GSM MSC/MSC-S R12 Configuration Guide

GSM MSC/MSC-S R12 Configuration
LZT 123 8482 R1A © Ericsson 2006 - 1 -
STUDENT BOOK
LZT 123 8482 R1A

- 2 - © Ericsson 2006 LZT 123 8482 R1A
DISCLAIMER
This book is a training document and contains simplifications.
Therefore, it must not be considered as a specification of the
system.
The contents of this document are subject to revision without
notice due to ongoing progress in methodology, design and
manufacturing.
Ericsson assumes no legal responsibility for any error or damage
resulting from the usage of this document.
This document is not intended to replace the technical
documentation that was shipped with your system. Always refer to
that technical documentation during operation and maintenance.
© Ericsson 2006
This document was produced by Ericsson.
• It is used for training purposes only and may not be copied or
reproduced in any manner without the express written consent
of Ericsson.
This Student Book, LZT 123 8482, R1A supports course number
LZU 108 6641 .

Table of Contents
LZT 123 8482 R1A © Ericsson 2006 - 3 -
Table of Contents
1 INTRODUCTION..........................................................................11
NETWORK ARCHITECTURE MODELS..............................................13
VERTICALLY INTEGRATED NETWORKS ....................................................13
HORIZONTALLY INTEGRATED NETWORKS...............................................14
LAYERS AND NODES.........................................................................15
THE CONNECTIVITY LAYER ........................................................................15
THE CONTROL LAYER..................................................................................16
THE APPLICATION LAYER ...........................................................................17
THE ARCHITECTURE .........................................................................18
ERICSSON’S GSM AND WCDMA SYSTEMS NETWORK .................20
NETWORK NODES .............................................................................23
BASE STATION SYSTEM (BSS) / WCDMA RADIO ACCESS NETWORK
(WCDMA RAN) ...............................................................................................23
CORE NETWORK (CN)..................................................................................24
ADDITIONAL NODES.....................................................................................28
GSM AND WCDMA SYSTEMS IDENTITIES.......................................31
MOBILE STATION ISDN NUMBER (MSISDN) ..............................................31
INTERNATIONAL MOBILE SUBSCRIBER IDENTITY (IMSI) ........................32
TEMPORARY MOBILE SUBSCRIBER IDENTITY (TMSI) .............................33
MOBILE STATION ROAMING NUMBER (MSRN) .........................................34
INTERNATIONAL MOBILE EQUIPMENT IDENTITY (IMEI) AND
SOFTWARE VERSION NUMBER (IMEISV) ..................................................35
LOCATION AREA IDENTITY (LAI).................................................................36
CELL GLOBAL IDENTITY (CGI).....................................................................37
SERVICE AREA IDENTITY (SAI) ...................................................................37
ADDRESSING THE SWITCHING SYSTEM ENTITIES .......................38
GLOBAL TITLE (GT).......................................................................................38
MOBILE GLOBAL TITLE (MGT) .....................................................................39
CORE NETWORK PROTOCOLS IN MSS ARCHITECTURE..............41
BEARER INDEPENDENT CALL CONTROL (BICC) ......................................44
H.248 - GATEWAY CONTROL PROTOCOL (GCP) ......................................47

- 4 - © Ericsson 2006 LZT 123 8482 R1A
SIGNALING OVER ATM.................................................................................48
SS7 SIGNALLING OVER IP (SIGTRAN)........................................................51
2 MESSAGE TRANSFER PART....................................................55
MESSAGE TRANSFER PART (MTP)..................................................57
INTRODUCTION.............................................................................................57
EXAMPLE .......................................................................................................59
PREREQUISITES...........................................................................................60
ANALOGY BETWEEN CALLS AND S7 MESSAGES ....................................60
SIGNALING POINT.........................................................................................60
MTP ROUTING AND LINK SET .....................................................................63
SIGNALING LINK AND SIGNALING TERMINAL ...........................................64
HARDWARE AND ROUTE CONNECTION (SS7) ...............................67
CONNECTION OF THE SIGNALING TERMINAL TO THE GROUP
SWITCH..........................................................................................................67
GS PATH ........................................................................................................67
ROUTE DATA.................................................................................................68
HARDWARE AND ROUTE CONNECTION (J7)..................................70
CONNECTION OF THE SIGNALING TERMINAL ..........................................70
HIGH SPEED SIGNALING LINKS (HSL) ............................................71
GENERAL.......................................................................................................71
CONCEPT.......................................................................................................72
IMPLEMENTATION ........................................................................................72
SS7 SIGNALING OVER IP ..................................................................78
3 SIGNALING CONNECTION CONTROL PART...........................85
INTRODUCTION..................................................................................87
SCCP ADDRESSING...........................................................................89
GLOBAL TITLE (GT) ...........................................................................90
SUBSYSTEM NUMBER (SSN).......................................................................90
ADDRESS INFORMATION (AI)......................................................................91
NATURE OF ADDRESS (NA).........................................................................91
NUMBERING PLAN (NP) ...............................................................................91
TRANSLATION TYPE (TT).............................................................................91

Table of Contents
LZT 123 8482 R1A © Ericsson 2006 - 5 -
EXAMPLE .......................................................................................................92
PREREQUISITES...........................................................................................93
ANALOGY BETWEEN CALLS AND SS7 MESSAGES ......................94
CALLING AND CALLED ADDRESS ...................................................95
GLOBAL TITLE TRANSLATION .........................................................98
GLOBAL TITLE ROUTING................................................................102
MAJOR PRINTOUTS IN SS7/J7........................................................104
4 MEDIA GATEWAY AND MSC SERVER...................................105
INTRODUCTION................................................................................107
MEDIA GATEWAY APPLICATION ...............................................................109
SIGNALING GATEWAY APPLICATION.......................................................110
MEDIA GATEWAY SELECTION ..................................................................111
MEDIA GATEWAY GROUP..........................................................................113
LOAD CONTROL BETWEEN MSC SERVER AND MEDIA GATEWAY ......114
RECOVERY SERVICES BETWEEN MSC SERVER AND MEDIA
GATEWAY ....................................................................................................115
DEFINITIONS IN MSC .......................................................................116
GATEWAY CONTROL PROTOCOL (GCP) OVER ATM .............................116
M-MGW SELECTION AND MGG .................................................................118
GATEWAY CONTROL PROTOCOL (GCP) OVER IP..................................119
NETWORK CONFIGURATION.....................................................................123
REMOTE CONTROL OF TDM DEVICES.....................................................125
BICC (BEARER INDEPENDENT CALL CONTROL) ....................................127
MSC IN POOL....................................................................................128
CONCEPTS .......................................................................................130
ANCHOR MSC..............................................................................................130
ENHANCED CO-OPERATING VLR FUNCTIONALITY................................130
GLOBAL CN-ID.............................................................................................130
GS-INTERFACE ...........................................................................................131
MSC POOL ...................................................................................................131
MEDIA GATEWAY........................................................................................132
NEIGHBORING MSC GROUP .....................................................................132

