• 2/3G and 4G

interoperability
 内部公开▲

Index

1. 2/3G re-select to 4G
2. 4G re-select to 2/3G
3. 4G handover to 2/3G
4. How to plan MME Code
5. CSFB procedure and configuration

© ZTE All rights reserved

2
 内部公开▲

2/3G and 4G interoperability

With the rapid development of 4G technologies, operators have begun to
establish commercial 4G networks. 4G network is not isolated, but it is seamlessly
connected to the existing 2/3G network.
when 4G signal are strong, subscriber will try to shift from 2/3G to 4G
There are two way for subscriber from 2/3G shift to 4G:
1. 2/3G re-selection to 4G
2. 2/3G handover to 4G

When 4G signal are weak, subscriber will try to shift from 4G to 2/3G
There are also two way for subscriber from 4G shift to 2/3G:
1. 4G re-selection to 2/3G
2. 4G handover to 2/3G

© ZTE All rights reserved

3
 内部公开▲

2/3G re-select to 4G

SGSN MME

RNC
&
BSC

eNodeB
NodeB

© ZTE All rights reserved

4
 内部公开▲

2/3G re-select to 4G

RNC Gn/Gp Serving Old PDN

UE eNodeB BSC MME SGSN GW MME GW PCRF HSS

1. Trigger to start
TAU procedure
2. Tracking Area Update Request
3. Tracking Area Update Request

4. Context Request
5. Context Response
6. Security procedures

7. Context Acknowledge

C1
8. Forward packets
9. Create Bearer Request

10. Update Bearer Request (A)

11. PCEF Initiated IP-CAN
Session Modification
12. Update Bearer Response
13.Create Bearer Response

14. Update Location Request

15. Cancel Location
16. Cancel Location Ack

17. Iu Release Command

18. Iu Release Complete

19. Update Location Ack

20. Tracking Area Update Accept

21. Tracking Area Update Complete

© ZTE All rights reserved

5
 内部公开▲

2/3G re-select to 4G
When UE try to re-select from 2/3G to 4G, then it will using RAI+PTIMSI generate GUTI (Mapping), Then put this GUTI
into TAU message.
GUTI=GUMMEI + M-TMSI =MCC+MNC+MMEI + M-TMSI=MCC+MNC+MMEGI+MMEC+ M-TMSI
When Enodeb received TAU from UE, it will select MME based on MME code. MME Received TAU from UE and it put
MME GroupID=LAC, MTMSI(15~23)=RAC.

RAI PTMSI
31 29 23 15 0

PLMN LAC RAC 11 NRI

GUMMEI MTMSI
31 29 23 15 0
MME
PLMN MME CODE 11
GROUPID

© ZTE All rights reserved

6
 内部公开▲
2/3G re-select to 4G
There are three scenario for MME to find old SGSN :
Scenario 1 : All SGSN are not in the pool, MME and SGSN are not combo.
MME will generate below string to get old SGSN address:
rac<RAC>.lac<LAC>.rac.epc.mnc<MNC>.mcc<MCC>.3gppnetwork.org
Please note ： This string configured in EPCHOST

Scenario 2 : All SGSN are in the pool, MME and SGSN are not combo
MME will generate below string to get default SGSN address:
rac<RAC>.lac<LAC>.rac.epc.mnc<MNC>.mcc<MCC>.3gppnetwork.org
Please note ： This string configured in EPCHOST
When default SGSN received context request message , Default SGSN will generate below string to find old SGSN :
nri<NRI>.rac<RAC>.lac<LAC>.mnc<NMC>.mcc<MCC>.gprs
Please note ： This string configured in SGSNHOST

Scenario 3 : All SGSN are in the pool, MME and SGSN are combo
If the uMAC is a Combo office and the SGSN is FLEX networking way, MME shall judge whether it is a local SGSN
according to the process in “Combo office’s SGSN supporting TAU handling of flex”. If yes, it will not query the DNS. If
it is the other office’s SGSN, the query format originated by the uMAC is NRI+RAI GPRS.
So the string format is below :
nri<NRI>.rac<RAC>.lac<LAC>.mnc<NMC>.mcc<MCC>.gprs
this string is configured in SGSNHOST configuration;

