Training / Course 02
Aims — what you can do after
- Explain why 5G needs IMS for voice, and the role of every IMS element.
- Map the IMS reference points (Gm, Mw, Cx, Rx, Mb) onto real processes and captures.
- Provision a subscriber end-to-end: the 5G side and the IMS side.
- Execute and read an IMS-AKA registration: REGISTER → 401 → REGISTER → 200 OK, with the Cx exchanges behind it.
- Place a VoNR call and read the INVITE / SDP / ACK / BYE ladder.
- Decode SIP and Diameter from captures, and read the logs like a call flow.
- Verify the media plane and voice quality, and compute voice KPIs.
- Diagnose the classic IMS failure modes with evidence.
The cast — one Kamailio, three roles
UE → P-CSCF → I-CSCF → S-CSCF → HSS
P/I/S-CSCF route; the HSS holds the subscriber and mints the auth vectors; a media relay carries the audio. The UE knows one address — the P-CSCF; everything past it is discovered.
Flow — IMS-AKA registration ⭐
UE P-CSCF I-CSCF S-CSCF HSS | | | | | |--REGISTER->|--REGISTER-->| | | no credentials yet | | |----Cx: UAR-------------> | may this user register? | | |<---Cx: UAA-------------- | assign an S-CSCF | | |--REGISTER-->| | | | | |---Cx: MAR--->| give me an AKA vector | | | |<--Cx: MAA----| RAND AUTN XRES CK IK |<------------- 401 Unauthorized --------| | challenge: RAND + AUTN # the client verifies the network, then answers the challenge |--REGISTER (response)---->|--REGISTER-->| | | | | |---Cx: SAR--->| I serve this user | | | |<--Cx: SAA----| profile + service triggers |<-------------- 200 OK -----------------| | registered.
The centerpiece: IMS-AKA registration. 401 is step two of the protocol, not an error.
Flow — a VoNR call
UE-A IMS core UE-B | | | |--INVITE (SDP offer)----->|--------INVITE----------->| |<--100 Trying-------------| | |<--180 Ringing----------------------------------- -| the phone rings |<--200 OK (SDP answer)------------------------------| answered |--ACK--------------------->|--------ACK------------->| |====== RTP media (via the relay) ==================| the actual audio |--BYE--------------------->|--------BYE------------->| # signalling can be perfect while media is silent — that fork opens every voice ticket
A voice call: signalling and media are separate planes.
Module breakdown
0
Lab bootstrap & helpers15 min
The IMS lab constants and the validate-gate discipline.
1
IMS architecture, services & startup30 min
The CSCF chain awake and patched; the dedicated voice data network.
2
Subscriber provisioning25 min
One user, two databases — the 5G side and the IMS side.
3
Access path30 min
A gNB and two UEs, each isolated in its own namespace.
4
The SIM-capable SIP client15 min
Why a stock softphone cannot register — and the AKA client that can.
5
IMS registration with AKA + evidence40 min
The centerpiece: the 401→200 handshake and its seven witnesses.
6
VoNR call + evidence30 min
A call between two UEs, and the signalling/media split.
7
Protocol deep dive30 min
Decode SIP and Diameter from captures, message by message.
8
Media plane & voice QoS20 min
RTP, the quality chain, and the dedicated voice bearer.
9
SMS over IMS & XCAP10 min
Messaging and subscriber-editable service settings.
10
Voice KPIs & ML datasets20 min
Registration and call-setup success rates; labelled feature export.
11
Troubleshooting clinic35 min
Guided fault injection across four interfaces, with repair.
What mastery of the voice layer looks like
- Read a registration and know that 401 is the protocol working, not failing.
- Follow one call across seven witnesses, correlated by Call-ID.
- Split every voice fault into signalling vs media before touching anything.