowledge where they represent tunneling end points of the target eNB for the downlink S1 bearer.

Figure 4. Modify Bearer Request for bearer 5 and 6

Note that the Modify Bearer Request is also sent by the SGW to the PGW which is not depicted here. The SGW and PGW are logically separated but in many cases, they are deployed on the same platform.

[14] The Modify Bearer Response sent from the PGW to the SGW and from the SGW to the MME.

• Cause: indicates the result of modifying the requested bearer.
• Bearer Context: identifies the bearer that has been modified. It is composed of EPS Bearer ID, Cause and S1 eNB F-TEID sub elements.

Note that in the following message, the value of F-TEID is set to 0x005b8422. This value is the one that was sent by the MME to the target eNB in step [3] Handover Request where it represents the tunneling end point of the SGW for the uplink S1 bearer. The tunneling end point values of SGW is created when the UE attaches the network at the very beginning. Upon S1 handover, the MME sends this value to the target eNB and the target eNB establishes uplink S1 bearer to the SGW using this value. At this moment, the source eNB also has uplink S1 bearer connection with the SGW with the same tunneling end points. As both source eNB and target eNB can send traffic to the SGW, there is no change that the data sent by the UE gets lost during handover procedure.

Now, the SGW sends this TEID to the MME for the downlink S1 bearer informing the tunneling end point for the downlink S1 bearer.

Figure 5. Modify Bearer Response for bearer 7

The same principal is applied to the following message which is for bearer 5 and 6.

Figure 6. Modify Bearer Response for bearer 5 and 6

[15] The MME requests the release of UE-associated S1 logical connections over S1 interface by sending UE Context Release Command. The source eNB releases its resources related to the given UE.

• UE S1AP ID Pair: contains the UE S1AP identifiers. It is composed of MME UE S1AP ID and eNB UE S1AP ID
• Cause: indicates the reason for this command. Refer to section 9.2.1.3 “Cause” in TS36.413 for the detail.

Figure 7. UE Context Release Command

[16] The source eNB confirms the release of UE-associated S1 logical connections over S1 interface by sending UE Context Release Complete.

• MME UE S1AP ID: uniquely identifies the UE association with the S1 interface within the MME.
• eNB UE S1AP ID: uniquely identifies the UE association with the S1 interface within the eNB.

Figure 8. UE Context Release Complete

[17] The MME requests the SGW to delete the Indirect Forwarding Tunnels by sending Delete Indirect Data Forwarding Tunnel Request.

Figure 9. Delete Indirect Data Forwarding Tunnel Request

[18] The SGW responds with Delete Indirect Data Forwarding Tunnel Response to the MME.

Figure 10. Delete Indirect Data Forwarding Tunnel Response

Red Mouse

REFERENCES

[1] 3GPP TS23.401, “General Packet Radio Service (GPRS) enhancements for Evolved Universal Terrestrial Radio Access Network (E-UTRAN) access”, v12.4.0, Mar 2014

[2] 3GPP TS29.274, “Evolved General Packet Radion Service (GPRS) Tunneling Protocol for Control Plane (GTPv2-C); Stage3”, v13.2.0, Jun 2015

[3] 3GPP TS36.411, "Evolved Universal Terrestrial Radio Access (E-UTRA); S1 Application Protocol (S1AP)", v13.0.0, Jun 2015

VoLTE: Traffic Flow Templates

The service data flow template is a set of packet filters applied to IP packets to identify the service data flow belonging to a specific application. The packet filters typically consist of IP 5-tuples, i.e., source IP address, destination IP address, source port, destination port, protocol type. The service data flow template is delivered to the PGW contained in the PCC rules. The PGW identifies the service data flow based on the service data flow template applied in the order of filtering priorities. Once the service data flow is identified, the corresponding QoS parameters are applied to relate the service data flow to a certain EPS bearer.

I. TFT filter
Once the bearer binding is completed, that is, the PGW builds mapping relations between EPS bearers and the corresponding PCC rules, the PGW requests the creation of the EPS bearer (i.e., Create Bearer Request) towards the MME in which the set of IP 5-tuples are interpreted as a bearer level Traffic Flow Template (TFT). The TFT can be defined either separately for uplink and downlink or for both uplink and downlink. The TFT for the downlink is used by the network element whereas the TFT for the uplink is used by the UE. The following diagram shows the TFT structure when the TFT operation is add, create or replace [TS24.008].