- 6 - © Ericsson 2006 LZT 123 8482 R1A
NRI 133
NON-ANCHOR MSC ....................................................................................134
OVERLAPPING POOL AREA.......................................................................134
POOL AREA .................................................................................................135
PROXY MSC.................................................................................................136
THIRD MSC ..................................................................................................136
TMSI 137
SUBSEQUENT HANDOVER/SRNS RELOCATION.....................................137
ROUND ROBIN ALGORITHM ......................................................................137
5 BSC CONNECTION ..................................................................139
INTRODUCTION TO BSC FUNCTIONALITY....................................141
TRANSCODER CONTROLLER (TRC)..............................................142
DEFINITION OF MOBILE TELEPHONY A-INTERFACE LINE TERMINAL
(MALT) DEVICES AND REMOTE MALT (MRALT) ......................................143
BSC CONNECTION TO THE CLASSICAL AND MSS ARCHITECTURES..144
SIGNALING LINK ON THE A-INTERFACE ..................................................144
CONNECTING A BSC TO THE MSC - CLASSICAL
ARCHITECTURE ...............................................................................145
OTHER USEFUL OPERATIONAL INSTRUCTIONS (OPIS) ........................148
ADAPTATION DIRECTION ..........................................................................148
APPLICATION INFORMATION ....................................................................148
CONNECTING A BSC TO THE MSC - MSS ARCHITECTURE.........149
REMOTE A INTERFACE..............................................................................150
CELL DEFINITION IN THE MSC-S ..............................................................152
M-MGW, MGG AND BSC DEFINITION IN THE MSC-S ..............................152
BSC CONNECTED TO REDUNDANT M-MGW ...........................................153
OTHER USEFUL OPERATIONAL INSTRUCTIONS (OPIS) ........................154
ADAPTATION DIRECTION ..........................................................................154
APPLICATION INFORMATION ....................................................................155
BSC CONNECTION TO THE MSC IN POOL ....................................155
6 LOCATION UPDATING.............................................................159
INTRODUCTION................................................................................161
IMSI NUMBER SERIES ANALYSIS...................................................163

Table of Contents
LZT 123 8482 R1A © Ericsson 2006 - 7 -
ROAMING ..........................................................................................166
AUTHENTICATION AND KEY AGREEMENT (AKA) SELECTION
MECHANISM ................................................................................................166
NORMAL LOCATION UPDATING.....................................................169
IMSI DETACH ....................................................................................172
IMSI ATTACH.....................................................................................173
AUTHENTICATION............................................................................174
GSM TRIPLET GENERATION .....................................................................174
TRIPLET CONCEPT.....................................................................................174
TRIPLET PARTS ..........................................................................................174
GSM AUTHENTICATION PROCEDURE .....................................................175
GSM CIPHERING PROCEDURE .................................................................176
WCDMA SYSTEMS QUINTET GENERATION ............................................177
BENEFITS OF WCDMA SYSTEMS AUTHENTICATION.............................178
QUINTET CONCEPT....................................................................................179
QUINTET PARTS .........................................................................................179
AUTHENTICATION AND KEY AGREEMENT ..............................................180
7 CALL FROM MOBILE SUBSCRIBER ......................................183
GENERAL..........................................................................................185
GSM 185
WCDMA ........................................................................................................186
ANALYSIS FUNCTIONS....................................................................190
CALL FROM MOBILE SUBSCRIBER TO PSTN ..............................191
EMERGENCY CALL..........................................................................198
ENHANCED EMERGENCY CALL ROUTING ...................................203
GENERAL.....................................................................................................203
CONCEPT.....................................................................................................203
BENEFIT.......................................................................................................204
IMPLEMENTATION ......................................................................................204
8 CALL TO MOBILE SUBSCRIBER FROM PSTN/ISDN ............207
GENERAL..........................................................................................209

- 8 - © Ericsson 2006 LZT 123 8482 R1A
CALL FROM ISDN TO MS/UE...........................................................213
INTRODUCTION...........................................................................................213
EXCHANGE DATA FOR THE GMSC (SERVER).........................................214
GMSC CALL HANDLING..............................................................................217
EXCHANGE DATA FOR THE HLR ..............................................................222
HLR CALL HANDLING .................................................................................226
EXCHANGE DATA FOR THE MSC..............................................................227
MSC CALL HANDLING.................................................................................229
GMSC AND MSC CALL HANDLING ............................................................231
9 HANDOVER ..............................................................................235
INTRODUCTION................................................................................237
GSM HANDOVER..............................................................................237
INTRA BSC HANDOVER..............................................................................238
INTER BSC HANDOVER/INTRA MSC HANDOVER ...................................239
INTER MSC HANDOVER.............................................................................241
BASIC HANDOVER......................................................................................241
SUBSEQUENT HANDOVER IN MSC-B.......................................................247
WCDMA SYSTEM HANDOVER ........................................................250
INTRA RNC SOFT HANDOVER...................................................................252
INTRA RNC HARD HANDOVER ..................................................................253
INTER RNC SOFT HANDOVER/INTRA MSC HANDOVER.........................255
INTER RNC HARD HANDOVER/ INTRA MSC HANDOVER.......................258
WCDMA TO GSM HANDOVER.........................................................260
WCDMA TO GSM HANDOVER, INTRA-MSC..............................................261
WCDMA TO GSM HANDOVER, INTER-MSC..............................................261
WCDMA TO GSM HANDOVER, INTER-PLMN............................................261
CHARGING...................................................................................................261
GSM TO WCDMA HANDOVER.........................................................263
GSM TO WCDMA HANDOVER, INTRA-MSC..............................................263
GSM TO WCDMA HANDOVER, INTER-MSC..............................................263
GSM TO WCDMA HANDOVER, INTER-PLMN............................................263
CHARGING...................................................................................................264
EXCHANGE DATA FOR HANDOVER...............................................265

Table of Contents
LZT 123 8482 R1A © Ericsson 2006 - 9 -
ROUTE DEFINITION FOR INTER-MSC HANDOVER ROUTES .................265
DEFINITION AND ANALYSIS OF HANDOVER NUMBERS ........................266
DEFINITION OF NEIGHBORING MSC ........................................................266
DEFINITION OF NEIGHBORING RNC ........................................................267
10 TELECOMMUNICATION SERVICE ANALYSIS.......................269
INTRODUCTION................................................................................271
BEARER CAPABILITIES (BC)......................................................................271
BASIC SERVICE GROUPS ..........................................................................272
BASIC SERVICE CODE (BASC) ..................................................................273
SERVICES IN WCDMA SYSTEMS NETWORKS ........................................274
SERVICES IN GSM NETWORKS ................................................................275
COMMON CHARACTERISTICS ..................................................................276
TELECOMMUNICATION SERVICE ANALYSIS ................................279
EXAMPLE OF A FAX GROUP 3 CALL:........................................................282
TRANSMISSION MEDIUM REQUIREMENT ANALYSIS ..................286
COMPATIBILITY CHECK ..................................................................287
11 SHORT MESSAGES, DATA AND FAX CALLS .......................289
SHORT MESSAGE SERVICE (SMS) ................................................290
MOBILE-TERMINATED SMS .......................................................................290
UNSUCCESSFUL MOBILE-TERMINATED SMS DELIVERY ...........294
WCDMA SYSTEMS/GSM EQUIPMENT PRESENT ..........................295
MOBILE-ORIGINATED SMS ........................................................................297
SMS QUEUING.............................................................................................300
DATA AND FAX CALLS.....................................................................302
CHARACTERISTICS OF DATA COMMUNICATION ...................................302
DATA AND FAX CALLS IN CS .....................................................................303
IWF PLATFORMS.........................................................................................307
TRAFFIC CASES..........................................................................................317
DATACOM BASE FOR WCDMA SYSTEMS .....................................326
3G.324M MULTIMEDIA SUPPORT....................................................329
FRAME TUNNELING MODE .............................................................334

- 10 - © Ericsson 2006 LZT 123 8482 R1A
INTERWORKING FUNCTION (IWF) IN MEDIA GATEWAY (M-
MGW).................................................................................................335
APPENDIX A: ABBREVIATIONS......................................................343
APPENDIX B: TABLE OF FIGURES.................................................355
APPENDIX C: INDEX ........................................................................363

