Complete SIP and SDP: Complete Guide, NGN: Softswitch, H.248, SIGTRAN and TDM Interworking, and LTE/4G and the EPC Core first: SIP methods, headers, transactions and dialogs (RFC 3261), the SDP Offer/Answer model (RFC 3264), H.248 (MEGACO) contexts and ISUP ↔ SIP interworking (Q.1912.5 / Q.850), as well as EPC core architecture (P-GW, PCRF, HSS), EPS bearers (QCI 5 for SIP signaling and QCI 1 for voice), the Diameter base protocol (RFC 6733) and AKA authentication are used here without repeating the basics.
One topic, one lesson: interactive slides, SIP and Diameter signaling ladder diagrams, iFC trigger and session-routing animations, exercises with automated answer checking, and study notes in three languages (az, ru, en). Every lesson includes a worked example, a “What can go wrong and how to find it” section, practice tasks and a self-check. Hands-on labs run on the track Docker testbed: Kamailio IMS (P-CSCF, I-CSCF, S-CSCF) + pyHSS + rtpengine + DNS (NAPTR/SRV/ENUM) + Asterisk (as AS and PSTN gateway) + Wireshark.
Course outline
01
IMS architecture
- why IMS is needed (one unified multimedia core across any access network and service)
- history of 3GPP Releases 5/6/7 (ETSI TISPAN, Common IMS) and 3GPP2 MMD
- the three-plane architecture (access/transport, session control, application services)
- P-CSCF, I-CSCF, S-CSCF
- emergency E-CSCF and LRF
- HSS and SLF, Application Servers (MMTel AS, SCC AS, IP-SM-GW, IM-SSF)
- MRFC and MRFP, BGCF/MGCF/IM-MGW
- IBCF and TrGW, Huawei IMS product mapping (CSC3300, ATS9900, CloudSE2980, UGC3200/MSOFTX3000, UMG8900, MRP6600, HSS9860, SPG2800, iCG9815)
- fixed VoIP access (SBC + P-CSCF)
- PSTN emulation via AGCF/MSAN (UAC3000, UA5000) and enterprise SIP trunks
02
Subscriber identities and data model
- Private User Identity (IMPI)
- Public User Identity (IMPU: SIP URI and tel URI)
- ISIM vs USIM smart-card applications and IMSI-derived identities
- Implicit Registration Sets
- Service Profiles, Initial Filter Criteria (iFC structure: TriggerPoint, SPT, ApplicationServer, DefaultHandling) and real-world iFC examples
- PSI and GRUU overview, the HSS data model and subscriber provisioning from billing via the SPG gateway
03
IMS reference points and protocols
- complete reference-point map (Gm, Mw, Mi, Mj, Mk, Mg, Mr, Mp, Mn, ISC, Ici/Izi)
- Diameter Cx/Dx commands (UAR, MAR, SAR, LIR, RTR, PPR)
- Diameter Sh interface for Application Servers (UDR, PUR, SNR, PNR)
- Diameter Rx interface toward PCRF (AAR, RAR, STR, ASR)
- Ro and Rf charging interfaces
- 3GPP SIP extensions in TS 24.229 (Path, Service-Route, Security-Client/Server/Verify)
- IMS P-headers (P-Visited-Network-ID, P-Called-Party-ID, P-Served-User, P-Charging-Function-Addresses) and inter-node Network Domain Security (NDS/IP, Za/Zb, TLS)
04
IMS registration
- end-to-end registration overview
- how the UE discovers the P-CSCF (PCO, DHCP, static config)
- initial REGISTER (P-CSCF → I-CSCF and Diameter UAR/UAA)
- S-CSCF selection via mandatory/optional capabilities and server name
- MAR/MAA authentication vectors and 401 Unauthorized
- IMS-AKA mutual authentication (RES, XRES, AUTN)
- SQN desynchronization and resynchronization via AUTS
- IPsec SA pair setup between UE and P-CSCF (Security-Client/Server/Verify)
- SAR/SAA profile download and 200 OK (Path and Service-Route)
- Third-Party Registration to Application Servers
- subscribing to the reg-event package (SUBSCRIBE/NOTIFY)
- re-registration and network-initiated de-registration (RTR)
- P-CSCF/S-CSCF failure recovery (IMS Restoration) and a registration trace practicum
05
IMS session control
- splitting calls into Originating (MO) and Terminating (MT) session halves
- MO call progression (UE → P-CSCF → S-CSCF)
- step-by-step iFC evaluation in the S-CSCF and invoking Application Servers over ISC
- the four AS operating modes (Proxy, B2BUA, Terminating UA, Originating UA) and multi-AS chaining
- number normalization (tel URI, phone-context and user=phone)
- routing lookup via ENUM and DNS
- provisioning ENUM zones and records
- MT call ingress at the I-CSCF (Diameter LIR/LIA)
