Page 386 - From GMS to LTE

372 From GSM to LTE-Advanced Pro and 5G

also stored there. The result is returned to the mobile device, which then sends a
response to the network’s authentication challenge to verify the network’s authenticity
and to generate the ciphering keys for the IPSec connection that the ePDG establishes
once it has confirmed the mobile device’s authenticity.
Once the IPSec tunnel is in place, the mobile device performs a standard IMS VoLTE
registration procedure as shown earlier in this chapter. In Figure 5.17 the IPSec‐
encrypted IMS register packet that was sent from the mobile device to the IMS core via
the ePDG can be seen at the bottom (packet 1093 with 1374 bytes). On the ePDG the
traffic flow is decrypted and the IP packet is then forwarded to network operator’s core
network. It should be noted at this point that as part of the IMS registration procedure another
IPSec tunnel is established between the mobile device’s IMS client and the P‐CSCF
in the network, as discussed in Section 5.3.2. This means that this IMS IPSec tunnel is
transported inside the IPSec tunnel between the UE and the ePDG.

5.5.2 VoWifi Handover

An important function of the extension of a network operator’s voice service to Wi‐Fi is
that an ongoing VoLTE voice call can be handed over to Wi‐Fi and an ongoing VoWifi
call can be handed over to LTE. This is possible as the ePDG acts like an MME/Serving‐
Gateway in the EPC (LTE core network) and hence a switch from Wi‐Fi to LTE can be
treated similarly to an Inter‐MME / Inter‐Serving‐Gateway LTE handover.
From the outside, a handover from LTE to Wi‐Fi means that the IP address of the LTE
IMS default bearer is transferred into the IPSec tunnel during ePDG session establish-
ment. The signaling exchange between the mobile device and the ePDG is mostly the
same as discussed above and shown in Figure 5.17. The only difference is that instead of
requesting a new IP address for use inside the IPSec tunnel, the mobile device includes
the information that a handover of the existing IMS bearer is requested. The ePDG then
forwards the request to the PDN‐GW. The PDN‐GW contacts the previously used
MME and Serving‐Gateway (S‐GW), informs them of the change and re‐routes the
GTP core network tunnel away from the previous S‐GW to the ePDG. Despite the
number of actions required, the procedure must only take a few hundred milliseconds
at most to make the speech path interruption as short and inaudible as possible.
A handover of an ongoing VoWifi call to LTE is performed when the user leaves the
coverage area of a Wi‐Fi network. If an LTE network is available at the time, the mobile
device is already attached to it, as it has a default bearer in place for Internet connectiv-
ity. This is required as LTE needs at least one default bearer to be established at all
times. The bearer is not used at that point, however, as the Wi‐Fi network is used for
Internet connectivity. To hand over the ongoing VoWifi call to LTE, the mobile device
sends a PDN Connectivity Request message. Instead of declaring it an ‘initial request’, it
sets the request‐type parameter to ‘handover’. The MME then initiates the transfer of
the IMS bearer that is still terminated at the ePDG to itself. In the process the PDN‐GW
will change its routing table and replaces the ePDG as source and destination of packets
for this connection with the MME/S‐GW.
In practice, transferring the IMS bearer between LTE and an IPSec tunnel over Wi‐Fi to
the ePDG is not only done during an ongoing voice call but even when the bearer is idle.
This is because from a logical point of view it is not a voice call that is transferred but the
IMS bearer, i.e. the IP connectivity itself. From an IMS and VoLTE point of view, moving