When mobile networks moved to 4G LTE and then to 5G NR, their core became purely packet-based: the EPC core (in 5G — 5GC) can only deliver IP packets. The familiar "telephone half" — the circuit-switched domain CS — is no longer there. Yet people still need an ordinary call to a phone number: it must connect in a couple of seconds, sound clean at busy hour, work in roaming, reach 112 and be charged correctly. In this lesson we look at why Internet messengers do not solve this task, and how the 3GPP TS 23.228 standard solved it with IMS — one core for any access network and any service.

Goal and prerequisites

After this lesson you will be able to:

  • explain why an EPC / 5GC core without a CS domain does not provide telephony by itself, and why the interim CSFB solution holds the operator back;
  • compare a messenger call (OTT) with a carrier call on six points: QCI 1 quality guarantee, emergency calls, billing, lawful interception, roaming and a single E.164 number;
  • name the three main principles of IMS per 3GPP TS 23.228: access-network independence, end-to-end quality control through the link with PCC, and separation of service logic from session control;
  • explain what Fixed-Mobile Convergence (FMC) is and calculate how much an operator saves by replacing several legacy networks with one core.

What you need to know beforehand:

  • course sip, lessons 1–10: what SIP is, the INVITE request, the SDP session description and RTP voice packets;
  • course ngn, lessons 1–5: the move from TDM to Softswitch and media gateways;
  • course lte: lessons 3–5 (the EPC core without a CS domain, the MME, S-GW, P-GW, HSS, PCRF nodes, the Gx and SGs interfaces and CSFB voice fallback), lesson 24 (ROHC header compression), lesson 42 (the APN access point), lesson 72 (the Dedicated EPS Bearer requested via Rx / Gx) and lesson 97 (Home Routed roaming).

A real-life task

A national operator serves 6 million mobile subscribers (4G LTE and a 5G NR network under construction) and 900,000 homes on its fixed network (GPON and copper xDSL). The network has grown for decades, so the operator runs four separate networks — "silos" side by side:

  1. 2G/3G mobile voice (the CS domain: MSC-Server, MGW, HLR). A smartphone on 4G drops to 3G/2G on every call via the CSFB procedure. Because of this, the operator cannot switch off 3G and give 15 MHz of spectrum to 4G/5G.
  2. Fixed telephony (legacy TDM exchanges and a Softswitch) — with its own subscriber database and its own billing.
  3. The 4G/5G packet core (EPC / 5GC) — delivers fast Internet but does not understand calls.
  4. The business platform (office PBXs and SIP trunks) — not linked to employees' mobile numbers at all.

At the board meeting, the CFO asks: "Subscribers already call each other on WhatsApp and Telegram over mobile Internet. Why do we need a new core? Let's keep one Internet channel and switch off all the telephone exchanges!"

As the core network architect, you must answer with numbers and facts: why the operator cannot hand voice over to messengers, how one IMS core replaces four silos, and how much it will save.


1. A 4G/5G core without a CS domain: what is the problem

In 2G and 3G networks the core had two halves: the circuit-switched domain (CS) for voice and the packet-switched domain (PS) for the Internet. When designing 4G, the 3GPP consortium kept only the packet half. The EPC core (and later 5GC) is an IP packet transport: the S-GW and P-GW nodes deliver packets and apply quality rules to them, but they do not know what a phone number, a ringing tone, "busy", call forwarding or a conference is.

Analogy: the 4G core is a modern motorway. It carries any cargo perfectly, but it has neither a taxi dispatch office nor a letter delivery service. The road is built — the service that takes the order "connect me to +994…" has to be created separately.

Until such a service existed, operators used an interim solution, CSFB (course lte, lesson 5): when a call arrives, the MME tells the legacy switch about it over the SGs interface, and the smartphone leaves 4G for 3G or 2G for the duration of the call. It works, but at a price:

  • Slow call setup. Measurements in live networks show that call setup via CSFB takes roughly 4–7 seconds, while a call that stays entirely in 4G through IMS takes roughly 1.5–2.5 seconds.
  • Internet suffers during the call. In 3G the speed drops several times, and in 2G data transfer often stops completely during the conversation.
  • Frozen spectrum. As long as voice depends on CSFB, the operator must keep 2G/3G switched on and occupy frequencies that would carry several times more data in 4G/5G.
  • A dead end for 5G and Wi-Fi. Where 2G/3G has already been switched off, there is nowhere to fall back to. And a legacy switch cannot accept calls over home Wi-Fi.
  • Four silos. Every new service (for example, a spam-call filter) is built four times — on four incompatible platforms, with four engineering teams.
Four vertical networks versus one horizontal IMS core
Four vertical networks versus one horizontal IMS core

2. Carrier call versus OTT messenger

OTT (Over-The-Top) is a service that runs over the operator's Internet channel without any agreement with its core: WhatsApp, Telegram, FaceTime. For the operator, such a call is just encrypted packets in the shared Internet channel.

