When mobile networks moved to 4G LTE and then to 5G NR, their core became purely packet-based: the EPC core (in 5G — 5GC) can only deliver IP packets. The familiar "telephone half" — the circuit-switched domain CS — is no longer there. Yet people still need an ordinary call to a phone number: it must connect in a couple of seconds, sound clean at busy hour, work in roaming, reach 112 and be charged correctly. In this lesson we look at why Internet messengers do not solve this task, and how the 3GPP TS 23.228 standard solved it with IMS — one core for any access network and any service.
Goal and prerequisites
After this lesson you will be able to:
- explain why an
EPC/5GCcore without aCSdomain does not provide telephony by itself, and why the interimCSFBsolution holds the operator back; - compare a messenger call (
OTT) with a carrier call on six points:QCI 1quality guarantee, emergency calls, billing, lawful interception, roaming and a singleE.164number; - name the three main principles of IMS per 3GPP TS 23.228: access-network independence, end-to-end quality control through the link with
PCC, and separation of service logic from session control; - explain what Fixed-Mobile Convergence (
FMC) is and calculate how much an operator saves by replacing several legacy networks with one core.
What you need to know beforehand:
- course
sip, lessons 1–10: whatSIPis, theINVITErequest, theSDPsession description andRTPvoice packets; - course
ngn, lessons 1–5: the move fromTDMtoSoftswitchand media gateways; - course
lte: lessons 3–5 (theEPCcore without aCSdomain, theMME,S-GW,P-GW,HSS,PCRFnodes, theGxandSGsinterfaces andCSFBvoice fallback), lesson 24 (ROHCheader compression), lesson 42 (theAPNaccess point), lesson 72 (theDedicated EPS Bearerrequested viaRx/Gx) and lesson 97 (Home Routedroaming).
A real-life task
A national operator serves 6 million mobile subscribers (4G LTE and a 5G NR network under construction) and 900,000 homes on its fixed network (GPON and copper xDSL). The network has grown for decades, so the operator runs four separate networks — "silos" side by side:
- 2G/3G mobile voice (the
CSdomain:MSC-Server,MGW,HLR). A smartphone on 4G drops to 3G/2G on every call via theCSFBprocedure. Because of this, the operator cannot switch off 3G and give15 MHzof spectrum to 4G/5G. - Fixed telephony (legacy
TDMexchanges and aSoftswitch) — with its own subscriber database and its own billing. - The 4G/5G packet core (
EPC/5GC) — delivers fast Internet but does not understand calls. - The business platform (office PBXs and
SIPtrunks) — not linked to employees' mobile numbers at all.
At the board meeting, the CFO asks: "Subscribers already call each other on WhatsApp and Telegram over mobile Internet. Why do we need a new core? Let's keep one Internet channel and switch off all the telephone exchanges!"
As the core network architect, you must answer with numbers and facts: why the operator cannot hand voice over to messengers, how one IMS core replaces four silos, and how much it will save.
1. A 4G/5G core without a CS domain: what is the problem
In 2G and 3G networks the core had two halves: the circuit-switched domain (CS) for voice and the packet-switched domain (PS) for the Internet. When designing 4G, the 3GPP consortium kept only the packet half. The EPC core (and later 5GC) is an IP packet transport: the S-GW and P-GW nodes deliver packets and apply quality rules to them, but they do not know what a phone number, a ringing tone, "busy", call forwarding or a conference is.
Analogy: the 4G core is a modern motorway. It carries any cargo perfectly, but it has neither a taxi dispatch office nor a letter delivery service. The road is built — the service that takes the order "connect me to +994…" has to be created separately.
Until such a service existed, operators used an interim solution, CSFB (course lte, lesson 5): when a call arrives, the MME tells the legacy switch about it over the SGs interface, and the smartphone leaves 4G for 3G or 2G for the duration of the call. It works, but at a price:
- Slow call setup. Measurements in live networks show that call setup via
CSFBtakes roughly 4–7 seconds, while a call that stays entirely in 4G through IMS takes roughly 1.5–2.5 seconds. - Internet suffers during the call. In 3G the speed drops several times, and in 2G data transfer often stops completely during the conversation.