1 Introduction
LZT 123 8482 R1A © 2006 Ericsson - 11 -
1 Introduction
Objectives:
Explain the main parts of Ericsson’s GSM Systems
network including Mobile Softswitch Solution.
ƒ Cite examples of basic traffic cases in a GSM network
ƒ Explain the GSM Systems identities
ƒ Detail the MGT (Mobile Global Title) concept
ƒ Identify the Core Network Protocols in MSS Architecture
Figure 1-1. Objectives

- 12 - © Ericsson 2006 LZT 123 8482 R1A
Intentionally Blank

1 Introduction
LZT 123 8482 R1A © 2006 Ericsson - 13 -
NETWORK ARCHITECTURE MODELS
The GSM R12/WCDMA CN 4.0 network is a multi-service
network. It accommodates the growing number of interconnections
between a variety of networks, both circuit-switched and packet-
switched, narrowband and broadband, voice and data, fixed and
mobile. For the operator, the GSM/WCDMA network means
continuity of services, optimized end user application portfolios
and significant cost reductions in transmission, operation and
maintenance.
In the parlance of modern network architecture, network
implementations can be loosely classified as either Vertically
Integrated or Horizontally Integrated (see Figure 1-2).
Access Transport
& Switching Networks
Services
Horizontal
Horizontal Integration
Integration
Vertical
Vertical Integration
Integration
PL
MN
PSTN/ISDN
CATV
PLMN
PSTN/ISDN
Data/IP
Networks
CATV
Services/Applications
Connectivity
Data/IP
Networks
Access Transport
& Switching Networks
Services
Horizontal
Horizontal Integration
Integration
Vertical
Vertical Integration
Integration
PL
MN
PSTN/ISDN
CATV
PLMN
PSTN/ISDN
Data/IP
Networks
CATV
Services/Applications
Connectivity
Data/IP
Networks
Figure 1-2. Vertically Integrated and Horizontally Integrated network
design models
VERTICALLY INTEGRATED NETWORKS
Many older networks in existence today can be described as
“vertically integrated”. Vertically integrated networks are
optimized for a particular service category and typically offer a
single service or set of closely related services. The PSTN and
PLMN are examples of vertically integrated networks. The
operator offers everything from subscriber access to service
creation and service delivery across a wholly owned network
infrastructure.

- 14 - © Ericsson 2006 LZT 123 8482 R1A
Each vertically integrated network incorporates its own protocols,
nodes and end-user equipment. Telephony and data service
domains are still kept more or less separate. Since vertically
integrated networks need only support a limited range of closely
related services, it is relatively easy to ensure reliability and to
meet customer expectations in terms of service quality. Network
specific approaches to network management and guaranteed
service levels are used. A conceptual view of vertically integrated
networks is illustrated in Figure 1-2. Each vertically integrated
network requires its own Operation and Maintenance (O&M)
personnel, dimensioning engineers and network designers.
HORIZONTALLY INTEGRATED NETWORKS
The rapid convergence of telecom and datacom technologies has
lead to the integration of vertical networks into multi-service (or
next generation) networks that provide reliable and real-time
communications for all service types.
To simplify backbone network design and enable incremental
upgrade as new technologies are commercialized, a layered
approach has been taken to the design of the next generation
networks. By layering the design of the network and providing
open, standard interfaces, each part of the network can evolve at its
own pace independent of changes in other parts of the network.
Networks designed on this layered principle are described as
“horizontally integrated”. All network functionality is split
between:
• the connectivity layer
• the control layer
• the application layer
The concept of horizontal integration was used to formulate
Ericsson’s network architecture (See Figure 1-2).
Within Ericsson, the terminology Core Network usually refers to
the backbone network for WCDMA Systems (and now GSM),
while Multi-Service Network usually refers to the multi-service
backbone used in fixed solutions such as the Engine Integral
Network. It should be noted that the term multi-service network is
used in a generic sense to describe any network capable of carrying
diverse traffic types with acceptable Quality of Service (QoS).

1 Introduction
LZT 123 8482 R1A © 2006 Ericsson - 15 -
LAYERS AND NODES
THE CONNECTIVITY LAYER
The horizontal structure of the next generation networks means that
all service types use the same transport network; this forms the
connectivity layer. The connectivity layer handles the transport and
manipulation of user and control data. Manipulation includes
coding/decoding of the user plane data and protocol conversion in
the control plane. An operator with a multi-service backbone
network can reduce equipment and operational costs by having this
common transport network for all services.
The connectivity layer comprises transport backbone elements and
Media Gateways (M-MGWs) as shown in Figure 1-3.
RNC
BS
BS
Connectivity Layer
Transport Network
(IP or ATM)
EIR
MSC
server
HLR AUC GMSC-
TSC
server
Control Layer
Application Layer
ISDN/PSTN
Internet
Intranets
Extranets
ISP-POP
Media
Gateway
Media
Gateway
BSC
BS
BS
RNC
BS
BS
Connectivity Layer
Transport Network
(IP or ATM)
EIR
MSC
server
HLR AUC GMSC-
TSC
server
Control Layer
Application Layer
ISDN/PSTN
Internet
Intranets
Extranets
ISP-POP
Media
Gateway
Media
Gateway
BSC
BS
BS
Figure 1-3. Layered Core Network Model Showing the Logical Network
Nodes
The transport backbone elements may be IP routers, ATM switches
or nodes built on any technology that meets the requirements for
flexibility and Quality of Service (QoS). Their role is to
transparently transport user and control data across the Core
Network.

- 16 - © Ericsson 2006 LZT 123 8482 R1A
M-MGWs act as interfaces between the Core Network and the
access networks, performing protocol and data conversion. For
example, Adaptive Multi Rate (AMR) transcoders may be found in
M-MGWs (AMR is the official voice codec for the WCDMA
RAN). They also incorporate auxiliary functions such as tone
generators, DTMF senders/receivers and echo cancellers allowing
integration with existing networks.
The GSM/EDGE Radio Access Network (GERAN) and the
WCDMA RAN are connected to the connectivity network via M-
MGWs, as are external networks such as the Internet and
ISDN/PSTN. User plane data is transported across the connectivity
network via M-MGWs.
THE CONTROL LAYER
The control layer (seen in the middle of Figure 1-3) is where
service intelligence resides. Service intelligence is unique and
specific to each service type.
Supported service types include Global System for Mobile
Communication (GSM), General Packet Radio Service (GPRS) and
Wideband Code Division Multiple Access (WCDMA).
The nodes found in the control layer are generically referred to as
control servers. Control servers provide call control functionality as
well as hand-over and paging support. They do not control bearer
allocation or mapping; the connectivity layer performs these
functions.
Several control servers are required for Circuit Switched Services
(2G) / Circuit Mode Services (3G):
• MSC
• GMSC
• SSP (Service Switching Point)
• The SSP is used to implement Intelligent Network (IN)
functions.
• TSC (Transit Switching Center)
At the interface towards the external network, the TSC is
introduced. In most cases the TSC is co-located with a Gateway
MSC (GMSC). The main responsibility of the TSC is to hide the
layered network architecture towards external networks (always
STM).

1 Introduction
LZT 123 8482 R1A © 2006 Ericsson - 17 -
The Signaling Gateway (SGW is incorporated in M-MGWs and
performs routing of the SS7 messages between different types of
SS7 signaling data-links. SGWs are required to interface to
external networks that do not support call and bearer separation.
SGWs include the Signaling Transfer Point (STP) function.
THE APPLICATION LAYER
The top layer, see Figure 1-3, is the application layer. Applications
in the application layer are as generic as possible, enabling their
use for all types of services. These applications would typically be
Internet applications, Intelligent Network (IN) applications and so
on.
There are two different types of node at the application layer:
Application Servers and Service Capability Servers (SCSs):
• The Application Servers provide generic services and content.
An example may be mobile web banking.
• The Service Capability Servers interface with the network
specific resources in the Core Network and provide generic
open protocols to the Application Servers. Examples of SCSs
are WAP servers, CAMEL servers, SIM Application Toolkit
(SAT) and Mobile Positioning Center (MPC).