Analogy: an OTT call is a parcel sent by ordinary post together with thousands of others. A carrier call is the same parcel, but with a courier, a separate lane on the road, insurance and a receipt.

The difference runs along six boundaries — exactly the ones listed in the lesson outline:

FeatureOTT messengerCarrier call through IMS
Quality guaranteeShared Internet channel QCI 9: voice waits in the queue with video and updatesA separate voice channel QCI 1 with a guaranteed bit rate (GBR) for the duration of the call
Emergency callsReaching 112 is not guaranteed, cell-based location is not passed to the serviceA 112 call is handled by the network with priority and location data
BillingThe operator sees only megabytesEvery call is charged: who, to whom, how many minutes
Lawful interceptionThe operator cannot meet the legal requirement: traffic is encrypted by the appInterception by court order is performed in the operator's core according to the standard
RoamingWorks only if there is Internet, with no inter-operator guaranteesCalls on your own number abroad under operators' roaming agreements
Single E.164 numberCalls only inside one appAny number in the world: mobile, landline, office (tel URI, course sip, lesson 9)

The main technical reason is in the first row. The eNodeB base station and the P-GW gateway do not know that a conversation is travelling inside the Internet channel. When hundreds of people in a cell watch video in the evening, the QCI 9 queue overflows — and the messenger voice starts to break up.

In IMS it is different. When a subscriber dials a number in the phone's ordinary dialler:

  1. The SIP INVITE request with an SDP description goes over a separate access point APN ims in the QCI 5 channel — it has the highest priority and is meant for signalling.
  2. The IMS core reads from the SDP which voice stream is needed and reports it to the policy node PCRF over the Rx interface (course lte, lesson 72).
  3. The PCRF commands the P-GW gateway over the Gx interface, and the gateway, via the S-GW, MME and eNodeB, creates a dedicated QCI 1 channel for this conversation only. The base station enables ROHC header compression for it (course lte, lesson 24).
  4. After hang-up (SIP BYE) the QCI 1 channel is removed and the cell's resources are freed.
An OTT call in the shared QCI 9 channel and an IMS call with a dedicated QCI 1 channel
An OTT call in the shared QCI 9 channel and an IMS call with a dedicated QCI 1 channel

The parameters of the QCI classes are defined in 3GPP TS 23.203 (the table of standardized characteristics). Below is a comparison in a congested cell: the class parameters come from the standard, while the delay and quality values are an illustrative example.

yaml
# Congested 4G cell at busy hour (illustrative example)
cell:
  active_subscribers: 120
  radio_resource_load: "94%"

qci_classes_ts_23_203:
  QCI_9: {type: "non-GBR", priority: 9, delay_budget_ms: 300}  # Internet
  QCI_5: {type: "non-GBR", priority: 1, delay_budget_ms: 100}  # IMS signalling
  QCI_1: {type: "GBR",     priority: 2, delay_budget_ms: 100}  # conversation

ott_call:
  channel: "APN internet, QCI 9"
  what_the_network_sees: "encrypted UDP packets, like a file download"
  busy_hour_result: {jitter_ms: 185, loss_percent: 4.8, rating: "poor"}

ims_call:
  signalling: "APN ims, QCI 5"
  voice: "dedicated QCI 1 channel (created via Rx -> PCRF -> Gx -> P-GW)"
  busy_hour_result: {jitter_ms: 14, loss_percent: 0.08, rating: "clean"}

The smaller the priority number, the sooner the base station scheduler serves the packets. That is why QCI 5 (priority 1) and QCI 1 (priority 2) go ahead of QCI 9 Internet traffic (priority 9).