- Frozen spectrum. As long as voice depends on
CSFB, the operator must keep 2G/3G switched on and occupy frequencies that would carry several times more data in 4G/5G. - A dead end for 5G and Wi-Fi. Where 2G/3G has already been switched off, there is nowhere to fall back to. And a legacy switch cannot accept calls over home Wi-Fi.
- Four silos. Every new service (for example, a spam-call filter) is built four times — on four incompatible platforms, with four engineering teams.
2. Carrier call versus OTT messenger
OTT (Over-The-Top) is a service that runs over the operator's Internet channel without any agreement with its core: WhatsApp, Telegram, FaceTime. For the operator, such a call is just encrypted packets in the shared Internet channel.
Analogy: an
OTTcall is a parcel sent by ordinary post together with thousands of others. A carrier call is the same parcel, but with a courier, a separate lane on the road, insurance and a receipt.
The difference runs along six boundaries — exactly the ones listed in the lesson outline:
| Feature | OTT messenger | Carrier call through IMS |
|---|---|---|
| Quality guarantee | Shared Internet channel QCI 9: voice waits in the queue with video and updates | A separate voice channel QCI 1 with a guaranteed bit rate (GBR) for the duration of the call |
| Emergency calls | Reaching 112 is not guaranteed, cell-based location is not passed to the service | A 112 call is handled by the network with priority and location data |
| Billing | The operator sees only megabytes | Every call is charged: who, to whom, how many minutes |
| Lawful interception | The operator cannot meet the legal requirement: traffic is encrypted by the app | Interception by court order is performed in the operator's core according to the standard |
| Roaming | Works only if there is Internet, with no inter-operator guarantees | Calls on your own number abroad under operators' roaming agreements |
Single E.164 number | Calls only inside one app | Any number in the world: mobile, landline, office (tel URI, course sip, lesson 9) |
The main technical reason is in the first row. The eNodeB base station and the P-GW gateway do not know that a conversation is travelling inside the Internet channel. When hundreds of people in a cell watch video in the evening, the QCI 9 queue overflows — and the messenger voice starts to break up.
In IMS it is different. When a subscriber dials a number in the phone's ordinary dialler:
- The
SIP INVITErequest with anSDPdescription goes over a separate access pointAPN imsin theQCI 5channel — it has the highest priority and is meant for signalling. - The IMS core reads from the
SDPwhich voice stream is needed and reports it to the policy nodePCRFover theRxinterface (courselte, lesson 72). - The
PCRFcommands theP-GWgateway over theGxinterface, and the gateway, via theS-GW,MMEandeNodeB, creates a dedicatedQCI 1channel for this conversation only. The base station enablesROHCheader compression for it (courselte, lesson 24). - After hang-up (
SIP BYE) theQCI 1channel is removed and the cell's resources are freed.
The parameters of the QCI classes are defined in 3GPP TS 23.203 (the table of standardized characteristics). Below is a comparison in a congested cell: the class parameters come from the standard, while the delay and quality values are an illustrative example.
# Congested 4G cell at busy hour (illustrative example)
cell:
active_subscribers: 120
radio_resource_load: "94%"
qci_classes_ts_23_203:
QCI_9: {type: "non-GBR", priority: 9, delay_budget_ms: 300} # Internet
QCI_5: {type: "non-GBR", priority: 1, delay_budget_ms: 100} # IMS signalling
QCI_1: {type: "GBR", priority: 2, delay_budget_ms: 100} # conversation
ott_call:
channel: "APN internet, QCI 9"
what_the_network_sees: "encrypted UDP packets, like a file download"
busy_hour_result: {jitter_ms: 185, loss_percent: 4.8, rating: "poor"}
ims_call:
signalling: "APN ims, QCI 5"
voice: "dedicated QCI 1 channel (created via Rx -> PCRF -> Gx -> P-GW)"
busy_hour_result: {jitter_ms: 14, loss_percent: 0.08, rating: "clean"}The smaller the priority number, the sooner the base station scheduler serves the packets. That is why
QCI 5(priority 1) andQCI 1(priority 2) go ahead ofQCI 9Internet traffic (priority 9).
3. The three principles of IMS per 3GPP TS 23.228
IMS (IP Multimedia Subsystem) is a core that uses the SIP protocol to set up voice, video and text sessions over any IP network. Its architecture is described in specification 3GPP TS 23.228 and rests on three principles.