• TFT operation code : the action to be taken to the TFT and/or packet filter list e.g., create, delete, add, replace, etc. 
• Number of packet filters : the number of packet filters. In case the operation code is "Delete existing TFT" or "no operation code", the number of filters will be 0. Otherwise, the maximum number of packet filters is 15.
• Packet filter direction: the direction of the traffic, i.e., uplink only, downlink only, bidirectional
• Packet filter identifier: the unique number to identify the packet filter
• Packet filter evaluation precedence: the precedence for the packet filter among all the packet filters in all TFTs associated with the PDP address.
• Packet filter contents: variable components with variable size such as remote/local IPv4/IPv6 address, protocol identifier, remote/local port, etc.

The following snapshot shows the TFT included in the Create Bearer Request (PGW/SGW->MME) captured over S11. The TFT operation code is to "Create a new TFT" and the direction of the IP flow to which this TFT is applied is an "uplink only" as this TFT is supposed to be used by the UE. The precedence value indicates the priority for this filter among other filters to be applied to the IP flow. Therefore this priority value must be locally unique in the UE. In this example, the IPv4 remote address indicates the P-CSCF address.

The following snapshot shows the TFT included in the Activate dedicated EPS bearer (MME ->eNB) captured over S1AP. As the TFT is included in the NAS message, it is delivered to the UE transparently so it can be used by the UE.

In a nutshell, the uplink-only TFT is created by the PGW based on the received PCC rules and sent to the UE so the UE can utilize it to filter and map the outgoing IP packets with the corresponding uplink EPS bearer.


II. TFT errors
The TFT is delivered from the MME to UE or vice versa contained in a NAS message over S1AP and the RRC interfaces. The TFT errors indicate operational inconsistencies from semantics or syntax perspectives between TFT operations, packet filters and NAS messages and once detected, it leads to the failure of EPS bearer level operations. The 3GPP TS24.301 has specified four types of TFT related errors as below:

(1) Semantic error in the TFT operation is more likely the case when there is a contextual inconsistency in the TFT operation. The following shows example cases:
   - The TFT operation of other than "Create a new TFT" in the Activate dedicated EPS bearer context request.
   - The TFT operation of "Delete packet filters from existing TFT" when the deletion will result in the empty TFT.
(2) Syntactical error in TFT operations is more likely the case when there is a logical inconsistency between TFT operation and the packet filters. The following shows example cases:
   - The TFT operation of "Create a new TFT" and the empty packet filter list in the TFT IE.
   - The TFT operation of "Add packet filters in existing TFT" and the empty packet filter list in the TFT IE.
   - The TFT operation of "Delete packet filters from existing TFT" when there is no corresponding packet filter in the existing TFT.
(3) Semantic error(s) in packet filter(s) is more likely the case when a packet filter consists of conflicting packet filter component which would render the packet filter ineffective.
(4) Syntactical error(s) in packet filters(s) is more likely the case when two or more packet filters in the resultant TFT would have component(s) with identical values such as the same packet filter identifiers, the same packet filter precedence values, etc.

Each of the above error cause can appear in the following NAS messages as an ESM cause:

(1) The Activate dedicated EPS bearer context reject (UE-->MME) as a failure to create the dedicated EPS bearer.
(2) The Modify EPS bearer context reject (UE-->MME) as a failure to modify the dedicated EPS bearer.
(3) The Bearer Resource Allocation reject (MME-->UE) as a failure to initiate the activation of the dedicated EPS bearer.
(4) The Bearer Resource Modification reject (MME-->UE) as a failure to initiate the update of the dedicated EPS bearer.


III. Case study
The following snapshot has been captured while testing the conference call scenario. Having been sorted out based on the MME-UE-S1AP-ID, it shows the lifetime of the EPS bearer from when it is created until it is released due to the "semantic error in the TFT operation". In the meantime, there are five times of EPS bearer modifications occurred.

NOTE The MME-UE-S1AP-ID is assigned by the MME to identify the UE over S1AP. In the same way, the eNB also identifies the UE by assigning the ENB-UE-S1AP-ID.

The following snapshot shows the TFT in the Activate dedicated EPS bearer context request. Please note that there are two packet filters, one for the RTP and the other one for the RTCP. The TFT operation has to be "Create a new TFT". The packet filter identifiers are 1 and 2 and the precedence values are 223 and 191, respectively.

NOTE the detail of the second packet filter is not shown in this snapshot.

The following snapshot shows the TFT in the first Modify EPS bearer context request. The TFT operation is "Add packet filters to existing TFT". The packet filter identifiers are 3 and 4 and the packet precedence values are 247 and 239, respectively.