- 18 - © Ericsson 2006 LZT 123 8482 R1A
THE ARCHITECTURE
Many of the nodes within the classical architecture perform the
roles of connection control and bearer control.
For example, the Mobile Switching Center (MSC) performs call
control functions such as B-number analysis and IMSI analysis to
determine user plane and control plane routing. They also perform
bearer control, comprising tasks such as physically switching user
plane connections and managing bearer (route) resources.
MSC
MSC
Server
Media
Gateway
MGW
(ALI)
Monolithic
Traffic Traffic
Traffic Traffic
Control
Control
Signalling GCP
MSC
MSC
Server
Media
Gateway
MGW
(ALI)
Monolithic
Traffic Traffic
Traffic Traffic
Control
Control
Signalling GCP
MSC
MSC
Server
Media
Gateway
MGW
(ALI)
Monolithic
Traffic Traffic
Traffic Traffic
Control
Control
Signalling GCP
MSC
MSC
Server
Media
Gateway
MGW
(ALI)
Monolithic
Traffic Traffic
Traffic Traffic
Control
Control
Signalling GCP
Figure 1-4. Migration from Classical MSC Architecture
One concrete way of offering a smooth migration to layered
architecture is the support of server functionality in MSC(GSM)
and MSC(WCDMA) The solution allows using a classical node
MSC(GSM) or MSC(WCDMA) additionally as an MSC Server
respectively a TSC as a TSC Server, that remote controls M-MGW
nodes.
This solution allows a node to decide for each call whether it
behaves as server or as classical node. Once a selection has been
done for the server or the classical node the call continues
according to this selection, for example, during a handover.
Mobile Softswitch and classical architecture are combined in a
single node. It provides the following advantages to an operator:
• Possibility to statistically regulate the share of classical and
Mobile Softswitch traffic in the network thereby allowing a
controlled and flexible introduction of layered architecture

1 Introduction
LZT 123 8482 R1A © 2006 Ericsson - 19 -
• Reuse of spare CP capacity in existing nodes for GSM,
WCDMA or GSM/WCDMA traffic extension via a layered
network architecture
• Reduced load on signaling network and on HLR since roaming
between GSM and WCDMA areas requires less location
updates towards HLR
• Reduced need for inter-MSC handovers when moving between
GSM and WCDMA areas
• Allows for capacity expansions in the Mobile Softswitch
architecture while fully reusing the hardware in Classical
architecture nodes

- 20 - © Ericsson 2006 LZT 123 8482 R1A
ERICSSON’S GSM AND WCDMA SYSTEMS NETWORK
The Core Network of the GSM/WCDMA supports both Circuit
Switched and Packet Switched services.
Figure1-5 illustrates the Mobile Softswitch CS core network
architecture with logical nodes and Figure 1-6 the corresponding
Classical MSC network architecture.
Engine
Multi-Service
Network
ISDN/PSTN
PLMN
Internet
SGSN
GMLC gsmSCF
GGSN
SC
GSC
SC
BSS
RNS
PABX
MGW MGW
PRA
access
SMS-SC LCS CSE
VIG
A
IuCS
D
Nb
Nc
Gs
Mc
Lg
PS domain
SNM
F Mc
RAN
C
TSC
server
Lh
CAS, TUP
Legacy NW
User & control
User plane
Control plane
Internet
access
legacy
support
GMSC
server
FNR
EMA
Inmarsat
SAT RAN
IuCS
gsmSSF
MSC
server
gsmSSF
MGW
Mc
Nb
Nc
HLR
CA
SCS
OSS-RC
SMS
IWMSC/GMSC
H
AUC
EIR
X1,X2 HI3
LIS
LEMF
LI-IMS MM
SYN
Charg
GSC
NRG
ADD
DRC
Engine
Multi-Service
Network
ISDN/PSTN
PLMN
Internet
SGSN
GMLC gsmSCF
GGSN
SC
GSC
SC
BSS
RNS
PABX
MGW MGW
PRA
access
SMS-SC LCS CSE
VIG
A
IuCS
D
Nb
Nc
Gs
Mc
Lg
PS domain
SNM
F Mc
RAN
C
TSC
server
Lh
CAS, TUP
Legacy NW
User & control
User plane
Control plane
Internet
access
legacy
support
GMSC
server
FNR
EMA
Inmarsat
SAT RAN
IuCS
gsmSSF
MSC
server
gsmSSF
MGW
Mc
Nb
Nc
HLR
CA
SCS
OSS-RC
SMS
IWMSC/GMSC
H
AUC
EIR
X1,X2 HI3
LIS
LEMF
LI-IMS MM
SYN
Charg
GSC
NRG
ADD
DRC
Figure 1-5. Mobile Softswitch architecture with logical nodes

1 Introduction
LZT 123 8482 R1A © 2006 Ericsson - 21 -
Engine
Multi-Service
NW
ISDN/PSTN
PLMN
Internet/
IP network
SGSN
GGSN
PABX
MSC
Internet
access
A
D
Gs
Lg
PS domain
User & control
User plane
HI3
F
TSC
Lh
Control plane
CTM
(ANSI)
H
Nc
PRA
ISUP/TUP/CAS
ISUP
GMSC
FNR HLR
A
BSS
RNS
RAN
Thuraya
SAT RAN
IuCS
gsmSSF
gsmSS
F
GMLC NRG
LCS SNM
EMA
LIS CA
C
Nc
Nc
VIG
gsmSCF DCR
CSE ADD
OSS-RC
LEMF
LI-IMS
X1,X2
SC
SMS-SC
SMS
IWMSC/GMSC
EIR
AUC
ISUP
ISUP
SCS
MM
Charg
GSC
SYN
Engine
Multi-Service
NW
ISDN/PSTN
PLMN
Internet/
IP network
SGSN
GGSN
PABX
MSC
Internet
access
A
D
Gs
Lg
PS domain
User & control
User plane
HI3
F
TSC
Lh
Control plane
CTM
(ANSI)
H
Nc
PRA
ISUP/TUP/CAS
ISUP
GMSC
FNR HLR
A
BSS
RNS
RAN
Thuraya
SAT RAN
IuCS
gsmSSF
gsmSS
F
GMLC NRG
LCS SNM
EMA
LIS CA
C
Nc
Nc
VIG
gsmSCF DCR
CSE ADD
OSS-RC
LEMF
LI-IMS
X1,X2
SC
SMS-SC
SMS
IWMSC/GMSC
EIR
AUC
ISUP
ISUP
SCS
MM
Charg
GSC
SYN
Figure 1-6. Classical MSC architecture with logical nodes
The system contains the following components:
• Base Station System (BSS)
– Base Station (BS)
– Base Station Controller (BSC)
• WCDMA Radio Access Network (WCDMA RAN)
– Base Station (BS)
– Radio Network Controller (RNC)
• Core Network (CN)
– Mobile services Switching Center (MSC)
– Mobile services Switching Center (MSC) Server
– Gateway MSC (GMSC)
– Gateway MSC (GMSC) Server
– Home Location Register (HLR)
– Authentication Center (AUC)
– Equipment Identity Register (EIR)
– Short Message Service - Gateway MSC (SMS-GMSC)
– Short Message Service– Interworking MSC (SMS-IWMSC)
– Serving GPRS Support Node ( SGSN )

