02IMS · Voice Track

IMS Core & VoNR Procedures

Register and call over a live IMS core on top of 5G — and prove every step with packet evidence.

Training  /  Course 02

Overview Lab Environment Topics & Cases

Stand up voice on top of the 5G core: a full P/I/S-CSCF call-session chain, an HSS, and a media relay. Drive an IMS-AKA REGISTER, place a VoNR call between two UEs, and decode the SIP and Diameter (Cx: UAR/MAR/SAR/LIR) side by side so the SIP dialog and the subscriber lookups line up. Every step proven with real packet evidence — never "it rang, so it works".

You leave able to: You can bring up IMS voice from nothing and read a VoNR call end to end, separating a signalling problem from a media problem on sight.

Aims — what you can do after

  • Explain why 5G needs IMS for voice, and the role of every IMS element.
  • Map the IMS reference points (Gm, Mw, Cx, Rx, Mb) onto real processes and captures.
  • Provision a subscriber end-to-end: the 5G side and the IMS side.
  • Execute and read an IMS-AKA registration: REGISTER → 401 → REGISTER → 200 OK, with the Cx exchanges behind it.
  • Place a VoNR call and read the INVITE / SDP / ACK / BYE ladder.
  • Decode SIP and Diameter from captures, and read the logs like a call flow.
  • Verify the media plane and voice quality, and compute voice KPIs.
  • Diagnose the classic IMS failure modes with evidence.

The cast — one Kamailio, three roles

UE → P-CSCF → I-CSCF → S-CSCF → HSS

P/I/S-CSCF route; the HSS holds the subscriber and mints the auth vectors; a media relay carries the audio. The UE knows one address — the P-CSCF; everything past it is discovered.

Flow — IMS-AKA registration ⭐

  UE          P-CSCF        I-CSCF        S-CSCF          HSS
   |            |             |             |              |
   |--REGISTER->|--REGISTER-->|             |              |     no credentials yet
   |            |             |----Cx: UAR------------->    |     may this user register?
   |            |             |<---Cx: UAA--------------    |     assign an S-CSCF
   |            |             |--REGISTER-->|              |
   |            |             |             |---Cx: MAR--->|     give me an AKA vector
   |            |             |             |<--Cx: MAA----|     RAND AUTN XRES CK IK
   |<------------- 401 Unauthorized --------|              |     challenge: RAND + AUTN
   #  the client verifies the network, then answers the challenge
   |--REGISTER (response)---->|--REGISTER-->|              |
   |            |             |             |---Cx: SAR--->|     I serve this user
   |            |             |             |<--Cx: SAA----|     profile + service triggers
   |<-------------- 200 OK -----------------|              |     registered.

The centerpiece: IMS-AKA registration. 401 is step two of the protocol, not an error.

Flow — a VoNR call

  UE-A                     IMS core                     UE-B
   |                          |                          |
   |--INVITE (SDP offer)----->|--------INVITE----------->|
   |<--100 Trying-------------|                          |
   |<--180 Ringing-----------------------------------  -|     the phone rings
   |<--200 OK (SDP answer)------------------------------|     answered
   |--ACK--------------------->|--------ACK------------->|
   |====== RTP media (via the relay) ==================|     the actual audio
   |--BYE--------------------->|--------BYE------------->|
   #  signalling can be perfect while media is silent — that fork opens every voice ticket

A voice call: signalling and media are separate planes.

Module breakdown

0
Lab bootstrap & helpers15 min
The IMS lab constants and the validate-gate discipline.
1
IMS architecture, services & startup30 min
The CSCF chain awake and patched; the dedicated voice data network.
2
Subscriber provisioning25 min
One user, two databases — the 5G side and the IMS side.
3
Access path30 min
A gNB and two UEs, each isolated in its own namespace.
4
The SIM-capable SIP client15 min
Why a stock softphone cannot register — and the AKA client that can.
5
IMS registration with AKA + evidence40 min
The centerpiece: the 401→200 handshake and its seven witnesses.
6
VoNR call + evidence30 min
A call between two UEs, and the signalling/media split.
7
Protocol deep dive30 min
Decode SIP and Diameter from captures, message by message.
8
Media plane & voice QoS20 min
RTP, the quality chain, and the dedicated voice bearer.
9
SMS over IMS & XCAP10 min
Messaging and subscriber-editable service settings.
10
Voice KPIs & ML datasets20 min
Registration and call-setup success rates; labelled feature export.
11
Troubleshooting clinic35 min
Guided fault injection across four interfaces, with repair.

What mastery of the voice layer looks like

  • Read a registration and know that 401 is the protocol working, not failing.
  • Follow one call across seven witnesses, correlated by Call-ID.
  • Split every voice fault into signalling vs media before touching anything.
← Course 01 — 5G Core Operations Course 03 — Advanced Core Engineering →