NOTE the detail of the second packet filter is not shown in this snapshot.

All the history of packet filters for the rest of operations can also be analyzed following the same way. The following table shows the resulting analysis of the details for all the packet filters during the lifetime of the EPS bearer.

In this example, the last TFT "Add packet filters to existing TFT" operation which is sent in the Modify EPS bearer context request has the same packet precedence value with the existing packet filter #5. Therefore, the UE responds with the ESM cause = "semantic error in the TFT operation" in the Modify EPS bearer context reject.

NOTE The UE seems to have a glitch sending the wrong ESM cause in this test case. The duplicated packet precedence value will lead to the ESM cause of "Syntactical errors in packet filter(s)" according to the 3GPP TS24.301.

Red Mouse

VoLTE: Bearer binding and Session binding

The LTE supports the PCC(Policy and Charging Control) architecture for QoS control applied to service data flow. In the PCC architecture, the PCRF(Policy and Charging Rules Function) takes the role of a central network component interacting with P-CSCF, SPR(Subscription Profile Repository) and the EPC. The PCRF is always involved in the activities of EPS bearer creation by generating the PCC(Policy and Charging Control) rules and provisioning them to PDN GW(i.e., PCEF). In order to generate PCC rules, the PCRF needs to gather service data flow information from the P-CSCF and possibly the subscription information from the SPR. As the PCC rule shall be applied from the access network to the EPC core with consistency, the PCRF needs to be able to maintain the relations of different sessions over different interfaces across the IP-CAN, EPS bearer and applications, in which the binding mechanism becomes a basic concept.

NOTE In this article, it is assumed that the S5 between the SGW(Serving GW) and PGW(PDN GW) is using GTP, where the PGW becomes the end point of the GTP tunnel.


I. Session binding

The session binding is an association of the AF session information to one and only one IP-CAN session [TS23.203]. Th AF(Application Focus) session is defined as a service level session such as IMS service session that is established by the application level signaling protocol offered by the AF that requires a session-setup with explicit session description before the use of the service[TS29.214].

The IP-CAN session information is obtained by the PCRF during the UE initial attach procedure.
When the UE performs the initial attach to the LTE network, the PGW triggers the CCR-I towards the PCRF. The CCR-I contains the IP-CAN related AVPs such as Framed-IP-Address, IP-CAN-Type, RAT-Type, Called-Station-Id, AN-GW-Address. The following is an example of CCR-I captured over Gx.

• Framed-IP-Address: The valid routable IPv4 address that is applicable for the IP Flows towards the UE at the PCEF. The PCRF shall use this address to identify the correct IP-CAN session binding[TS29.214].
• Freamed-IPv6-Prefix: A valid full IPv6 address that is applicable to an IP flow or IP flows towards the UE at the PCEF. The PCRF shall use this address to identify the correct IP-CAN session binding[RFC4005,RFC3162].
• IP-CAN-Type: Type of Connectivity Access Network in which the user is connected[TS29.212]. 
• RAT-Type: The Radio Access Technology that is currently serving the UE[TS29.212].
• Called-Station-Id: APN [TS29.212].

The service data flow information is obtained while the service session is set up. Upon UE request for VoLTE call setup, the SIP INVITE is delivered to the P-CSCF(i.e., AF) with an SDP offer. The SDP offer includes media session information such as 5-tuples(source ip address, destination ip address, source port, destination port and protocol), codec information, etc. Upon receiving the SIP INVITE, the P-CSCF interprets the received SDP contents into diameter AVPs and triggers the AAR towards the PCRF. The following shows an example of SDP contents included in the SIP INVITE.

NOTE It would be possible for the P-CSCF to trigger AAR once when the 183 Session In Progress is received(SDP answer) in order to reduce diameter traffic.

The following is an example of diameter AAR over Rx which includes the service data flow information.

• Media-Sub-Component: contains the requested bitrate and filters for the set of IP flows identified by their common Flow-Identifier[TS29.212].
• Flow-Description: defines a packet filter for an IP flow with the following information[TS29.212].
• Flow-Status: describes whether the IP flow(s) are enabled or disabled[TS29.214].
• Max-Requested-Bandwidth-UL/DL: Indicates the maximum requested bandwidth in bits per second for an uplink/downlink IP flow[TS29.214].
• RS-Bandwidth: indicates the maximum required bandwidth in bits per second for RTCP sender reports within the session component[TS29.214].
• Codec-Data: contain codec related information known at the AF[TS29.214].

