Tuesday, April 28, 2009

LTE : UE initial Attach

Source : 3GPP TS 23.401 & 3GPP TS 29.274 [LTE Bibles :) ]

Lots of people asked me about UE initial attach. So I thought of blogging about it. Initially I was confused about how UE attaches to the network. With specs talking of default bearer and dedicated bearer every thing went over head. I must also say that both specs which I mentioned above are not referring to each other very well. It will definitely take some time figure out how things are working in LTE. I remember attending a webinar conducted by Light reading where the presenter asked a question regarding the clarity and completion of specs. No wonder more that 60% of attendees voted to option saying specs are still not clear. Well understanding UE initial attach proves the point. Lets move ahead.

Now the LTE is all IP, there has to be always a bearer established. That means when the UE comes up it has to get an IP address. When you switch on the UE, UE sends out a attach request to eNB with bunch of IE's attached. Kindly refer to 3GPP TS 23.401 for IE's that UE send out. Note that this is encapsulated in RRC and and send to eNB. eNB forwards the request to MME. Here is where GTPv2 starts. So you should be having 3GPP TS 29.274 open. When MME receives attach request for the first time it puts in few more IE's and forwards the request to SGW, which forward the request to PGW. Now to understand initial attach better lets restrict ourselves to communication between MME, SGW and PGW. The communication between them takes place using GTPv2 protocol.

If you open 29.274 spec you will find create session request. This is used in UE initial attach to create default bearer. Confusion!! The message type is "Create Session Request" and it is creating "Default bearer". Yes, it is like that. This message is also used for other things like " UE requested PDN connectivity", "Tracking area update" etc etc. Spec clearly gives where this message is to be used. Ok! So we have Create session request being sent asking for establishment of default bearer. MME reads the APN and forwards the request to proper SGW, which again forwards it to PGW. Now PGW responds to the request with a response. This is "Create session response". The response contains Ip address to be assigned to the UE, default bearer ID etc. PGW sends the response to SGW which in turn forwards to MME.MME forwards the response to eNB which in turn sends it to UE. With this response we have a default bearer established. This how a create session request look like.


Refer to spec for detailed IEs. Now that you have default bearer established traffic from UE can start. Note that this bearer is always established. It gets torn down only when the UE is powered down or goes out of network area or something. After the default bearer is established traffic has to flow. Since we have direct tunneling, which means the user plane traffic flows from eNB to SGW without the intervention of MME. This is S1-U interface. To indicate this interface to PDN GW, MME sends out a modify bearer request immediately after the default bearer is created. So modify bearer request modifies the default bearer user plan. PGW responds to modify bearer request with modify bearer response. If the response is success then we have user plane setup for traffic flow. This completes the default bearer establishment from my perspective. You can sends other messages based on your implementation. But I think these two requests are must. So how does the call flow look like?

I hope the figure is visible. After that default bearer is established, we can ask for other bearers based on the applications running on UE. These are called dedicated bearers. I was completely confused when the dedicated bearers came in. I could not co-relate the dedicated bearer to secondary PDP context. But later I figured out the trick. I wrote about the dedicated bearers sometime back. Now if you go back to 29.274 you will find create bearer request. This request is used to establish dedicated bearers but not default bearer. I was very confused when I read the dedicated bearers are network initiated. The thing is since LTE is all on IP and if you are receiving a call then network may initiate dedicated bearer to forward that call to you. This doesnt mean that UE cannot ask for dedicated bearers. UE can ask for dedicated bearers by sending out bearer modification command but UE cannot send create bearer request. Bearer modification command will make PDN trigger a dedicated bearer. If you have just started reading the specs it will take a while to understand things, but once you figure out the specs it goes smooth.
I hope the post was useful. Will post more as time permits. As usual comments/questions are greatly welcomed.


Anonymous said...


Could you please explain about the Release Access Bearer Request and Response? Under which scenario do these message are sent from MME to SGW and vice versa?