Principle 1. Access-network independence
The IMS core does not care how the subscriber is connected — as long as there is IP:
- 4G LTE — through the
EPCcore (voice over LTE is often calledVoLTE); - 5G NR — through the
5GCcore; - Wi-Fi — at home, in the office or in a hotel abroad: the smartphone builds a protected tunnel over the Internet to an operator gateway, and the gateway connects it to the same core;
- GPON / xDSL — a home optical terminal or an office IP phone registers in the same core using
SIP.
Analogy: IMS is like a bank card. You can pay in a shop, online or by phone — the account and the rules stay the same. The way of access changes, the "bank" stays one.
Principle 2. End-to-end quality control through the link with PCC
An ordinary SIP proxy (course sip, lesson 4) forwards signalling "blindly" and does not know whether the network has enough capacity. IMS is linked to the transport through the PCC architecture (Policy and Charging Control, course lte). For each media stream the IMS core requests resources from the PCRF, and the conversation gets its own guaranteed channel — audio QCI 1, video QCI 2. At the same time PCC provides data for charging.
Principle 3. Service logic is separated from session control
Instead of vertical silos, IMS divides the network into three horizontal layers:
- The access and transport layer — 4G/5G base stations, Wi-Fi, GPON,
S-GW/P-GWgateways. - The session control layer — IMS core nodes that register the subscriber, check them, route
SIPand request quality. The subscriber profile is stored in theHSSdatabase (familiar from courselte). - The service layer — separate servers where the logic "lives": call forwarding, call hold, conferences, voicemail, messaging, an office PBX.
Session control holds no logic of specific services — it simply hands the call to the right service server.
Analogy: a taxi dispatcher (session control) takes the order and passes it to the right service: economy, cargo van, child seat (services). To add "flower delivery", there is no need to rebuild the dispatch office — just connect the new service.
What the session control nodes and service servers are called, and how they talk to each other, we will cover in the next lessons of this section.
Fixed-Mobile Convergence (FMC)
Together the three principles give FMC (Fixed-Mobile Convergence):
- one profile in the
HSS— a home phone on GPON, a softphone on a laptop and a smartphone on 4G/5G can belong to one subscriber; on an incoming call all devices ring at once (this is call forking, coursesip, lesson 80); - one service — everywhere — a new feature is connected once on a service server and immediately works on 4G, 5G, Wi-Fi and GPON;
- one billing system and one operations team instead of four.
Worked example: the business case for one IMS core
Let us calculate the answer to the CFO for the operator from "A real-life task". All amounts are illustrative input data of the task.
Given:
- Subscribers:
6,000,000mobile (4G/5G) and900,000fixed lines (GPON/xDSL). - Option A — keep everything as it is:
- the mobile
CScore (MSC-Server,MGW,HLR):OPEX$4.2M / year; - keeping 3G for
CSFB:15 MHzon4,500base stations; giving them to 4G/5G would avoid building new sites worth$6.5M / year(annualized); - fixed exchanges and the office platform:
$3.1M / year; - subscriber churn caused by slow call setup (
CSFBaverages5.2 s) and poor indoor coverage:$2.4M / year. - Option B — one cloud IMS core for all access networks:
- IMS core
OPEX:$3.4M / year; - a minimal 2G layer for legacy meters and terminals:
$0.8M / year; - one-time
CAPEXfor deployment and subscriber migration:$8.2M; - call setup through IMS:
2.0 son average.
Step-by-step solution:
# Step 1. Annual costs and losses without IMS (option A), M USD
option_a:
mobile_cs_core: 4.2
fixed_exchanges_and_office_platform: 3.1
lost_benefit_of_3g_spectrum_15mhz: 6.5
subscriber_churn: 2.4
total_per_year: 16.2 # 4.2 + 3.1 + 6.5 + 2.4
# Step 2. Annual costs with one IMS core (option B), M USD
option_b:
ims_core: 3.4
residual_2g_layer: 0.8
total_per_year: 4.2 # 3.4 + 0.8
# Step 3. Impact
impact:
savings_per_year_m_usd: 12.0 # 16.2 - 4.2
capex_m_usd: 8.2
payback_months: 8.2 # 8.2 / 12.0 * 12
call_setup_s: {csfb_before: 5.2, ims_after: 2.0}
freed_spectrum: "15 MHz move from 3G to 4G/5G"Line by line:
- Step 1 adds up everything the operator pays or loses by keeping four networks:
16.2M per year. - Step 2 is the same with one core:
4.2M per year. The 2G layer remains only for legacy devices that do not support IMS. - Step 3: savings are
16.2 − 4.2 = 12.0M per year. The one-time8.2M is returned in8.2 / 12.0 × 12 ≈ 8.2months.
