VoLTE Call Flow and Procedures

VoLTE call flow and procedures is very big area to cover because of the many scenarios to consider from both UE and network perspective.

In this article I will try to put some examples of VoLTE call flow from UE point of view. These procedures are the most important for VOLTE calls.

From the UE’s point of view the initial step is to camp on the network and read system information in the form of Master Information Blocks (MIBs) and System Information Blocks (SIBs). Once that information has been processed the UE can initiate its own processes.

EPS Attach for VoIP and Default  Bearer Setup

VoLTE EPS Attach Call Flow

Let’s discuss how UE attach to network after camping on and how default bearer is created for IMS services.  We are discussing the whole procedure from UE point of view. This process consists of some important sub-procedures as follows:

  • PDN Connectivity
  • Authentication
  • Bearer Setup and EPS Attach
  • P-SCCF Discovery

PDN Connectivity

UE starts connection by sending RRC Connection Request message. This is similar to UMTS registration. This is a UE originated message and it contains important information as what the UE wants.

For example the cause value in RRC Connection Request can be “Mobile Originated Signalling” or “Emergency”. If there is no problem in the network then network or eNodeB will respond with RRC Connection Setup message. This message contains signalling radio bearer information and is transmitted over downlink DCCH (Dedicated Control Channel) channel.

After receiving the RRC Connection Setup message UE responds with RRC Connection Complete message. At this point Attach Request is already sent to the network which is an exception from old UMTS system.

Authentication

To protect UE and network from security and man in the middle attacks all UEs in the network need to be checked and secured before they can use any network resources. To begin this process network send Authentication Request message or a challenge to make sure the UE is a valid entity. In response UE sends Authentication Response.

After that network sends Security Mode Command to UE. IT is also good to know that Security Mode Command is integrity protected. This message carries vital information on ciphering. In response UE sends Security Mode Complete message.

In order to protect EPS Session Management (ESM) information, the network now sends an ESM Information Request; the UE reacts with an ESM Information response describing the now-protected protocol configuration options.

Bearer Setup

At this point network must set up additional bearers to carry out IMS VoLTE call. To establish EPS bearer network sends Radio Bearer Reconfiguration message. UE responds with Radio Bearer Reconfiguration Complete message.

P-CSCF Discovery

Before sending any Session Initiation Protocol (SIP) requests, the UE must perform “P-CSCF Discovery”, the process of identifying (by address) the correct Proxy-Call Session Control Function (P-CSCF). The P-CSCF address may be discovered in one of three different ways:

  • It may be stored in the IP Multimedia Services Identity Module (ISIM).
  • The UE may request it as part of the PDN connectivity request during the Attach process.
  • The UE may request an IP address and Fully Qualified Domain Name (FQDN) from a DHCP server and then perform a DNS query on the returned IP address and FQDN.

SIP IMS Call Flow

VoLTE SIP Call Flow

SIP Registration

After UE finishes radio procedures and it establishes radio bearers UE can start SIP registration towards the IMS for VoLTE call.

Here is a typical IMS SIP registration call flow.

  1. The IMS client attempts to register by sending a REGISTER request to the P-CSCF.
  2. The P-CSCF forwards the REGISTER request to the I-CSCF.
  3. The I-CSCF polls the HSS for data used to decide which S-CSCF should manage the REGISTER request. The I-CSCF then makes that decision.
  4. The I-CSCF forwards the REGISTER request to the appropriate S-CSCF.
  5. The S-CSCF typically sends the P-CSCF a 401 (UNAUTHORIZED) response as well as a challenge string in the form of a “number used once” or “nonce”.
  6. The P-CSCF forwards the 401 – UNAUTHORIZED response to the UE.
  7. Both the UE and the network have stored some Shared Secret Data (SSD), the UE in its ISIM or USIM and the network on the HSS. The UE uses an algorithm per RFC 33101 (e.g. AKAv2-MD5) to hash the SSD and the nonce.”
  8. The UE sends a REGISTER request to the P-CSCF. This time the request includes the result of the hashed nonce and SSD.
  9. The P-CSCF forwards the new REGISTER request to the I-CSCF.
  10. The I-CSCF forwards the new REGISTER request to the S-CSCF.
  11. The S-CSCF polls the HSS (via the I-CSCF) for the SSD, hashes it against the nonce and determines whether the UE should be allowed to register. Assuming the hashed values match, the S-CSCF sends 200 – OK response to the P-CSCF. At this point an IPSec security association is established by the P-CSCF.
  12. The P-CSCF forwards the 200 – OK response to the UE.

