VoLTE and IMS Registration Flow

Introduction¶

Before VoLTE, an LTE phone dropped to 2G/3G for a call (CSFB). VoLTE carries voice as SIP + RTP over the LTE packet core, anchored in the IMS (IP Multimedia Subsystem). It needs the radio, the EPC, and the IMS core all working together, which is why it has many failure points.

The IMS core¶

• P-CSCF (Proxy) — the first SIP contact point for the handset. Sits in the visited or home network; handles IPsec/SIP security, and talks Rx to the PCRF/PCF to set up the voice bearer.
• I-CSCF (Interrogating) — the entry point into the home network; queries the HSS (Cx) to find which S-CSCF serves the user.
• S-CSCF (Serving) — the registrar and the brain: authenticates the user, applies service logic (iFC — initial Filter Criteria → application servers like the TAS for supplementary services), routes calls.
• HSS — subscriber data + authentication (shared with the EPC).
• TAS (Telephony Application Server) — call features: forwarding, barring, hold, conference, CLIP/CLIR.
• MGCF / IMS-MGW — breakout to the PSTN/legacy.
• SBC (often = the P-CSCF plus an access/interconnect SBC) — NAT, security, transcoding, topology hiding.

Getting connected¶

1. LTE attach — normal EPS attach; the handset also requests the IMS APN (a separate PDN connection, APN name often ims), getting an IP for SIP signalling and the P-CSCF address (via PCO — Protocol Configuration Options — in the attach, or DHCPv6).
2. IMS registration:

   UE --REGISTER--> P-CSCF --> I-CSCF --(Cx: query HSS)--> S-CSCF
   S-CSCF --401 (AKA challenge, IMS AKA)--> ... --> UE
   UE --REGISTER (with AKA response, sets up IPsec SAs with P-CSCF)--> ... --> S-CSCF
   S-CSCF --200 OK--> UE     (registered; third-party register to the TAS)
   

   SIP between UE and P-CSCF runs over IPsec (SIP security, RFC 3329) on the IMS APN. Re-registration on a timer (often ~600s or per reg-event).
3. The UE subscribes to the reg event package to learn about de-registration.

Making a call¶

1. UE sends INVITE with SDP (usually AMR-WB/AMR codecs, RTP/AVP).
2. P-CSCF, on seeing the INVITE/SDP, uses Rx → PCRF/PCF to request a dedicated bearer with QCI 1 (GBR, low latency, prioritised) for the RTP. The PGW/SMF creates it toward the eNodeB/gNodeB.
3. Precondition handling (183 Session Progress + PRACK + UPDATE) ensures the bearer is up before the phone rings.
4. 180 Ringing → 200 OK → ACK; RTP flows on the QCI-1 bearer.
5. Supplementary services (forwarding, etc.) applied at the S-CSCF via iFC to the TAS.

SRVCC (Single Radio Voice Call Continuity) hands an in-progress VoLTE call to 2G/3G circuit-switched if the user leaves LTE coverage mid-call.

Verification and troubleshooting¶

# UE-side (engineering/field-test menu) or P-CSCF/SBC logs
- IMS registration state, P-CSCF address, IPsec SA status
- SIP traces at the SBC/P-CSCF (sngrep-style)
- QCI-1 bearer establishment on the PGW/SMF and eNodeB

• VoLTE not available (falls back to CSFB / no VoLTE icon) — no IMS APN provisioned for the subscriber in the HSS, the device's carrier profile (MBN/carrier bundle) doesn't enable VoLTE for this PLMN, or the network's IMS isn't enabled in that area.
• IMS REGISTER fails 403/401 loop — IMS AKA credentials / ISIM issue, HSS Cx failure, S-CSCF not assigned, or IPsec SA negotiation failing (P-CSCF address wrong, or a middlebox mangling the SIP security headers).
• Registered but calls fail immediately — the QCI-1 dedicated bearer isn't being created: Rx failure between P-CSCF and PCRF/PCF, PCRF has no rule for the voice media, or the PGW/SMF/eNodeB rejected the GBR bearer (admission control, no GBR capacity).
• Call connects, no audio / one-way — RTP on the default bearer instead of QCI-1 (bearer binding failed) so it's deprioritised/dropped, NAT at the SBC, or codec mismatch (AMR variants, or the far leg is PSTN and the MGW didn't transcode).
• Call drops when leaving LTE coverage — SRVCC not configured/failing (MSC server enhanced for SRVCC, Sv interface), so the call can't hand to 2G/3G.
• One-way or dead air after ~30s — lost SIP ACK (see the SIP INVITE post) or a session-timer/re-INVITE issue across the SBC.
• Roaming VoLTE fails — needs S8HR (home-routed) or LBO with IMS roaming agreements, DEA/IPX support, and the visited network's P-CSCF or a home P-CSCF reachable; many roaming pairs still don't support it.

Related tools and reading¶

• On-site: Port Checker, Ping test.
• Related posts: Core telco architecture: 2G to 5G in one read, SIP registration and INVITE flow.