| Metric | Option A: four silos | Option B: one IMS core (FMC) | Gain |
|---|---|---|---|
| Voice cores | 4 (CS, TDM, Softswitch, office PBX) | 1 for 4G, 5G, Wi-Fi, GPON | No duplicated nodes, databases or teams |
| Call setup | 5.2 s (fallback to 3G/2G) | 2.0 s (the call stays in 4G/5G) | Faster, Internet keeps working during the call |
| 3G spectrum | Occupied for CSFB | 15 MHz given to 4G/5G | More capacity without buying spectrum |
| New service | Built 4 times | Built once | Launch in weeks, not years |
| Annual costs and losses | $16.2M | $4.2M (+ one-time CAPEX $8.2M) | $12.0M per year, payback ≈ 8 months |
💡 Architectural verdict: carrier voice cannot be replaced by messengers:
OTTgives no guaranteedQCI 1channel, does not meet the requirements for112calls and lawful interception, and does not work withE.164numbers outside its own app. Keeping four legacy networks does not pay off either. Under the task conditions, one IMS core pays back in about 8 months, saves$12.0Mper year, speeds up call setup from5.2 sto2.0 sand frees15 MHzof 3G spectrum for 4G/5G.
What can go wrong and how to find it
| Symptom | Possible cause | What to check |
|---|---|---|
| The smartphone is on 4G, but drops to 3G/2G when calling | Voice over IMS is not enabled for the subscriber: their HSS profile has no APN ims access point, or the feature is turned off in the phone settings | The subscriber profile the HSS sends to the MME over S6a (course lte, lesson 38): is APN ims there; the "voice over 4G" setting in the phone |
| The call connects, but at busy hour the voice breaks up while other subscribers are fine | The dedicated QCI 1 channel was not created, and voice went over the shared channel | The Rx → PCRF → Gx exchange and the Create Bearer Request with QCI 1 (course lte, lessons 72 and 133) |
| In roaming the Internet works, but calls on your own number do not | The APN ims access point is not routed to the home network, or the roaming agreement does not cover voice over IMS | Which P-GW serves APN ims in roaming (the Home Routed scheme, course lte, lesson 97); the terms of the agreement with the visited operator |
⚠️ A typical mistake: "for simplicity" sending IMS voice through the Internet access point in the
QCI 9channel and not setting up the link with thePCRF. In the test lab everything works, but at the first evening busy hour the voice falls apart together with the Internet.
Practice
- Predict. Below are the smartphone's channels during a call while the subscriber is browsing a website. What happens to each channel when the subscriber hangs up but leaves the browser open?
# EPS Bearer channels of one smartphone during a call
channels:
- ebi: 5
apn: internet
type: default
qci: 9
gbr_kbps: 0
- ebi: 6
apn: ims
type: default
qci: 5
gbr_kbps: 0
- ebi: 7
apn: ims
type: dedicated
qci: 1
gbr_kbps: 44 # example guaranteed bit rate for voice- Check. Are the statements true (compare with the
QCItable in section 2): a) theQCI 5channel provides a guaranteed bit rate; b)QCI 1andQCI 5have the same delay budget of100 ms; c)QCI 9packets are served beforeQCI 1packets. - Explain. Why can't the
P-GWgateway allocate aQCI 1channel for a messenger call on its own, even if the operator wants it to? - Modify. The operator has bought an ISP with
150,000GPON subscribers whose optical terminal has a phone port with aSIPclient. The finance department proposes buying a separateSoftswitchwith a separate announcement system for them. What would you propose instead, based on the three principles of IMS? - Do it yourself ⭐. The operator keeps
10 MHzunder 3G only forCSFB. The spectral efficiency of 3G in this band is0.45bit/s/Hz, and after moving it to 4G/5G —2.70bit/s/Hz. Calculate the band's capacity before and after, and how many times it grows when voice moves to IMS and 3G is switched off.