3. The three principles of IMS per 3GPP TS 23.228

IMS (IP Multimedia Subsystem) is a core that uses the SIP protocol to set up voice, video and text sessions over any IP network. Its architecture is described in specification 3GPP TS 23.228 and rests on three principles.

Principle 1. Access-network independence

The IMS core does not care how the subscriber is connected — as long as there is IP:

  • 4G LTE — through the EPC core (voice over LTE is often called VoLTE);
  • 5G NR — through the 5GC core;
  • Wi-Fi — at home, in the office or in a hotel abroad: the smartphone builds a protected tunnel over the Internet to an operator gateway, and the gateway connects it to the same core;
  • GPON / xDSL — a home optical terminal or an office IP phone registers in the same core using SIP.

Analogy: IMS is like a bank card. You can pay in a shop, online or by phone — the account and the rules stay the same. The way of access changes, the "bank" stays one.

Principle 2. End-to-end quality control through the link with PCC

An ordinary SIP proxy (course sip, lesson 4) forwards signalling "blindly" and does not know whether the network has enough capacity. IMS is linked to the transport through the PCC architecture (Policy and Charging Control, course lte). For each media stream the IMS core requests resources from the PCRF, and the conversation gets its own guaranteed channel — audio QCI 1, video QCI 2. At the same time PCC provides data for charging.

Principle 3. Service logic is separated from session control

Instead of vertical silos, IMS divides the network into three horizontal layers:

  1. The access and transport layer — 4G/5G base stations, Wi-Fi, GPON, S-GW / P-GW gateways.
  2. The session control layer — IMS core nodes that register the subscriber, check them, route SIP and request quality. The subscriber profile is stored in the HSS database (familiar from course lte).
  3. The service layer — separate servers where the logic "lives": call forwarding, call hold, conferences, voicemail, messaging, an office PBX.

Session control holds no logic of specific services — it simply hands the call to the right service server.

Analogy: a taxi dispatcher (session control) takes the order and passes it to the right service: economy, cargo van, child seat (services). To add "flower delivery", there is no need to rebuild the dispatch office — just connect the new service.

What the session control nodes and service servers are called, and how they talk to each other, we will cover in the next lessons of this section.

Fixed-Mobile Convergence (FMC)

Together the three principles give FMC (Fixed-Mobile Convergence):

  • one profile in the HSS — a home phone on GPON, a softphone on a laptop and a smartphone on 4G/5G can belong to one subscriber; on an incoming call all devices ring at once (this is call forking, course sip, lesson 80);
  • one service — everywhere — a new feature is connected once on a service server and immediately works on 4G, 5G, Wi-Fi and GPON;
  • one billing system and one operations team instead of four.

Worked example: the business case for one IMS core

Let us calculate the answer to the CFO for the operator from "A real-life task". All amounts are illustrative input data of the task.

Given:

  • Subscribers: 6,000,000 mobile (4G/5G) and 900,000 fixed lines (GPON/xDSL).
  • Option A — keep everything as it is:
  • the mobile CS core (MSC-Server, MGW, HLR): OPEX $4.2M / year;
  • keeping 3G for CSFB: 15 MHz on 4,500 base stations; giving them to 4G/5G would avoid building new sites worth $6.5M / year (annualized);
  • fixed exchanges and the office platform: $3.1M / year;
  • subscriber churn caused by slow call setup (CSFB averages 5.2 s) and poor indoor coverage: $2.4M / year.
  • Option B — one cloud IMS core for all access networks:
  • IMS core OPEX: $3.4M / year;
  • a minimal 2G layer for legacy meters and terminals: $0.8M / year;
  • one-time CAPEX for deployment and subscriber migration: $8.2M;
  • call setup through IMS: 2.0 s on average.

Step-by-step solution:

yaml
# Step 1. Annual costs and losses without IMS (option A), M USD
option_a:
  mobile_cs_core: 4.2
  fixed_exchanges_and_office_platform: 3.1
  lost_benefit_of_3g_spectrum_15mhz: 6.5
  subscriber_churn: 2.4
  total_per_year: 16.2       # 4.2 + 3.1 + 6.5 + 2.4

# Step 2. Annual costs with one IMS core (option B), M USD
option_b:
  ims_core: 3.4
  residual_2g_layer: 0.8
  total_per_year: 4.2        # 3.4 + 0.8