- 22 - © Ericsson 2006 LZT 123 8482 R1A
– Gateway GPRS Support Node ( GGSN )
– Data Transmission Interworking unit (DTI)
– Flexible Number Register (FNR)
– Media Gateway (M-MGW)
– Combined MSC Server/Media Gateway
• Additional items possibly connected
– Mobile Intelligent Network (MIN)
– Multi Mediation (MM)
– Ericsson Multi Activation ( EMA )

1 Introduction
LZT 123 8482 R1A © 2006 Ericsson - 23 -
NETWORK NODES
BASE STATION SYSTEM (BSS) / WCDMA RADIO ACCESS NETWORK
(WCDMA RAN)
The Base Station System (BSS) and the WCDMA Radio Access
Network (WCDMA RAN) consists of the functional units
described in the following sections.
Base Station (BS)
A Base Transceiver Station (BTS) is the GSM radio equipment
required to serve one cell. It contains the antenna system, radio
frequency power amplifiers and digital signaling equipment. The
Ericsson product for the BTS is the Base Station (BS).
The system versions are:
• RBS 2000 for GSM 900, GSM 1800, and GSM 1900
• RBS 200 for GSM 900 and GSM 1800
Node B
A node B is the WCDMA SYSTEMS radio equipment required to
serve one cell. It contains the antenna system, radio frequency
power amplifiers, and digital signaling equipment.
The system versions are:
• RBS 3000 for WCDMA RAN
Base Station Controller (BSC)
The BSC controls and supervises a number of BSs and radio
connections in the system. It handles the administration of cell data
and the locating algorithm, as well as ordering handovers.
The node is based on the Ericsson Digital Switching System AXE
810 or AXE 10 switch.

- 24 - © Ericsson 2006 LZT 123 8482 R1A
Radio Network Controller (RNC)
The RNC houses radio network control functions, such as
connection establishment and release, handover, power control, and
radio resource handling functions. Diversity combining devices and
the radio link functions will also be located in the RNC.
The node is based on CPP, Ericsson’s new generic ATM switch
infrastructure, which handles packet based traffic cost effectively.
CORE NETWORK (CN)
The Core Network (CN) contains the functional units described in
the following sections.
Mobile Services Switching Center (MSC) / Mobile Services Switching
Center (MSC) Server
The MSC-S is responsible for setting up, routing, and supervising
calls to and from the mobile subscriber (mobility management,
handover,…). Short messages, routed from the SMS-GMSC or sent
from the Mobile Station (MS) / User Equipment (UE), are relayed
in the MSC.
The MSC-S is implemented using an AXE 10 or AXE 810 switch.
Gateway MSC (GMSC) / Gateway MSC (GMSC) Server
The GMSC is an MSC serving as an interface between the mobile
network and other networks, such as the Public Switched
Telephony Network (PSTN), Integrated Services Digital Network
(ISDN) and other Public Land Mobile Networks (PLMN) for
mobile terminating calls. It contains an interrogation function for
retrieving location information from the subscriber’s HLR. The
GMSC contains functions for rerouting a call to the Mobile
Subscriber according to the location information provided by the
HLR. The GMSC is implemented using an AXE 10 or AXE 810
switch. The MSC temporarily stores information about the MS/UE
currently visiting its service area.
Media Gateway (M-MGW)
The Media Gateway acts as an interface between the Core Network
using TDM, ATM and IP as transport M-MGWIS based on the CPP
platform.

1 Introduction
LZT 123 8482 R1A © 2006 Ericsson - 25 -
Combined MSC Server/Media Gateway (MSC-S/M-MGW)
The MSC-S and the M-MGW can be co-located in the same
physical GSM MSC node.
Home Location Register (HLR)
The HLR database stores and manages all mobile subscriptions
belonging to a specific operator. The HLR stores permanent data
about subscribers, including subscriber's supplementary services,
location information, and authentication parameters. When a
person buys a subscription, it is registered in the operator’s HLR.
The HLR can be implemented with the MSC or as a standalone
database.
The HLR uses Mobile Application Part (MAP) signaling towards
the other nodes (Except for PC-based AUC).
Flexible Number Register (FNR)
FNR was introduced with Ericsson’s release to provide a flexible
number function, which enables mobile operators to allocate
subscriber MSISDN freely without restricting it to the MSISDN
series, held in the HLR where the corresponding IMSI series is
held.
FNR is modified to provide the function of number portability with
GSM R7 in addition to flexible numbering.
Number portability is a network feature that allows the subscribers
to retain their MSISDN when they change their service provider
within one country, based on the agreement between different
network operators.
FNR is a database, which stores all the information needed to
perform SCCP message translation before rerouting an incoming
call to the correct HLR.
The FNR has the same platform as HLR. It can be implemented as
a standalone node or can be co-located with the other AMs
(Application Module).

- 26 - © Ericsson 2006 LZT 123 8482 R1A
Authentication Center (AUC)
The AUC database is connected to the HLR. The AUC provides the
HLR with authentication parameters and ciphering keys by
generating triplets or quintuplets depending on GSM or WCDMA
SYSTEMS Release. Using these triplets or quintuplets, ciphering
of speech, data, and signaling over the air-interface is performed.
Both provide system security.
The AUC is available as a PC or VAX-based system or as an
integrated AUC. The PC-based version is connected to the
Input/Output Group 20 (IOG20) similar to an operator terminal.
The VAX-based version uses MAP signaling and is connected via
S7 signaling links. The integrated AUC is implemented on an RPD
within the AXE 10 and can be co-located with a MSC. There is
also support for RPG/RPG2/RPG3 (apart from RPD): a new and
more powerful RP built for the new building practice BYB 501.
The RPG/RPG2/RPG3 is also more than ten times more powerful
than RPD. It is smaller and contains fewer boards.
Equipment Identity Register (EIR)
The EIR database validates mobile equipment. The MSC can
request the EIR to check if a MS/UE has been stolen (black listed),
not type-approved (gray listed), normal registered (white listed), or
unknown.
The EIR is connected to the MSC via the S7 network and uses
MAP signaling.
The EIR is implemented as a UNIX operating system or as a VAX
computer platform.
Data Transmission Interworking Unit (DTI)/GSM InterWorking Unit
(GIWU)
The DTI/GIWU provides the interface necessary for fax and data
communication.
Short Message Service - Gateway MSC (SMS-GMSC)
The SMS-GMSC routes MS/UE-terminated short messages.
For signaling to GSM and WCDMA Systems entities, MAP
signaling is used.

1 Introduction
LZT 123 8482 R1A © 2006 Ericsson - 27 -
For signaling to an Ericsson SC, an Ericsson variant of MAP is
used.
Any MSC/GMSC can be implemented as an SMS-GMSC.
Short Message Service - InterWorking MSC (SMS-IWMSC)
The SMS-IWMSC routes MS/UE-originated short messages to the
SC for delivery.
For signaling to GSM and WCDMA System entities, MAP
signaling is used.
For signaling to an Ericsson SC, an Ericsson variant of MAP is
used.
Any MSC/GMSC can be implemented as an SMS-IWMSC.
Serving GPRS Support Node - SGSN
The Serving GPRS Support Node is a primary component in the
GSM and WCDMA Systems network using GPRS. It forwards
incoming and outgoing IP packets addressed to/from a MS/UE that
is attached within the SGSN service area.
The SGSN handles packet routing and serves all subscribers that
are physically located within the geographical SGSN service area.
The (packet-switched) traffic is routed from the SGSN to the
BSC/RNC, via the BTS/node B to the User Equipment.
Gateway GPRS Support Node – GGSN
The Gateway GPRS Support Node is the second new node type,
introduced to handle GPRS connections. The GGSN handles the
interface to the external IP packet networks and acts like a router
for the IP addresses of all GPRS subscribers in the network.

