Review CPE Allocated IP Changing on each Radio Bearer Re-Establishment

Introduction

This document describes the unexpected allocated IP change when Customer Premises Equipment (CPE) tries to re-establish the radio bearer.

Prerequisites 

Requirements

Cisco recommends that you have knowledge of these topics:

• Long-Term Evolution (LTE)
• General Packet Radio Service (GPRS)
• Terrestrial Radio Access Network (E-UTRAN)

Components Used

This document is not restricted to specific software and hardware versions.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Background Information

In this case, CPE are modems deployed for providing fixed LTE (Home Broadband) services. However, the information and scenario described in this article can also apply to mobile phones.

Problem

Each time CPE tries to re-establish the radio bearer, the MME sends a Create Session Request with a different EPS Bearer ID (EBI) than the previously established. This is causing the CPE IP assigned by PGW to be changing.

Analysis Performed

Call Flow Analyzed

1. Focusing on the UEContextReleaseRequest, once the signaling connection between the MME and the eNodeB for a particular CPE is released, the MME deletes any eNodeB-related information (eNodeB Address in use for S1-MME, MME UE S1 AP ID and eNB UE S1AP ID). However, retains the rest of the CPE MME context; including the S-GW S1-U configuration information (address and TEIDs).

Frame 74        2022-05-31 08:48:14.866        10.30.50.36           10.125.230.100        S1AP        UEContextReleaseRequest [RadioNetwork-cause=user-inactivity]
Frame 75        2022-05-31 08:48:14.866        10.125.231.104        10.125.231.105        GTPv2       Release Access Bearers Request
Frame 77        2022-05-31 08:48:14.866        10.125.231.105        10.125.231.104        GTPv2       Release Access Bearers Response
Frame 79        2022-05-31 08:48:14.867        10.125.230.100        10.30.50.36           S1AP        UEContextReleaseCommand [RadioNetwork-cause=user-inactivity]

At this point,  based on 3GPP TS 23.401, 5.3.5 S1 release procedure:

• All non-GBR EPS bearers established for the UE are preserved in the MME and in the Serving GW

• If the cause of the S1 release is because of User Inactivity, Inter-RAT Redirection, the MME shall preserve the GBR bearers.

Both statements mean that the CPE still has a PDN connection established and it is registered in the network (Default bearer is still present in MME, SGW and PGW; only radio resources were released). Since the CPE is still registered at a network, but its S1 connection was released due to inactivity, the CPE has no radio resources available. That means that the CPE is in EMM-REGISTERED, but ECM-IDLE state.

2. Based on 3GPP TS 23.401, when CPE in EMM-REGISTERED and ECM-IDLE states has new traffic to send but no radio resources available, it must be sending a Service Request procedure. By sending the Service Request message, S1 connectivity is reestablished but EBI and IP assigned by PGW are not modified.

3GPP TS 23.401 General Packet Radio Service (GPRS) enhancements for Evolved Universal Terrestrial Radio Access Network (E-UTRAN) access 
ECM-IDLE
[…]
In the EMM-REGISTERED and ECM-IDLE state, the UE shall:
- answer to paging from the MME by performing a service request procedure.
[…]
- perform the service request procedure in order to establish the radio bearers when uplink user data is to be sent.

Extracted from 3GPP TS 23.401

In this case, when CPE needs to establish radio bearers again, it sends an Attach Request instead of a Service Request message:

Frame 74        2022-05-31 08:48:14.866        10.30.50.36           10.125.230.100        S1AP                    UEContextReleaseRequest [RadioNetwork-cause=user-inactivity]
Frame 75        2022-05-31 08:48:14.866        10.125.231.104        10.125.231.105        GTPv2                   Release Access Bearers Request
Frame 77        2022-05-31 08:48:14.866        10.125.231.105        10.125.231.104        GTPv2                   Release Access Bearers Response
Frame 79        2022-05-31 08:48:14.867        10.125.230.100        10.30.50.36           S1AP                    UEContextReleaseCommand [RadioNetwork-cause=user-inactivity]
Frame 80        2022-05-31 08:48:21.813        10.30.50.36           10.125.230.100        S1AP/NAS-EPS            InitialUEMessage, Attach request, PDN connectivity request

3. Consider the 3GPP TS 23.401 where E-UTRAN Initial Attach is described:

Extracted from 3GPP TS 23.401

E-UTRAN Initial Attach
[…]
7. If there are active bearer contexts in the new MME for this particular UE (i.e. the UE re-attaches to the same MME without having properly detached before), the new MME deletes these bearer contexts by sending Delete Session Request (LBI) messages to the GWs involved. 
The GWs acknowledge with Delete Session Response (Cause) message. If a PCRF is deployed, the PDN GW employs an IP-CAN Session Termination procedure to indicate that resources have been released. 

Since MME receives an unexpected Attach Request from eNB, it deletes the default bearer that was previously established (during UEContextReleaseRequest in frame 74, only radio resources were released, PDN connection was still established after this point) by sending Delete Session Request messages to the SGW and PGW involved. The GWs acknowledge with a Delete Session Response message:

Frame 87        2022-05-31 08:48:22.108        10.125.231.104        10.125.231.105        GTPv2         EBI=10        Delete Session Request
Frame 89        2022-05-31 08:48:22.108        10.125.232.106        10.125.232.107        GTPv2         EBI=10        Delete Session Request
Frame 91        2022-05-31 08:48:22.109        10.125.232.107        10.125.232.106        GTPv2                       Delete Session Response
Frame 93        2022-05-31 08:48:22.110        10.125.231.105        10.125.231.104        GTPv2                       Delete Session Response

4. Based on E-UTRAN Initial Attach procedure, after the Delete Session Request/Response have been processed, MME sends a Create Session Request to SGW allocating a new EBI and PGW assigns a different IP to the CPE for this new EBI :

Frame 87        2022-05-31 08:48:22.108        10.125.231.104       10.125.231.105        GTPv2         EBI=10        Delete Session Request
Frame 89        2022-05-31 08:48:22.108        10.125.232.106       10.125.232.107        GTPv2         EBI=10        Delete Session Request
Frame 91        2022-05-31 08:48:22.109        10.125.232.107       10.125.232.106        GTPv2                       Delete Session Response
Frame 93        2022-05-31 08:48:22.110        10.125.231.105       10.125.231.104        GTPv2                       Delete Session Response
Frame 95        2022-05-31 08:48:22.112        10.125.231.104       10.125.231.105        GTPv2         EBI=9         Create Session Request
Frame 97        2022-05-31 08:48:22.114        10.125.232.106       10.125.232.107        GTPv2         EBI=9         Create Session Request
Frame 100       2022-05-31 13:48:22.121        10.125.232.107       10.125.232.106        GTPv2         EBI=9         Create Session Response/Create Bearer Request
                                                                                                                      PDN Address and Prefix(IPv4): 10.62.135.145

Solution

CPE is not behaving as per the 3GPP standards. Since eNB initiates the S1 release procedure due to user inactivity, when CPE tries to re-establish the radio bearers, it must send a Service Request message. However, CPE sends an Attach Request instead.

The default bearer is established when the UE connects to a PDN, and that remains established throughout the lifetime of the PDN connection to provide the UE with always-on connectivity to that PDN. As CPE sends a new attach request, MME comply with 3GPP TS 23.401 specification terminating PDN connection by sending Delete Session Request; therefore, the default bearer with EBI=10 is deleted. When MME sends a new Create Session Request, the new default bearer can be allocated with a different EBI and IP (for example, EBI=9 and IP 10.62.135.145) than the previously assigned.