- terminating S-CSCF → P-CSCF → UE delivery
- QoS Preconditions negotiation (SDP curr, des, conf attributes)
- session release, access-edge media handling (P-CSCF/SBC and IMS-AGW)
- complete end-to-end IMS–IMS call flow and a session-path practicum
06
IMS laboratory with Kamailio, pyHSS and rtpengine
- testbed architecture (what Kamailio P/I/S-CSCF, pyHSS, rtpengine, DNS and Asterisk model)
- bringing up the IMS core on the Docker testbed
- provisioning a subscriber in pyHSS (IMPI, IMPU, keys, iFC)
- capturing correlated SIP and Diameter Cx registration flows in Wireshark
- reproducing SQN desynchronization and AUTS resync
- capturing a full IMS–IMS call across all CSCFs
- triggering an iFC to route calls through Asterisk as an Application Server
- verifying Third-Party Registration on the AS
- and configuring E.164 ENUM records in the testbed DNS
07
Interworking with the PSTN and external networks
- breakout point selection by the BGCF
- SIP ↔ ISUP signaling conversion on the MGCF
- controlling the IM-MGW over H.248 on the Mn reference point
- PSTN-to-IMS incoming call flow
- inter-operator IMS ↔ IMS interconnect via IBCF and TrGW
- IPX carrier exchange and IMS roaming overview
- a hands-on PSTN gateway breakout lab on the testbed and an interworking practicum
08
Media resources and MMTel supplementary services
- playing announcements and early media via MRFC/MRFP
- multi-party audio conferencing on the MRF
- a hands-on MRF announcement lab
- overview of the Multimedia Telephony (MMTel) service suite (3GPP TS 24.173)
- Call Diversion (CDIV), identity presentation and restriction services (OIP, OIR, TIP, TIR)
- Call Hold, Call Waiting (CW) and Explicit Call Transfer (ECT)
- subscriber self-service configuration over Ut/XCAP
- video calling and video conferencing
- IP Centrex and RCS overview (Huawei ATS9900 and RCS9880)
- and detailed emergency call architecture in IMS (Emergency Registration, E-CSCF, LRF and PSAP routing)
09
IMS charging architecture
- offline and online charging entities (CTF, CDF, CGF and OCS per 3GPP TS 32.260)
- billing correlation identifiers ICID
- IOI and the P-Charging-Vector header
- offline charging over Diameter Rf (ACR/ACA messages and CDR generation)
- ACR record types (Start, Interim, Stop, Event)
- dissecting IMS CDR fields
- real-time online charging over Diameter Ro (CCR/CCA credit control)
- a hands-on call accounting lab on the IMS testbed and a charging practicum
10
Huawei IMS practice and operations
- Huawei IMS O&M fundamentals (OMU architecture, LMT terminal and end-to-end signaling trace per documentation)
- IMS capacity dimensioning (simultaneous registrations, BHCA, session licensing)
- correlating SIP and Diameter in a single Wireshark capture
- IMS SIP failure codes reference (403, 404, 480, 488, 500, 503, 580) and a fault-injection and recovery lab on the testbed
11
Problems, solutions and final project
- 30 real-world outage investigations (403 Forbidden on mismatched IMPI/IMPU with Diameter 5002 and 5001 User Unknown; infinite 401 Unauthorized loops due to SQN desync and wrong ISIM/HSS keys; IPsec SA setup failure; unreachable P-CSCF in PCO/DNS; I-CSCF failing to select an S-CSCF; registration drops due to short Expires and NAT timeouts; failed Third-Party Registration to AS, iFC not triggering, and AS timeouts with DefaultHandling; 404 routing/ENUM failures, 480 Not Registered, 488 codec mismatch and 580 Precondition Failure; BGCF PSTN breakout failure and MGCF cause mapping errors; one-way audio across the SBC and silent announcements due to P-Early-Media; CDIV forwarding loops, hidden caller ID due to PAI/Privacy and Ut/XCAP 403 errors; missing Rf CDRs and calls blocked by OCS over Ro; HSS overload during mass re-registrations and P-CSCF failure recovery; broken DNS NAPTR/SRV records, IBCF TLS handshake failures, AS ↔ S-CSCF routing loops and misrouted emergency calls to PSAP)
- systematic IMS troubleshooting workflow and the operator IMS core design capstone project
The eleventh course of the 14-course Telecom track, from the telephone line to 5G.