- 28 - © Ericsson 2006 LZT 123 8482 R1A
ADDITIONAL NODES
Mobile Intelligent Network (Mobile IN)
Mobile IN is used in conjunction with the Public Land Mobile
Network (PLMN). It consists of service nodes that provide
advanced services to subscribers. Mobile IN functions include the
Service Switching Point (SSP) and the Service Control Point
(SCP), or a combined Service Switching and Control Point (SSCP).
The mechanism to support operator-specific services that are not
covered by standardized GSM services even while the user is
roaming outside the Home PLMN is provided by the Customized
Applications for Mobile network Enhanced Logic (CAMEL).
The SSP function determines whether the SCP function is required.
The SCP function provides the service. The SSP is typically located
in an MSC. The SCP function may be located in the SSP node or it
may be a standalone node.
SSP-SCP communication occurs via the Ericsson Intelligent
Network Application Part (INAP) protocol CS 1+. INAP CS 1+ is
compatible with the standard protocol INAP CS 1, but offers
further functions. When the SSP and SCP are co-located, INAP
messages are carried on internal AXE software signals. When the
nodes are remote, INAP messages are carried on S7 links and use
the Transaction Capabilities Application Part (TCAP) function.
An example of an advanced service provided by Mobile IN is
Virtual Private Network (VPN). The VPN service gives the
corporate customer a private numbering plan within the PLMN
network.
The Mobile IN functions are implemented on AXE 10 platforms.
Note: Mobile IN is not discussed further in this course.
Service Center (SC)
The SC receives, stores, and forwards a short message between the
message sender and the MS/UE.
Ericsson offers the SC as a combined messaging system, for
example, voice and fax on an MXE platform.

1 Introduction
LZT 123 8482 R1A © 2006 Ericsson - 29 -
Multi Mediation (MM)
The MM collects billing information, Call Data Records (CDRs),
in files from the network elements, and immediately forwards the
information to post-processing systems that use CDR files as input.
The MM acts as a billing interface to all network elements in an
Ericsson network. The flexible interface of the MM easily adapts to
new types of network elements, as well.
Ericsson Multi Activation (EMA)
The EMA connects a Customer Administrative System (CAS) and
a set of Ericsson Network Elements (NEs) to allow the CAS to
exchange service data with the NEs. It provides a safe and reliable
connection for updating the GSM and WCDMA Systems network
database and eliminates the operator’s need to create his own
interface to each of the NEs.
The EMA provides a remote interface to the HLR, the AUC, and
the EIR. This combines the subscription management functionality
of the HLR/AUC and the equipment management functionality of
the EIR.
Mobile Station (MS) / User Equipment (UE)
The MS/UE allows the subscriber to access the network through
the radio interface. It is not specified as a network node in
Ericsson’s GSM or WCDMA Systems network.
The MS (GSM) consists of:
• Mobile Equipment (ME)
The ME consists of radio processing functions and an interface to
the user and other terminal equipment.
• Subscriber Identity Module (SIM)
The SIM contains information regarding user subscription and can
be used with any MS.
The UE (WCDMA) consists of:

- 30 - © Ericsson 2006 LZT 123 8482 R1A
• Mobile Equipment (ME)
The ME consists of radio processing functions and an interface to
the user and other terminal equipment.
• WCDMA SYSTEMS Subscriber Identity Module (USIM)
The USIM contains information regarding the user subscription
and can be used with any UE.

1 Introduction
LZT 123 8482 R1A © 2006 Ericsson - 31 -
GSM AND WCDMA SYSTEMS IDENTITIES
To switch a call to a mobile subscriber, the right identifying codes
must be used. A mobile subscriber can make, receive, or forward
calls from any location within the Systems Public Land Mobile
Network (PLMN) with a high degree of security. PLMN uses more
than one addressing and numbering plan to identify different
networks.
The identities used in GSM and WCDMA Systems PLMN network
are as follows.
MOBILE STATION ISDN NUMBER (MSISDN)
The MSISDN is a number that uniquely identifies a mobile
telephone subscription within the Public Switched Telephony
Network (PSTN) numbering plan.
In GSM and WCDMA Systems the MSISDN is composed of:
MSISDN = CC + NDC + SN
• CC = Country Code
• NDC = National Destination Code
• SN = Subscriber Number
CC NDC SN
National Mobile Number
International Mobile Station ISDN Number
MSISDN=CC+NDC+SN
CC NDC SN
MSISDN=CC+NDC+SN
Figure 1-7. MSISDN in GSM and WCDMA Systems
In some particular markets, the MSISDN is composed of:
MSISDN = CC + NPA + SN
• NPA = Number Planning Area

- 32 - © Ericsson 2006 LZT 123 8482 R1A
CC NPA SN
MSISDN=CC+NPA+SN
CC NPA SN
MSISDN=CC+NPA+SN
Figure 1-8. MSISDN in some particular markets
A National Destination Code (NDC)/ Numbering Plan Area (NPA)
is allocated to each PLMN. In some countries more than one
NDC/NPA may be required for each PLMN.
The length of the MSISDN depends on the structure and operating
plan of each operator. The maximum length is 15 digits, prefixes
not included.
Each subscription is connected to one HLR.
Examples:
A Swedish PSTN subscriber calls a German subscriber.
International
prefix in Sweden
Country Code National
Destination Code
Subscriber
Number
001 49 172 2011111
Table 1-1. German subscriber
INTERNATIONAL MOBILE SUBSCRIBER IDENTITY (IMSI)
The IMSI is a unique identifying code allocated to each subscriber
allowing correct identification over the radio path and through the
GSM and WCDMA Systems PLMN network.
It is used for all identification signaling in the PLMN and all
network related subscriber information is connected to it.
The IMSI is stored in the Subscriber Identity Module (SIM,
USIM), as well as in the HLR and the MSC.
It consists of three different parts (Figure 1-9 IMSI):
IMSI = MCC + MNC + MSIN

1 Introduction
LZT 123 8482 R1A © 2006 Ericsson - 33 -
• MCC = Mobile Country Code
• MNC = Mobile Network Code
• MSIN = Mobile Subscriber Identification Number
According to the GSM and WCDMA Systems specifications, IMSI
can have a maximum length of 15 digits.
Examples:
A subscriber in the German Telecom network has the following
IMSI:
IMSI = 262 02 XXXXXXXXXX
A subscriber in the American network has the following IMSI:
IMSI = 310 011 XXXXXXXXX
MCC MNC MSIN
National MSI
IMSI
3 digits 1-2 digits (CME 20)
1-3 digits(CMS 40)
Maximum 15 digits
IMSI=MCC+MNC+MSIN
MCC MNC MSIN
National MSI
IMSI
3 digits 1-2 digits (CME 20)
1-3 digits(CMS 40)
Maximum 15 digits
IMSI=MCC+MNC+MSIN
Figure 1-9. IMSI
TEMPORARY MOBILE SUBSCRIBER IDENTITY (TMSI)
The TMSI can be used to keep subscriber information confidential
on the air interface. It also increases paging capacity, as the length
of the TMSI is shorter than the length of the IMSI.
The TMSI is relevant at the local MSC level only and is changed at
certain events or time intervals. Each local operator can define his
own TMSI structure.