Santosh said...

Hi there

Cannont answer this right away. Need to look at few things, may be in next post. Please check back.


Anonymous said...

What are bearers, EPS bearer and Radio Access bearer? Please explain.

Santosh said...

Bearer in simple words is the one which carries information. Radio Access Bearers is a service provided by Access stratum to the Non access stratum for transfer of data of between UE and CN. RAB is specific to radio network. RAB are mapped to EPS bearer in core network.

Google and 3GPP TS 23.401 should help more.

Anonymous said...

Thanks for your reply.

1) Is the below understanding correct?

Radio bearer EPS bearer

2) Gone through the TS 23.401. The Release Access Bearers Request/Response is to release the S1-U bearer. Is S1-U bearer same as EPS bearer. If this command is only releasing the S1-U bearer, do we need to delete it? Is the Delete Bearer Command has any role here?

Santosh said...

1. I have the same understanding.

2. We have something called E-RAB (EUTRAN Radio access bearers) over S1-MME. i believe Realse Access bearer is used to release the bearers(E-RAB) over S1_MME. Delete bearer command is specific to EPS bearer and it is used to delete a dedicated bearer. My confusion here is will Release Access bearer also releases the EPS bearer or not? Atleast, S1 release procedure talks (23.401 5.3.5) of UE moving from ECM-Connected to ECM-Idle and in ECM-Idle UE still has a default bearer.

Anonymous said...


What about establishing connection to several different PDNs? Does it mean that UE can have several different default bearers?
And, at the same time, it should mean, that UE can have several different IP-address for each PDN?

Santosh said...

As far as I know a UE can have 3 PDN connections, i.e 3 default bearers. This also mean that a UE can have 3 IP addresses for 3 PDNs

Ashwath said...


1. I have one basic doubt. What data will UE have during attach to send (as per my exp attach is done even before you can see the menu)? I am infact not able to understand the use of the default bearer.

2. Is a default bearer is nothing but the IP address allocation and this IP can be used for background services like web browsing (so that you can avoid the signalling to get IP like in 3G)?

3. Will there any resource reserved in CN?

Santosh said...


1. Attach is done when the UE is switched on. Since LTE is all IP, UE will need an IP address. Consider UE to be a computer with IP address in the internet.
2. A default bearer is something that will give UE an IP address. Also default bearer creation reserves resources in CN for UE data trafic.

I suggest you go through 3GPP TS 23.401 to get the basics of LTE.

Cheers, Santosh

Anonymous said...


In LTE can the UE send APNs in Attach Request towards MME, if yes, then in which field it can send the same, as not able to find where it can send the same in spec 24.301 Release 8

Santosh said...

Look for the ESM container in Attach Request. APN will go in PDN connectivity request.

Anonymous said...

Is it possible to send APN in Initial Attach Request, or would it be possible only in second default bearer

Santosh said...

Yes! You should be able to send APN in Initial Attach. Look for ESM container in Attach request.

Madhu said...

dear santosh could u please explain anything about femtocell of LTE? the basics, about its functionalities, how its communicate with Henb gateway, its procedure for MME etc etc???????

Santosh said...

I will see what I can do. I am under severe time crunch.

eyana said...


I want to know the total time taken to make initial attachment to the LTE network.

Thank you.

Santosh Kumar Dornal said...

It actually depends ... there are several time outs involved. Not very sure of time outs on RRC layer, but NAS and GTP timeouts are in seconds.

Davide said...


From my understanding the default bearer is assigned to an UE as long as the UE is attached to the network, but that does not imply that the S1 connection is always active. It should be released everytime the inactivity timer expires, right? Also, do you know the average duration of the inactivity timer? Thanks.


Santosh Kumar Dornal said...

HI Davide

Inactivity timer is configurable on eNBs. It is usually configured in minutes. You can check with RRC spec to see if there are any default values. However inactivity timer is more of network configuration.

Thanks, Santosh