© ZTE All rights reserved

7
 内部公开▲

2/3G re-select to 4G
Combo office’s SGSN supporting TAU handling of flex

Receive TAU Request

message
Internet

New office is
GGSN COMBO

Yes
Old RAIYes No
No configured
locally

Yes

MME2/SGSN2 MME3/SGSN3 No
MME1/SGSN1 COMBO
supports Flex

Yes

Old RAI No
POOL1 supports Flex No

Yes

NRI is local
Yes
configuration

No

Use RAI for Obtain user

Use NRI+RAI
SGSN info from
for resolution
resolution COMBO

BSC/RNC EnodeB Go to TAU flow Go to TAU flow Go to TAU flow

© ZTE All rights reserved

8
 内部公开▲

Index

1. 2/3G re-select to 4G
2. 4G re-select to 2/3G
3. 4G handover to 2/3G
4. How to plan MME Code
5. CSFB procedure and configuration

© ZTE All rights reserved

9
 内部公开▲

4G re-select to 2/3G

SGSN MME

RNC
&
BSC

eNodeB
NodeB

© ZTE All rights reserved

10
 内部公开▲

4G re-select to 2/3G
MS eNodeB new SGSN old MME S-GW P-GW HSS

0. UE changes to UTRAN or GERAN

1. Routeing Area Update Request

2. SGSN Context Request

2. SGSN Context Response

3. Security Functions

4. SGSN Context Acknowledge

6. Update PDP Context Request

6. Update PDP Context Response

7. Update Location

8. Cancel Location

8. Cancel Location Ack

9. Insert Subscriber Data

9. Insert Subscriber Data Ack

10. Update Location Ack

C2

11. Routeing Area Update Accept

C3

12. Routeing Area Update Complete 13. Delete Bearer Request

13. Delete Bearer Response

13. S1-AP: S1 Release

© ZTE All rights reserved

11
 内部公开▲
4G re-select to 2/3G
UE try to re-select from4G to 2/3G, then it will using GUTI generate RAI+PTMSI (Mapping), Then put this RAI+PTMSI
into RAU message.
MMEGROUPID=LAC, MME Code = RAC and NRI;
New SGSN Received RAU from UE and it generate below string to get old MME address:
rac<RAC>.lac<LAC>.mnc<MNC>.mcc<MCC>.gprs
This configuration is configured in SGSNHOST.

GUMMEI MTMSI
31 29 23 15 0
MME
PLMN MME CODE 11
GROUPID

RAI PTMSI
31 29 23 15 0

PLMN LAC RAC 11 NRI

PTMSI 签名
23 15

© ZTE All rights reserved

12
 内部公开▲

Index

1. 2/3G re-select to 4G
2. 4G re-select to 2/3G
3. 4G handover to 2/3G
4. How to plan MME Code
5. CSFB procedure and configuration

© ZTE All rights reserved

13
 内部公开▲

4G handover to 2/3G

SGSN MME

RNC
&
BSC

eNodeB
NodeB

© ZTE All rights reserved

14
 内部公开▲

4G Handover to 2/3G
MS Target Serving New Gn/Gp P-GW
Source eNodeB Old MME
RNC GW SGSN