- 34 - © Ericsson 2006 LZT 123 8482 R1A
The TMSI should not consist of more than four octets when used
within a Location Area (LA), for example, for paging. When a cell
within a new Location Area (LA) is entered, the Location Area
Identity (LAI) must be added to the four octets to perform a
location update.
MOBILE STATION ROAMING NUMBER (MSRN)
When a mobile terminating call is to be set up, the HLR of the
called subscriber requests the current MSC to allocate a MSRN to
the called subscriber. This MSRN is returned via the HLR to the
GMSC. The GMSC routes the call to the MSC exchange where the
called subscriber is currently registered. The routing is done using
the MSRN. When the routing is completed, the MSRN is released.
The interrogation call routing function (request for MSRN) is part
of the MAP.
All data exchanged between GMSC-HLR-MSC for the purpose of
interrogation is sent over S7 signaling.
The MSRN is built up like an MSISDN.
In GSM and WCDMA Systems, the MSRN is composed of the
following:
MSRN = CC + NDC + SN
• NDC = National Destination Code
In some particular markets the MSRN is composed of the
following:
MSRN = CC + NPA + SN
• NPA = Number Planning Area

1 Introduction
LZT 123 8482 R1A © 2006 Ericsson - 35 -
PSTN GMSC
MSC
HLR
MSISDN
MSISDN
MSRN
MSRN
IMSI
MSRN
IMSI MSRN
MSISDN IMSI MSC address
PSTN GMSC
MSC
HLR
MSISDN
MSISDN
MSRN
MSRN
IMSI
MSRN
IMSI MSRN
MSISDN IMSI MSC address
Figure 1-10. MSRN use in a network
INTERNATIONAL MOBILE EQUIPMENT IDENTITY (IMEI) AND
SOFTWARE VERSION NUMBER (IMEISV)
The IMEI uniquely identifies User Equipment (UE) as a piece or
assembly of equipment. Using the IMEI, stolen mobiles or mobile
not type-approved, causing severe malfunctions, can be barred. The
IMEI consists of 15 digits.
The IMEI consists of the following:
IMEI = TAC + FAC + SNR + sp
• TAC = Type Approval Code
• Determined by a central GSM and WCDMA Systems body,
TAC identifies the type of equipment.
• FAC = Final Assembly Code
• The FAC identifies the manufacturer of the equipment
• SNR = Serial NumbeR,
• The SNR is an individual serial number of six digits which
uniquely identifies all equipment within each TAC and FAC.
• sp = spare part for future use; this digit should always be zero
when it is transmitted by the UE
The IMEI has a total length of 15 digits.
The IMEISV consists of the following:

- 36 - © Ericsson 2006 LZT 123 8482 R1A
IMEISV = TAC + FAC + SNR + SVN
• SVN = Software Version Number
The SVN allows the mobile equipment manufacturer to identify
different software versions of given type-approved mobile
equipment.
TAC FAC SVN
SNR
IMEI
IMEISV
6 digits 2 digits 6 digits 2 digits
IMEI=TAC+FAC+SNR+SVN
TAC FAC SVN
SNR
IMEI
IMEISV
6 digits 2 digits 6 digits 2 digits
IMEI=TAC+FAC+SNR+SVN
Figure 1-11. IMEISV
LOCATION AREA IDENTITY (LAI)
The LAI, used for paging, indicates to the MSC in which location
area the MS/UE is operating. It is also used for location updating of
mobile subscribers.
The LAI contains the following (Figure 1-12. LAI):
LAI = MCC + MNC + LAC
• MCC = Mobile Country Code
• Identical to IMSI MCC
• MNC = Mobile Network Code
• Identical to IMSI MNC
• LAC=Location Area Code
The maximum length of LAC is 16 bits, enabling 65,536 different
location areas to be defined in one PLMN.
MCC MNC LAC
LAI
3 digits 1-2 digits(CME 20) Max 16 bits
1-3 digits(CMS 40)
LAI=MCC+MNC+LAC
MCC MNC LAC
LAI
1-3 digits(CMS 40)
LAI=MCC+MNC+LAC
Figure 1-12. LAI

1 Introduction
LZT 123 8482 R1A © 2006 Ericsson - 37 -
CELL GLOBAL IDENTITY (CGI)
The CGI is used for cell identification within a location area.
The CGI contains the same information as the LAI and also
includes a Cell Identity (CI). The CI has a maximum length of 16
bits.
CGI consists of (Figure 1-13):
CGI = MCC + MNC + LAC + CI
MCC MNC LAC
LAI
1-3 digits(CMS 40)
CI
Max 16 bits
CGI
CGI=MCC+MNC+LAC+CI
MCC MNC LAC
LAI
1-3 digits(CMS 40)
CI
Max 16 bits
CGI
CGI=MCC+MNC+LAC+CI
Figure 1-13. CGI
SERVICE AREA IDENTITY (SAI)
The SAI is used just to WCDMA network, it is used for cell
identification within a location area.
The SAI contains the same information as the LAI and also
includes a Service Area Code (SAC). The SAC has a maximum
length of 16 bits (see Figure 1-14. SAI)
SAI consists of:
SAI = MCC + MNC + LAC + SAC
MCC MNC LAC
LAI
1-3 digits(CMS 40)
Max 16 bits
Service Area Identity
SAC
MCC MNC LAC
LAI
1-3 digits(CMS 40)
Max 16 bits
Service Area Identity
SAC
Figure 1-14. SAI

- 38 - © Ericsson 2006 LZT 123 8482 R1A
ADDRESSING THE SWITCHING SYSTEM ENTITIES
GLOBAL TITLE (GT)
A Global Title (GT) is an identifying code, such as dialed digits,
which does not explicitly contain information that allows routing in
the signaling network. This requires the Signaling Connection
Control Part (SCCP) translation function, which is described in the
SCCP chapter.
The GT is used for addressing signaling information.
Different numbering plans are used to distinguish different
networks.
• E.164 is the numbering plan for PSTN/ISDN
• E.212 is the numbering plan for GSM and WCDMA Systems
PLMN
Each network entity is identified by its international PSTN/ISDN
number, that is, its own command defined address which has the
following structure:
Example: E.164: CC + NDC(or NPA) + SN
The CC, NDC, and SN identify the node within the whole GSM
and WCDMA Systems, as well as the entity. Entities include the
HLR, MSC, EIR, and AUC.
Refer to the SCCP chapter for more information.
During an incoming call to a mobile subscriber, the GMSC
analyzes the MSISDN to locate the appropriate HLR. The digits in
the Subscriber Number (MSISDN) are used for the signal routing
to the HLR.

1 Introduction
LZT 123 8482 R1A © 2006 Ericsson - 39 -
MOBILE GLOBAL TITLE (MGT)
When a MS/UE is powered on in a PLMN, the MSC must
communicate with the MS’s/UE’s HLR to perform location
updating. The only data available in the MSC for the SCCP
addressing of the HLR is the IMSI number. However, for signaling
in the international PSTN/ISDN network, IMSI cannot be used.
Thus, it is necessary to convert the IMSI number in the MSC into a
Global Title (GT), which enables routing of the S7 signaling to the
proper HLR. This converted number is called the Mobile Global
Title (MGT).
Structure of the MGT
The MGT is of variable length and is composed of decimal digits
arranged in two specific parts. These specific parts are E.164 and
E.212. Together they form E.214.
The E.164 part is used to identify the home country and the home
PLMN of the mobile subscriber.
The E.212 part is used to identify the HLR where the mobile
subscriber is registered and is composed of the Mobile Subscriber
Identification Number (MSIN).
E.164 part E.212 part
MGT=E.214
NDC/NPA
CC MSIN
MGT=CC+NDC/NPA+MSIN
CC=Country as defined recommendation E.164
NDC=National Destination Code
NPA=Numbering Plan Area
MGT=Mobile Global Title
MSIN=Mobile Subscriber Identification Number
MGT=E.214
NDC/NPA
CC MSIN
MGT=CC+NDC/NPA+MSIN
MGT=E.214
NDC/NPA
CC MSIN
MGT=CC+NDC/NPA+MSIN
CC=Country as defined recommendation E.164
NDC=National Destination Code
NPA=Numbering Plan Area
MGT=Mobile Global Title
MSIN=Mobile Subscriber Identification Number
Figure 1-15. Structure of MGT

