Digi Mobil Romania - VoLTE / VoWiFi / 5G info & more: 5G SA

TMobile USA :

https://www.t-mobile.com/news/network/standalone-5g-launch

T-Mobile partnered closely with Cisco and Nokia to build its 5G core, and Ericsson and Nokia for state-of-the-art 5G radio infrastructure. OnePlus, Qualcomm Technologies and Samsung have helped the Un-carrier ensure existing devices can access SA 5G with a software update, based on compatibility.

Cisco : SMF, UPF, PCF https://blogs.cisco.com/sp/t-mobiles-5g-hype-is-real-and-cisco-is-at-the-heart-of-it

Nokia : AMF

https://www.t-mobile.com/support/coverage/t-mobile-network

MCC:310, MNC: 260

5G SA: n71 - 600 MHz FDD : 5MHz ; 10 MHz(?)

5G NSA:

Band n71 (600 MHz)
Band n41 (2.5 GHz)
Band n260 (39 GHz)
Band n261 (28 GHz)

4G LTE:

Band 2 (1900 MHz)
Band 5 ;(850 MHz)
Band 4 (1700/2100 MHz)
Band 66 (Extension of band 4 on 1700/2100 MHz).

Band 12 (700 MHz)
Band 71 (600 MHz)

3G UMTS

Band 4 (1700/2100 MHz)
Band 2 (1900 MHz)

2G GSM

Band 2 (1900MHz)

https://twitter.com/lightspeed2398/status/1290994378777993216

5G DNNs (Data Network Name), the same like 2/3/4G APNs (Access Point Name)

fast.t-mobile.com : 5GQI 9 (or 6); AMBR: 4294/4294Mbps; IPv6; 2 DNSs; PDU Session ID 1
ims : 5GQI 5; AMBR: 100/100Mbps; IPv6; 2 P-CSCFs ;2 DNSs; PDU Session ID 2

VoLTE: IPv6, no SIP preconditions, EVS codec

P-Access-Network-Info: 3GPP-NR-FDD; utran-cell-id-3gpp= 310 260 a212 0010148e001 (MCC+MNC+TAC+NCI)

5G NR QOS Paraneters: http://www.techplayon.com/5g-nr-qos-parameters/

MFBR

4G APN -> 5G DNN
4G Default Bearer -> 5G PDU Session
4G Dedicated Bearer -> 5G Packet Filter Set / QOS Flow?

https://www.grandmetric.com/2018/06/19/5g-interworking-architecture/

http://www.eventhelix.com/5G/standalone-access-registration/5g-standalone-access-registration.pdf

Power ON Events: (test.08050702 NR SA deregister register sip register.log)

Power ON Messages:

Voice calls done with EPS Fallback from 5G SA to (4G) 5G NSA using redirect. As there is no Voice over NR support yet, VoLTE is used.

EPS fallback: http://5gblogs.com/eps-fallback-voice-in-5g/ :

"A smartphone (UE), connected to NR that tries to establish a voice connection, may perform an EPS fallback at call setup, triggered by the attempt to establish the Quality-of-Service (QoS) flow for voice media in NR.

At the attempt to establish the QoS flow for the voice media over NR during call set-up, the NG-RAN rejects the QoS flow setup towards the SMF with an indication that mobility is in progress. The NG-RAN initiates transfer of all PDU sessions from 5GS to EPS, using one of the two standardized procedures:

Release with redirect
Inter-system handover"

All in all the EPS fallback is expected to cause an additional call setup delay of approximately 2 seconds.

MO and MT, with redirect NR -> LTE triggered by the NG-RAN

3GPP TS 23.502 V16.4.0 (2020-03)

3. "NG-RAN is configured to support EPS fallback for IMS voice and decides to trigger fallback to EPS, taking into account UE capabilities, indication from AMF that "Redirection for EPS fallback for voice is possible" (received as part of initial context setup as defined in TS 38.413 [10]), network configuration (e.g. N26 availability configuration) and radio conditions. If NG-RAN decides not to trigger fallback to EPS, then the procedure stops here and following steps are not executed."

Redirect from NR n71 to LTE B71:

ARFCN:

126490 = NR n71 600 MHz https://5g-tools.com/5g-nr-arfcn-calculator/

68836 = LTE B71 600 MHz https://www.cellmapper.net/arfcn?net=LTE&ARFCN=68836&MCC=0

MT CALL: (test.08051030 5g nr mt sa to nsa.log)

MO call (test.08051024 5g nr mo fallback to 4g.log , ded bearer messages missing)

Mobile Originating voice call setup (*REFERENCE*.log)

Voice over NR :

Screenshot OnePlus 8 Pro:

Some tweaks applied in order to support VoNR.

UE Capability :

1. VoNR support in EUTRA UE capability information (NR-SA/NR-NSA/EUTRA mode)

4.3.34.13 ims-VoiceOverNR-FR1-r15
This field indicates whether the UE supports IMS voice over NR FR1.

4.3.34.14 ims-VoiceOverNR-FR2-r15
This field indicates whether the UE supports IMS voice over NR FR2.