NOTE: It is typical that UE makes a deliberate unauthenticated registration attempt. It waits for the expected 401 response, extracts the nonce from the response and hashes it with the SSD before including the result in a second REGISTER request.

QoS Class Identifier (QCI)

QCI parameter generally targets a specific service type based on delay and packet loss requirements. For VoLTE call the bearer is associated with QCI value from row 1 as described in the following table.

LTE QoS Class Identifier - QCI

Chapter #5 – IMS SIP Requests and Codes

20 Comments


  1. What happens in case Inroamer(other network IMS customer roaming on your IMS network) is initiating the call?


  2. I keep getting Volte Drop Calls with Error Internal Cause Code:(503) SIP 503 SERVICE UNAVAILABLE


  3. Is there any way we can use the normal LTE phones for VOLTE? Recently the Jio sim was out and is running based on the VOLTE service. I found an article explaining VOLTE here
    http://www.techandseo.com/2016/10/volte-call-flow-voice-over-lte
    But it discussed how to enable it in ios 8. nothing more.
    Can you help me with this?
    I use an iPhone 7 Plus


  4. If iPhone 7 has Jio configuration enabled in the modem, VoLTE should be up. Otherwise check with operator.


  5. Why subscribe and notify is sent after registration?


  6. Can somebody please tell me, How call will flow from 4G to 2G/3G network. Suppose I am in 4G network and my friend is in legacy network. How call will flow from VOLTE to 2G/3G CS.


  7. @ Chirag:

    I saw your question today…

    When you make a VoLTE origination call from your home network to your friend who is legacy 2g/3g the call flow is a below:

    A is your self having VoLTE phone and B is your friend in 3g.

    A –> PCSCF–> SCSCF –> Origination AS (to execute originating service if provisioned) –> SCSCF (after service execution) –> BGCF –> MGCF –> CS.

    SCSCF after receiving the originating request from AS, tries to find out terminating subscriber network. so it sends ENUM query for B party number and upon query failure, SCSCF decides that B party is not in its own network and that where it hand over the call to BGCF and from BGCF it will route it to corresponding MGCF and from it reach CS networks.

    So operator should know which is CS number and which is VoLTE numbers to configure in ENUM servers. in case if the B party is VoLTE number, ENUM will return the ICSCF’s address of B party. (since ICSCF is the entry point for any terminating request)

    Hope it answers your query…


  8. @Bharath :

    Why SCSCF send req to ENUM to find out CS number, i think in SIP invite itself , tel: number tells that it is a CS number right? pls let me know.

    @sandy:
    Notify is req to change any params during SIP reg, sent by NW.
    eg; reg timer value diff in NOTIFY which is to be accepted by UE.


  9. Can somebody please tell me, How call will flow from 2G/3G to 4G network. Suppose I am in 2G/3G network and my friend is Volte network. How call will flow from 2G/3G CS to VOLTE


  10. @Amit Kumar

    dear amit, call came to mgcf(CS domain)->bgcf now bgcf send invite to respective icscf->hss(find SCSCF address) ->scscf after than SCSCF does no. normalization(services barring, call divert,CRBT etc). after getting INvite from ATS, SCSCF sends to prospective Pcscf ->sbc->UE..

    Pls educate me if anything missing or im wrong & share docs to me on Ashraebareli@gmail.com

    thanks \\
    ashish


  11. I see you don’t monetize your website, don’t waste your traffic, you can earn extra bucks every month.

    You can use the best adsense alternative for any type of
    website (they approve all websites), for more info simply search in gooogle: boorfe’s tips monetize your website


  12. Can anybody tell me how the call will flow if Volte configuration not done on RAN site but configuration is done on IMS side.


  13. @Prachish Sharma:
    Although IMS signalling and data is transparent to RAN, I think if RAN site is not configured, QCI related information and scheduling are not supported by RAN, you will not get the real VoLTE service from RAN side.


  14. Thanks , I have recently been looking for information approximately this subject for ages and yours is the greatest I’ve came upon so far.
    However, what concerning the bottom line? Are you positive in regards to the
    source?


  15. Can you please discribe in detail about 401 unauthorized message send by S-CSCF.


  16. Can anyone explain why second time UAR msg needs to send although at first time S-CSCF address stored in HSS.
    Then A-SBC can directly send the Register request to serving CSCF


  17. Hi,

    Is it necessary call will go to ims network eventhough both ues(called & caller) in same network(users latched in adjacent enb’s)


  18. So each carrier have there own MME, S-GW P-GW servers! Is the IMS server is own by each carrier also?



Leave a Reply

Your email address will not be published. Required fields are marked *