1. Decision to perform
handover to UTRAN

2. Handover Required
3. Forward Relocation Request

4. Relocation Request

Establishment of Radio Access Bearers

4. Relocation Request Acknowledge

5. Forward Relocation Response

6. Create Bearer Request
7. Create Bearer Response
8. Handover Command

9. Forwarding of data

10. HO from E-UTRAN Command

MS detected by target RNC

12. Relocation Detect

13. RRC message
14. Relocation Complete

15. Forward Relocation Complete

15. Forward Relocation Complete Acknowledge

16. Update PDP Context Request

16. Update PDP Context Response

17. Routeing Area Update C2

C3

18. Delete Bearer Request

18b. Release Resources
18a. Delete Bearer Response

© ZTE All rights reserved

15
 内部公开▲
4G Handover to 2/3G
The subscriber switches from the LTE network to the UMTS network. The MME constructs an EPC RNC FQDN
message to initiate NAPTR inquiry to the DNS. According to the inquiry result, the MME initiates an A record inquiry
to the DNS to obtain the IP address of the corresponding SGSN.
The RNCID in the RNC FQDN is obtained from the TargetID field in the Handover required message.
It is configured in EPCHOST configuration;
rnc<RNC>.rnc.epc.mnc<MNC>.mcc<MCC>.3gppnetwork.org

© ZTE All rights reserved

16
 内部公开▲

Index

1. 2/3G re-select to 4G
2. 4G re-select to 2/3G
3. 4G handover to 2/3G
4. How to plan MME Code
5. CSFB procedure and configuration

© ZTE All rights reserved

17
 内部公开▲

MME Code plan priciple

The purpose for MME code plan is try to make sure UE re-select from 4G to
2/3G will select same combo SGSN.
MME Code need to plan based on the SGSN NRI value :

GUMMEI MTMSI
31 29 23 15 0
MME
PLMN MME CODE 11
GROUPID

RAI PTMSI
31 29 23 15 0

PLMN LAC RAC 11 NRI

PTMSI 签名
23 15

© ZTE All rights reserved

18
 内部公开▲
MME Code plan priciple
For example, We suppose NRI value is 5 and its length is 3, then below step introduce how to
calculate what MME Code should be planned.
31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
P-TMSI:Flex

NRI Value

31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
P-TMSI:Flex
1 0 1

NRI Value

MME Code

1 0 1 0 0 0 0 0 = 160

1 0 1 1 1 1 1 1 = 191

User ID
NRI

© ZTE All rights reserved

19
 内部公开▲

Index

1. 2/3G re-select to 4G
2. 4G re-select to 2/3G
3. 4G handover to 2/3G
4. How to plan MME Code
5. CSFB procedure and configuration

© ZTE All rights reserved

20
 内部公开▲

CSFB procedure and configuration

Combine Attach and TAU procedure

MME MSC/VLR HSS UE new MME old MME MSC/VLR HSS

UE
1. UE determines to
1. Attach Request perform TAU

2. Step 3 to step 16 of the Attach procedure specified in TS 23.401

2. TAU Request
3. Derive VLR number
3. Step 4 to step 19 of TAU procedure as specified in TS 23.401
4. Location Update Request
4. Location Update Request
5. Create SGs association
5. Location update in CS domain
6. Location update in CS domain
6. Location Update Accept
7. Location Update Accept
7. TAU Accept
8. Step 17 to step 26 of the Attach procedure specified in TS 23.401 8. TAU Complete

Combine Attach Combine TAU

© ZTE All rights reserved

21
 内部公开▲

CSFB procedure and configuration

Mobile Originating Call - PS HO supported
eNodeB BSS/RNS MME MSC SGSN Serving
UE/MS
GW
1a. Extended Service Request

1b. S1-AP Message with CS Fallback indicator

2. Optional Measurement Report Solicitation

3. PS HO as specified in 23.401 [2] (preparation phase and start of execution phase)

4. CM Service Request
4. A/Iu-cs message (with CM Service Request)

5. CM Service Reject 5. CM Service Reject

If the MSC
is changed
Location Area Update or Combined RA/LA Update

6. CS call establishment procedure

7. PS HO as specified in 23.401 [2] (continuation of execution phase)

© ZTE All rights reserved

22
 内部公开▲

CSFB procedure and configuration

Mobile Terminating Call - PS HO supported
eNodeB BSS/RNS MME MSC SGSN Serving
UE/MS
GW
1a. Paging Request
1a. CS Paging Notification
1a. Service Request
1b. Extended Service Request
1c. CS Paging Reject
1d. S1-AP Message with CS Fallback indicator