2.VoNR support in NR-SA UE capability information (NR-SA only mode)

https://justpaste.it/915r6

OnePlus 8 Pro VoNR messages:

Screenshot Samsung S20 Ultra locked on NR SA ONLY:

The TMO Network is setup to do EPS Fallback all the time , so the voice call is connected using VoLTE. EPS Fallback is a feature triggered by 5G Radio: when it senses the voice bearer setup, it will do reditect to LTE

My guess: When you force your phone in SA-only, it will not tell anymore to the network that it supports both : NR and LTE, it will send only the NR capabilities, nothing about EUTRA. NR-Radio will not be able to initiate the EPS fallback and it seems that finally the call is connected in NR.

(Cisco 5GC supports already VoNR, VoNR tests were done before in TMO network)

https://www.reddit.com/r/tmobile/comments/i4x8fb/are_we_sure_vonr_is_not_active_on_current_galaxy/

Cisco VoNR call flows :

https://www.cisco.com/c/en/us/td/docs/wireless/ucc/smf/b_SMF/b_SMF_chapter_011111.html#reference_d41_dyp_m3b

VoNR documentation :

The VoNR standards:
• 3GPP TS 23.228, Release 15.3.0 - SIP -https://www.etsi.org/deliver/etsi_TS/123200_123299/123228/15.03.00_60/ts_123228v150300p.pdf
• 3GPP TS 23.501, Release 15.4.0 - architecture - https://www.etsi.org/deliver/etsi_ts/123500_123599/123501/15.02.00_60/ts_123501v150200p.pdf
• 3GPP TS 23.502, Release 15.4.0 - procedures, flows - https://www.etsi.org/deliver/etsi_ts/123500_123599/123502/15.02.00_60/ts_123502v150200p.pdf

https://medium.com/@derekcheung/5c-core-pdu-session-and-qos-part-2-52bb72cb0ff7

VoNR messages flow based on TMO US 5G SA Samsung S20 Ultra logs:

When a VoNR call is performed, PDU Session Modification Command is used by the network to add/ delete voice GBR QOS flow (dedicated bearer) with 5QI: 1

"PDU Session Establishment Accept" ( to add the default bearer, 5QI 5 for SIP signaling) and "PDU Session Modification Command" ( used for voice dedicated connection 5QQI 1 ) messages ":

5G vs 4G NAS:

SMS/ 5G NAS: https://blogs.sap.com/2020/06/30/5g-sms-is-very-real-and-here-to-stay/

5G Core book : https://www.finetopix.com/showthread.php/52514-5G-Core-Networks-Powering-Digitalization?highlight=5G+Core+Networks