# Step 3. Impact
impact:
  savings_per_year_m_usd: 12.0      # 16.2 - 4.2
  capex_m_usd: 8.2
  payback_months: 8.2               # 8.2 / 12.0 * 12
  call_setup_s: {csfb_before: 5.2, ims_after: 2.0}
  freed_spectrum: "15 MHz move from 3G to 4G/5G"

Line by line:

  • Step 1 adds up everything the operator pays or loses by keeping four networks: 16.2 M per year.
  • Step 2 is the same with one core: 4.2 M per year. The 2G layer remains only for legacy devices that do not support IMS.
  • Step 3: savings are 16.2 − 4.2 = 12.0 M per year. The one-time 8.2 M is returned in 8.2 / 12.0 × 12 ≈ 8.2 months.
MetricOption A: four silosOption B: one IMS core (FMC)Gain
Voice cores4 (CS, TDM, Softswitch, office PBX)1 for 4G, 5G, Wi-Fi, GPONNo duplicated nodes, databases or teams
Call setup5.2 s (fallback to 3G/2G)2.0 s (the call stays in 4G/5G)Faster, Internet keeps working during the call
3G spectrumOccupied for CSFB15 MHz given to 4G/5GMore capacity without buying spectrum
New serviceBuilt 4 timesBuilt onceLaunch in weeks, not years
Annual costs and losses$16.2M$4.2M (+ one-time CAPEX $8.2M)$12.0M per year, payback ≈ 8 months

💡 Architectural verdict: carrier voice cannot be replaced by messengers: OTT gives no guaranteed QCI 1 channel, does not meet the requirements for 112 calls and lawful interception, and does not work with E.164 numbers outside its own app. Keeping four legacy networks does not pay off either. Under the task conditions, one IMS core pays back in about 8 months, saves $12.0M per year, speeds up call setup from 5.2 s to 2.0 s and frees 15 MHz of 3G spectrum for 4G/5G.


What can go wrong and how to find it

SymptomPossible causeWhat to check
The smartphone is on 4G, but drops to 3G/2G when callingVoice over IMS is not enabled for the subscriber: their HSS profile has no APN ims access point, or the feature is turned off in the phone settingsThe subscriber profile the HSS sends to the MME over S6a (course lte, lesson 38): is APN ims there; the "voice over 4G" setting in the phone
The call connects, but at busy hour the voice breaks up while other subscribers are fineThe dedicated QCI 1 channel was not created, and voice went over the shared channelThe Rx → PCRF → Gx exchange and the Create Bearer Request with QCI 1 (course lte, lessons 72 and 133)
In roaming the Internet works, but calls on your own number do notThe APN ims access point is not routed to the home network, or the roaming agreement does not cover voice over IMSWhich P-GW serves APN ims in roaming (the Home Routed scheme, course lte, lesson 97); the terms of the agreement with the visited operator

⚠️ A typical mistake: "for simplicity" sending IMS voice through the Internet access point in the QCI 9 channel and not setting up the link with the PCRF. In the test lab everything works, but at the first evening busy hour the voice falls apart together with the Internet.


Practice

  1. Predict. Below are the smartphone's channels during a call while the subscriber is browsing a website. What happens to each channel when the subscriber hangs up but leaves the browser open?
yaml
# EPS Bearer channels of one smartphone during a call
channels:
  - ebi: 5
    apn: internet
    type: default
    qci: 9
    gbr_kbps: 0
  - ebi: 6
    apn: ims
    type: default
    qci: 5
    gbr_kbps: 0
  - ebi: 7
    apn: ims
    type: dedicated
    qci: 1
    gbr_kbps: 44     # example guaranteed bit rate for voice
  1. Check. Are the statements true (compare with the QCI table in section 2): a) the QCI 5 channel provides a guaranteed bit rate; b) QCI 1 and QCI 5 have the same delay budget of 100 ms; c) QCI 9 packets are served before QCI 1 packets.
  2. Explain. Why can't the P-GW gateway allocate a QCI 1 channel for a messenger call on its own, even if the operator wants it to?
  3. Modify. The operator has bought an ISP with 150,000 GPON subscribers whose optical terminal has a phone port with a SIP client. The finance department proposes buying a separate Softswitch with a separate announcement system for them. What would you propose instead, based on the three principles of IMS?
  4. Do it yourself ⭐. The operator keeps 10 MHz under 3G only for CSFB. The spectral efficiency of 3G in this band is 0.45 bit/s/Hz, and after moving it to 4G/5G — 2.70 bit/s/Hz. Calculate the band's capacity before and after, and how many times it grows when voice moves to IMS and 3G is switched off.