Self-check
- Why does the base station guarantee quality for an IMS call but cannot guarantee it for a messenger call?
Explanation: a messenger call travels inside the sharedQCI 9Internet channel and is encrypted by the app. The network does not know when it started or what bit rate it needs: for the network these are the same packets as a file download. In an IMS call,SIPsignalling with theSDPdescription passes through the operator's core. The core reports the stream parameters to thePCRFoverRx, thePCRFcommands theP-GWoverGx, and the network creates a dedicatedQCI 1channel with a guaranteed bit rate and a100 msdelay budget. - What does separating service logic from session control give the operator?
Explanation: session control only registers subscribers, routesSIPand requests quality. Service logic lives on separate servers. Therefore a new service is connected once in the service layer and is immediately available to all subscribers — on 4G, 5G, Wi-Fi and GPON. There is no need to rebuild the core or the access networks.
Practice answers
- Exercise 1: channel
ebi 5(internet,QCI 9) stays — the browser keeps working. Channelebi 6(ims,QCI 5) stays — it is permanent; the phone keeps in touch with the IMS core through it and will receive the next call. Channelebi 7(QCI 1) is removed right afterSIP BYE— it is needed only for the duration of the conversation. - Exercise 2: a) false —
QCI 5is of thenon-GBRtype; b) true — both have100 ms; c) false —QCI 9has priority 9 (the lowest),QCI 1has 2, soQCI 1is served first. - Exercise 3: the messenger does not tell the operator's core that a call has started, and its traffic is encrypted. Nobody sends the
PCRFanRxrequest with the stream parameters, so thePCRFdoes not know when, for which packets and at what bit rate to create the channel. A dedicated channel is created at the request of the IMS core that takes part in the call. - Exercise 4: a separate
Softswitchis not needed. By the access-independence principle, the GPON terminals register in the same IMS core usingSIP. The subscriber profiles go into the sameHSS, and the announcements, call forwarding and billing come from the service layer that is already running. This isFMC: one number and the same services for fixed and mobile communication. - Exercise 5: before — $10\text{ MHz} \times 0.45 = 4.5\text{ Mbit/s}$; after — $10\text{ MHz} \times 2.70 = 27.0\text{ Mbit/s}$. Growth: $27.0 / 4.5 = 6$ times — without buying new spectrum.
Review and the criterion for moving on
- The
EPC/5GCcore is purely packet-based; it has noCSdomain. The interimCSFBslows down call setup (roughly 4–7 s versus 1.5–2.5 s through IMS), degrades the Internet and keeps spectrum under 3G. - An
OTTmessenger works in the sharedQCI 9channel and gives the operator neither aQCI 1quality guarantee, nor112calls, billing, lawful interception, roaming orE.164numbers. - IMS per 3GPP TS 23.228 rests on three principles: access-network independence (LTE, 5G NR, Wi-Fi, GPON/xDSL), end-to-end quality control through the link with
PCC(Rx→PCRF→Gx→QCI 1channel) and separation of service logic from session control. Together they giveFMC.
Criterion for moving on: you can explain in your own words why voice needs a separate QCI 1 channel and how it appears; list six differences between a carrier call and OTT; name the three principles of IMS and give an example of FMC.
Next is lesson 2, "IMS History and Releases: 3GPP Rel-5, 6, 7 (TISPAN, Common IMS) and 3GPP2 MMD": how IMS appeared in 3GPP and how the mobile and fixed branches of the standards merged into one core.
Standards and sources
- 3GPP TS 23.228 — IP Multimedia Subsystem (IMS); Stage 2: IMS architecture and principles.
- 3GPP TS 23.203 — Policy and Charging Control architecture: the
PCCarchitecture and the table of standardizedQCIcharacteristics. - 3GPP TS 29.214 — Policy and Charging Control over Rx reference point: the
Rxinterface between the IMS core and thePCRF. - 3GPP TS 23.401 — GPRS enhancements for E-UTRAN access: the
EPCcore andEPS Bearerchannels. - 3GPP TS 23.272 — Circuit Switched (CS) fallback in Evolved Packet System: the
CSFBprocedure.