Length : 254
Log Code : 0xB80A
Timestamp : 2020-08-07

NR5G NAS MM5G Plain OTA Incoming Msg
Version : 1
Std Version : 15
Std Major Version : 4
Std Minor Version : 0
Direction : Network to UE
Ext. PD : 126 (0x7E)
Security header type : Plain 5GS NAS message, not security protected
Message ID : 104 (0x68)
DL NAS Transport
    Payload container
      Payload Type : N1 SM information
      Container IE length : 227
      N1 SM information
        Direction : Network to UE
        Ext. PD : 46 (0x2E)
        PDU session ID : 2 (0x2)
        PTI : 0 (0x0)
        Message ID : 203 (0xCB)
        PDU Session Modification Command
          Always-on PDU session indication
            IEI : 8 (0x8)
            Always-on PDU session indication (APSI) : required
          Authorized QoS rules
            IEI : 122 (0x7A)
            Length : 190
            QoS rule[0]
              QoS rule identifier : 3
              Length of QoS rule : 92
              Rule operation code : Create new QoS rule
              default QoS rule(DQR) : not the default QoS rule
              Number of packet filters : 2
              Packet Filter[0]
                Create and Modify
                  Packet filter direction : downlink only
                  Packet filter identifier : 0
                  Content Length : 44
                  Component[0]
                    Component Type identifier : Protocol identifier/Next header type
                    Protocol identifier/Next header
                      value : 17
                  Component[1]
                    Component Type identifier : IPv6 remote address/prefix length type
                    IPv6 remote address/prefix length type
                      IPv6 : 'xxxx'H
                      Prefix : 128
                  Component[2]
                    Component Type identifier : Single remote port type
                    Single remote port
                      Port : 19313
                  Component[3]
                    Component Type identifier : IPv6 local address/prefix length type
                    IPv6 local address/prefix length type
                      IPv6 : 'xxxx'H
                      Prefix : 128
                  Component[4]
                    Component Type identifier : Single local port type
                    Single local port
                      Port : 1235
              Packet Filter[1]
                Create and Modify
                  Packet filter direction : uplink only
                  Packet filter identifier : 1
                  Content Length : 41
                  Component[0]
                    Component Type identifier : Protocol identifier/Next header type
                    Protocol identifier/Next header
                      value : 17
                  Component[1]
                    Component Type identifier : IPv6 remote address/prefix length type
                    IPv6 remote address/prefix length type
                      IPv6 : 'xxxx'H
                      Prefix : 128
                  Component[2]
                    Component Type identifier : Single remote port type
                    Single remote port
                      Port : 19313
                  Component[3]
                    Component Type identifier : IPv6 local address/prefix length type
                    IPv6 local address/prefix length type
                      IPv6 : 'xxxx'H
                      Prefix : 128
              QoS rule precedence : 128
              Segregation : not requested
              QoS flow identifier : 2
            QoS rule[1]
              QoS rule identifier : 2
              Length of QoS rule : 92
              Rule operation code : Create new QoS rule
              default QoS rule(DQR) : not the default QoS rule
              Number of packet filters : 2
              Packet Filter[0]
                Create and Modify
                  Packet filter direction : downlink only
                  Packet filter identifier : 0
                  Content Length : 44
                  Component[0]
                    Component Type identifier : Protocol identifier/Next header type
                    Protocol identifier/Next header
                      value : 17
                  Component[1]
                    Component Type identifier : IPv6 remote address/prefix length type
                    IPv6 remote address/prefix length type
                      IPv6 : 'xxxx'H
                      Prefix : 128
                  Component[2]
                    Component Type identifier : Single remote port type
                    Single remote port
                      Port : 19312
                  Component[3]
                    Component Type identifier : IPv6 local address/prefix length type
                    IPv6 local address/prefix length type
                      IPv6 : 'xxxx'H
                      Prefix : 128
                  Component[4]
                    Component Type identifier : Single local port type
                    Single local port
                      Port : 1234
              Packet Filter[1]
                Create and Modify
                  Packet filter direction : uplink only
                  Packet filter identifier : 1
                  Content Length : 41
                  Component[0]
                    Component Type identifier : Protocol identifier/Next header type
                    Protocol identifier/Next header
                      value : 17
                  Component[1]
                    Component Type identifier : IPv6 remote address/prefix length type
                    IPv6 remote address/prefix length type
                      IPv6 : 'xxxx'H
                      Prefix : 128
                  Component[2]
                    Component Type identifier : Single remote port type
                    Single remote port
                      Port : 19312
                  Component[3]
                    Component Type identifier : IPv6 local address/prefix length type
                    IPv6 local address/prefix length type
                      IPv6 : 'xxxx'H
                      Prefix : 128
              QoS rule precedence : 192
              Segregation : not requested
              QoS flow identifier : 2
          Authorized QoS flow descriptions
            IEI : 121 (0x79)
            Length : 26
            QoS flow description[0]
              QFI : 2
              Operation code : Create new QoS flow description
              E : 1
              Number of parameters : 5
              Parameter[0]
                Parameter identifier : 5QI
                Length of parameter contents : 1
                5GQI : 5GQI 1
              Parameter[1]
                Parameter identifier : GFBR uplink
                Length of parameter contents : 3
                GFBR uplink
                  value : 0.0 Mbps
              Parameter[2]
                Parameter identifier : GFBR downlink
                Length of parameter contents : 3
                GFBR downlink
                  value : 0.0 Mbps
              Parameter[3]
                Parameter identifier : MFBR uplink
                Length of parameter contents : 3
                MFBR uplink
                  value : 0.0 Mbps
              Parameter[4]
                Parameter identifier : MFBR downlink
                Length of parameter contents : 3
                MFBR downlink
                  value : 0.0 Mbps
    PDU session ID
      IEI : 18 (0x12)
      PDU Session ID 2 : ID 2

Another example:

QoS flow description[0]
    QFI : 2
    Operation code : Create new QoS flow description
    E : 1
    Number of parameters : 6
    Parameter[0]
     Parameter identifier : 5QI
     Length of parameter contents : 1
     5GQI : 5GQI 1
    Parameter[1]
     Parameter identifier : GFBR uplink
     Length of parameter contents : 3
     GFBR uplink
      value : 0.1 Mbps
    Parameter[2]
     Parameter identifier : GFBR downlink
     Length of parameter contents : 3
     GFBR downlink
      value : 0.1 Mbps
    Parameter[3]
     Parameter identifier : MFBR uplink
     Length of parameter contents : 3
     MFBR uplink
      value : 0.1 Mbps
    Parameter[4]
     Parameter identifier : MFBR downlink
     Length of parameter contents : 3
     MFBR downlink
      value : 0.1 Mbps
    Parameter[5]
     Parameter identifier : EPS bearer identity
     Length of parameter contents : 1
     EPS bearer identity
      ID : ID 999

4G Attach req with a UE that supports 5G SA and 5G NSA:

UE Network Capability:

N1 mode supported (N1mode) : supported
Dual connectivity with NR (DCNR) : supported

http://www.sharetechnote.com/html/5G/5G_NetworkArchitecture_N1.html

The formal definition of N1 mode is defined in 24.501-3.1 as follows

N1 mode: A mode of a UE allowing access to the 5G core network via the 5G access network.

5G Identifiers SUPI and SUCI

http://www.techplayon.com/5g-identifiers-supi-and-suci/

SUPI = IMSI ; Subscription Permanent Identifier

SUCI = enchrypted SUPI; Subscription Concealed Identifier