Self-check

  1. Why does the base station guarantee quality for an IMS call but cannot guarantee it for a messenger call?
    Explanation: a messenger call travels inside the shared QCI 9 Internet channel and is encrypted by the app. The network does not know when it started or what bit rate it needs: for the network these are the same packets as a file download. In an IMS call, SIP signalling with the SDP description passes through the operator's core. The core reports the stream parameters to the PCRF over Rx, the PCRF commands the P-GW over Gx, and the network creates a dedicated QCI 1 channel with a guaranteed bit rate and a 100 ms delay budget.
  2. What does separating service logic from session control give the operator?
    Explanation: session control only registers subscribers, routes SIP and requests quality. Service logic lives on separate servers. Therefore a new service is connected once in the service layer and is immediately available to all subscribers — on 4G, 5G, Wi-Fi and GPON. There is no need to rebuild the core or the access networks.

Practice answers

  • Exercise 1: channel ebi 5 (internet, QCI 9) stays — the browser keeps working. Channel ebi 6 (ims, QCI 5) stays — it is permanent; the phone keeps in touch with the IMS core through it and will receive the next call. Channel ebi 7 (QCI 1) is removed right after SIP BYE — it is needed only for the duration of the conversation.
  • Exercise 2: a) false — QCI 5 is of the non-GBR type; b) true — both have 100 ms; c) false — QCI 9 has priority 9 (the lowest), QCI 1 has 2, so QCI 1 is served first.
  • Exercise 3: the messenger does not tell the operator's core that a call has started, and its traffic is encrypted. Nobody sends the PCRF an Rx request with the stream parameters, so the PCRF does not know when, for which packets and at what bit rate to create the channel. A dedicated channel is created at the request of the IMS core that takes part in the call.
  • Exercise 4: a separate Softswitch is not needed. By the access-independence principle, the GPON terminals register in the same IMS core using SIP. The subscriber profiles go into the same HSS, and the announcements, call forwarding and billing come from the service layer that is already running. This is FMC: one number and the same services for fixed and mobile communication.
  • Exercise 5: before — $10\text{ MHz} \times 0.45 = 4.5\text{ Mbit/s}$; after — $10\text{ MHz} \times 2.70 = 27.0\text{ Mbit/s}$. Growth: $27.0 / 4.5 = 6$ times — without buying new spectrum.

Review and the criterion for moving on

  • The EPC / 5GC core is purely packet-based; it has no CS domain. The interim CSFB slows down call setup (roughly 4–7 s versus 1.5–2.5 s through IMS), degrades the Internet and keeps spectrum under 3G.
  • An OTT messenger works in the shared QCI 9 channel and gives the operator neither a QCI 1 quality guarantee, nor 112 calls, billing, lawful interception, roaming or E.164 numbers.
  • IMS per 3GPP TS 23.228 rests on three principles: access-network independence (LTE, 5G NR, Wi-Fi, GPON/xDSL), end-to-end quality control through the link with PCC (Rx → PCRF → Gx → QCI 1 channel) and separation of service logic from session control. Together they give FMC.

Criterion for moving on: you can explain in your own words why voice needs a separate QCI 1 channel and how it appears; list six differences between a carrier call and OTT; name the three principles of IMS and give an example of FMC.

Next is lesson 2, "IMS History and Releases: 3GPP Rel-5, 6, 7 (TISPAN, Common IMS) and 3GPP2 MMD": how IMS appeared in 3GPP and how the mobile and fixed branches of the standards merged into one core.

Standards and sources

  • 3GPP TS 23.228 — IP Multimedia Subsystem (IMS); Stage 2: IMS architecture and principles.
  • 3GPP TS 23.203 — Policy and Charging Control architecture: the PCC architecture and the table of standardized QCI characteristics.
  • 3GPP TS 29.214 — Policy and Charging Control over Rx reference point: the Rx interface between the IMS core and the PCRF.
  • 3GPP TS 23.401 — GPRS enhancements for E-UTRAN access: the EPC core and EPS Bearer channels.
  • 3GPP TS 23.272 — Circuit Switched (CS) fallback in Evolved Packet System: the CSFB procedure.