Upon receiving the AAR, the PCRF binds the service data flow information received from the P-CSCF to a specific IP-CAN session received from the PGW.


II. Bearer Binding

The bearer binding is the association of the PCC rule and the QoS rule (if applicable) to an IP-CAN bearer within that IP-CAN[TS23.203]. Upon user's request for voice call, the SIP signals will flow through the EPS bearer of QCI=5 and there will be additional EPS bearer newly established to transfer voice traffic. In the same way as described in the previous section, the PCC rules are generated and provisioned to the PGW by the PCRF. The PGW enforces PCC rules accordingly by performing gating control over service data flow.

The PCC rule contains various parameters that can be used to control service data flow such as Flow-Information, Flow-Status, QoS, etc. The following snapshot shows an example of PCC rule contained in the diameter RAR over Gx for voice traffic.

Upon receiving the RAR, the PGW triggers the EPS bearer creation procedure by sending the Create Bearer Request to the MME. The Create Bearer Request contains the TEID for GTP-U created by the PGW and QoS parameters(QCI, MBR, GMBR) as well. In return, the corresponding response from the MME, Create Bearer Response, contains the allocated EBI(EPS Bearer ID) and the TEID for GTP-U created by the eNB. As an end point of the GTP Tunnel, the PGW shall maintain the relations between EPS bearers and PCC rules. The following is an example of Create Bearer Response captured over GTPv2.

***

The session binding and the bearer binding are basic concepts to understand how different type of sessions are related with each other over different interfaces within the PCC architecture. The IP-CAN session to which the UE is attached is bound with the AF session by the PCRF and the service data flow for that AF session is used to generate the PCC rules. These PCC rules are used to map the specific service data flow to a certain EPS bearer which belongs to that IP-CAN session.

Thanks to this binding relations, one event at one place makes a ripple effect to the other, thereby the LTE core can maintain the consistent status for the same UE. If the UE releases an AF session, the corresponding PCC rules for the service data flow belonging to that AF session are removed and in turn, the EPS bearer for that PCC rules will also be released. If the UE detaches from the network, the IP-CAN session will be released and in turn, all the AF session and EPS bearers belonging to the same IP-CAN will also be released.

Red Mouse

VoLTE: E-RAB management vs Handover

The 3GPP TS36.413 addresses the racing condition between UE handover and the E-RAB management procedures. The UE handover occurs based on the measurement parameters sent by the UE whereas the EPS bearer creation as a part of VoLTE call setup procedure in general. When these two independent events occur at the same time, there can be a collision at eNB, as the eNB is involved in both procedures. In this collision state, the eNB has two options to take as follows:


I. Terminating the E-RAB Setup and continues the UE S1 handover

The following flow shows the eNB rejecting the E-RAB setup request and continues the handover procedure. Upon receiving the rejection to the E-RAB setup request with its cause id, e.g., "S1 intra system Handover Triggered", the MME continues the S1 handover procedure. In the meantime, the Create Bearer Request can be postponed temporarily until the handover is completed. If the Serving GW or MME is to be changed, the Create Bearer Request will be rejected with its cause id set to "Temporarily rejected due to handover" and the P-GW may retry the EPS bearer creation procedure after the S1 handover is completed(refer to http://bit.ly/1H4Z7yr for the detail).

II. Cancelling the UE handover and continues E-RAB Setup

The following shows the eNB cancels the S1 handover towards the MME and continues the EPS bearer creation procedure. Upon receiving the Handover Cancel, the MME terminates ongoing Handover Preparation procedure and release any resources associated with the handover preparation. If the eNB does not receive the Handover Cancel Ack, it is assumed that the handover is terminated successfully.

The following shows the eNB cancels the X2 handover to continue the EPS bearer creation procedure according to 3GPP TS36.423. Upon receiving the Handover Cancel, the target eNB releases any resources reserved for the concerned UE context.

III. Service impact
The eNB shall be able to handle the racing condition between two independent events(i.e., E-RAB setup request and handover) either by cancelling the handover or by rejecting the E-RAB setup request. The MME also needs to be able to handle the racing condition either by rejecting the bearer related requests with a corresponding reason (e.g., Temporarily rejected due to handover) or by possibly providing pause-and-resume mechanism itself for bearer related requests in case the handover is in progress. If the bearer related request is rejected, the PGW may realize the retry mechanism(refer to http://bit.ly/1H4Z7yr for the detail). If this type of racing condition is not handled appropriately, there could be frequent call drops or call setup failures based on eNB optimization status resulting in bad user experiences of VoLTE user.


Red Mouse