2. Optional Measurement Report Solicitation

3. PS HO as specified in 23.401 [2] (preparation phase and start of execution phase)

4a. Location Area Update or Combined RA/LA

Update
4b. Paging Response 4b. A/Iu-cs message (with Paging Response)
Option 1:
MSC is not
5a. Establish CS changed
connection
5b. Signalling Connection Release 5b. Connection Reject
If the MSC
is changed
5b. Location Area Update or Combined RA/LA Update

5b. CS call establishment procedure

6. PS HO as specified in 23.401 [2] (continuation of execution phase)

© ZTE All rights reserved

23
 内部公开▲

CSFB procedure and configuration

//Enable CSFB
SET SGSFLAG:SGSFLAG="YES";
//SGs SCTP
ADD SGSSCTP:ROLE="CLT",LOCADDR="IPv4"-102-"10.51.43.232"&"IPv4"-102-"10.51.43.233",LOCPORT=7201,REMADDR="IPv4"-102-"10.51.49.33"&"IPv4"-
102-"10.51.49.34",REMPORT=4801,NAME="to_DRMSCS01_1",ID=721;
ADD SGSSCTP:ROLE="CLT",LOCADDR="IPv4"-102-"10.51.43.232"&"IPv4"-102-"10.51.43.233",LOCPORT=7202,REMADDR="IPv4"-102-"10.51.49.34"&"IPv4"-
102-"10.51.49.33",REMPORT=4802,NAME="to_DRMSCS01_2",ID=722;
ADD SGSSCTP:ROLE="CLT",LOCADDR="IPv4"-102-"10.51.43.232"&"IPv4"-102-"10.51.43.233",LOCPORT=7203,REMADDR="IPv4"-102-"10.51.49.33"&"IPv4"-
102-"10.51.49.34",REMPORT=4803,NAME="to_DRMSCS01_3",ID=723;
ADD SGSSCTP:ROLE="CLT",LOCADDR="IPv4"-102-"10.51.43.232"&"IPv4"-102-"10.51.43.233",LOCPORT=7204,REMADDR="IPv4"-102-"10.51.49.34"&"IPv4"-
102-"10.51.49.33",REMPORT=4804,NAME="to_DRMSCS01_4",ID=724;

ADD SGSCONN:ID=721,SCTPID=721;
ADD SGSCONN:ID=722,SCTPID=722;
ADD SGSCONN:ID=723,SCTPID=723;
ADD SGSCONN:ID=724,SCTPID=724;

ADD SGS ROUTE:ROUTEID=72,PARTAKEMODE="PARTAKE",CONNECTION=721&722&723&724;

ADD SGS ROUTE GROUP:ROUTEGRPID=72,PARTAKEMODE="PARTAKE",ROUTE=72;
ADD SGS OFFICE ROUTE GROUP:OFFICEID=72,ROUTEGRPID=72;

//Configure VLR information and LAI mapping to VLR

ADD VLROFFICE:VLROFFICEID=72,VLRNAME="vlr002.msc72.isb.node.epc.mnc005.mcc410.3gppnetwork.org";
ADD VLRPOOL:VLRPOOLID=1,VLROFFICEID=72,VLRLEVEL="LEVEL_1",VLRWEIGHT=100,NAME="DRMSCS01";
ADD LAIVLRPOOL:LAINAME="mrp_bsc44_lac0c24",VLRPOOLID=1,NAME="mrp_bsc44_lac0c24";
ADD LAIVLRPOOL:LAINAME="lac-test",VLRPOOLID=1,NAME="lac-test";
ADD LAIVLRPOOL:LAINAME="mpr_rnc202_4eed",VLRPOOLID=1,NAME="mpr_rnc202_4eed";
ADD LAIVLRPOOL:LAINAME="TEST_RNC_20262",VLRPOOLID=1,NAME="TEST_RNC_20262";

© ZTE All rights reserved

24
谢谢！