- 40 - © Ericsson 2006 LZT 123 8482 R1A
Derivation of the MGT
The MGT is derived from the IMSI as follows:
1 The CC is derived directly from the MCC.
2 The NDC is derived either from the MNC or from the MNC
and some initial digits of the MSIN.
3 The MSIN is mapped directly into the MGT up to its maximum
length.
This translation is performed during the IMSI analysis in the MSC.
It is initiated via commands.
MCC MNC MSIN
CC NDC/NPA MSIN
translated
translated
translated
IMSI
MGT
MCC=Mobile Country Code
MNC=Mobile Network Code
MCC MNC MSIN
CC NDC/NPA MSIN
translated
translated
translated
IMSI
MGT
MCC=Mobile Country Code
MNC=Mobile Network Code
Figure 1-16. Derivation of the MGT from the IMSI

1 Introduction
LZT 123 8482 R1A © 2006 Ericsson - 41 -
CORE NETWORK PROTOCOLS IN MSS ARCHITECTURE
Just as the horizontally integrated network model demands the
splitting of nodes into Servers and M-MGWs, there is also a need
for separation of control protocols into call control and bearer
control.
In STM based PLMN and PSTN networks, call control and bearer
control are intrinsically linked. If, for example, B-number analysis
and routing analysis (call control functions) suggest a certain route,
the route is explicitly associated (via CIC values) with physical
circuits of know characteristics. Independent bearer control is not
required.
In horizontally integrated networks, control servers at the control
layer will select M-MGWs at both edges of the network (based on,
for example, B-numbers), but it is entirely up to the connectivity
layer to establish a connection between M-MGWs.
The connectivity network needs its own control protocols to enable
the establishment of bearers across the Core Network. This is
referred to as bearer control.
Call Control
At the control layer, there are two main requirements:
• The control servers (also known as Media Gateway
Controllers) must be able to control remote M-MGWs
• Control servers must be able to communicate call requirements
to each other so that calls may be set up end-to-end

- 42 - © Ericsson 2006 LZT 123 8482 R1A
MS
UE
WCDMA
RAN
Control Layer
Connectivity Layer
bearer/connectivity network
GMSC/
TSC
MGW
MGW
MGW
MGW
MSC
GCP GCP
BICC
Call Control
HLR MAP
MAP
ISDN
RNC
RNC
GCP
RANAP ISUP
GSM
RAN
BSC
BSSAP
MS
UE
WCDMA
RAN
Control Layer
Connectivity Layer
GMSC/
TSC
MGW
MGW
MGW
MGW
MSC
GCP GCP
BICC
Call Control
HLR MAP
MAP
ISDN
RNC
RNC
GCP
RANAP ISUP
GSM
RAN
BSC
BSSAP
WCDMA
RAN
Control Layer
Connectivity Layer
GMSC/
TSC
MGW
MGW
MGW
MGW
MSC
GCP GCP
BICC
Call Control
HLR MAP
MAP
ISDN
RNC
RNC
GCP
RANAP ISUP
GSM
RAN
BSC
BSSAP
WCDMA
RAN
Control Layer
Connectivity Layer
GMSC/
TSC
MGW
MGW
MGW
MGW
MSC
GCP GCP
BICC
Call Control
HLR MAP
MAP
ISDN
RNC
RNC
GCP
RANAP ISUP
GSM
RAN
BSC
BSSAP
Figure 1-17. Protocols used in the GSM and WCDMA Systems Core
Network.
GCP is required in any Ericsson network implementation that
utilizes the MSS – Mobile Soft Switch architecture. It is used for
both WCDMA Systems and GSM calls. GCP is used to order
bearer establishment and to control remote resources such as echo
cancellers, tone senders/receivers, announcement devices,
transcoders, Data Transmission Interfaces (DTIs), and so on.
The second requirement is met using Bearer Independent Call
Control (BICC) based ITU-T’s BICC CS2. The BICC protocol is
used to pass call control information such as the B-number and
service requirements between control servers. Additionally BICC
carries bearer-related information and the ID of selected M-MGWs
to the succeeding server for M-MGW selection and bearer
establishment purposes.
The signaling between the server nodes and other control nodes
(for example MAP, CAP) can use either IP, ATM or TDM as a
bearer. This also applies for MAP signaling between two MSCs
Bearer control
In the connectivity layer, different standards are used for bearer
control. In a TDM based Core Network standard Narrowband ISUP
(N-ISUP) is used for bearer control. If the Core Network is
ATM/AAL2 based, Q.AAL2 (Q.2630) is used. The IP Bearer
control protocol (IPBCP) is utilized in an IP based Core Network.

1 Introduction
LZT 123 8482 R1A © 2006 Ericsson - 43 -
Access Control
Control servers in the Core Network are responsible for various
aspects of communication with Mobile Station (MS) User
Equipment (UE), Base Station Controller (BSC), Radio Network
Controllers (RNCs) and external networks (see Figure 1-18). The
Base Station System Application Part (BSSAP)is used by MSC’s to
control BSC’s.
The Radio Access Network Application Part (RANAP) is used by
MSCs to control RNCs.
For call setup, the Direct Transfer Application Part (DTAP) is used
between the MSC Server and the MS/UE. At the BSC or RNC,
DTAP messages are encapsulated as BSSAP or RANAP Non-
Access Stratum messages, before being forwarded to the MSC.
The ISDN User Part (ISUP) is used between the Core Network and
ISDN/PSTN/PLMN networks.
Control
Layer
Connectivity
Layer
GMSC/
TSC
MGW
MGW
MGW
MGW
MSC
HLR
ISUP
ISDN
RNC
BSC
DTAP
RANAP
BSSAP
DTAP
Control
Layer
Connectivity
Layer
GMSC/
TSC
MGW
MGW
MGW
MGW
MSC
HLR
ISUP
ISDN
RNC
BSC
DTAP
RANAP
BSSAP
DTAP
Control
Layer
Connectivity
Layer
GMSC/
TSC
MGW
MGW
MGW
MGW
MSC
HLR
ISUP
ISDN
RNC
BSC
DTAP
RANAP
BSSAP
DTAP
Figure 1-18. Access signaling in Ericsson GSM/ WCDMA Systems
implementations
Note: RANAP, BSSAP and ISUP do not need to physically go
through M-MGW

- 44 - © Ericsson 2006 LZT 123 8482 R1A
BEARER INDEPENDENT CALL CONTROL (BICC)
General
When the ITU first developed the ISDN User Part (ISUP), voice
networks were almost exclusively based on the vertically integrated
network model. As a result, SS7 ISUP incorporates both call and
bearer signaling. This is unsuitable in the context of horizontally
integrated networks.
The solution to this problem is a modified version of ISUP that
overcomes ISUP limitations to make it truly transport-network
(bearer) independent. The result of this effort, undertaken by the
ITU-T is the Bearer Independent Call Control protocol (BICC).
Because of the separation of call signaling and bearer signaling,
BICC can be used in combination with any type of packet network,
for example ATM, or others.
The BICC protocol allows us to offer the complete set of
PSTN/ISDN services, including all supplementary services, over a
variety of packet networks.
Although BICC is an adaptation of ISUP, BICC and ISUP are not
peer-to-peer compatible. A conscious effort was made during the
development of BICC to keep the two protocols as closely aligned
as possible, to avoid extensive inter-work requirements.
Control Layer
Connectivity Layer
MGW
MGW
MGW
MGW
Control
Server
To Access
Network/s
Control
Server
Control
Server
BICC BICC
Access
Signaling
Access
Signaling
Control Layer
Connectivity Layer
MGW
MGW
MGW
MGW
Control
Server
To Access
Network/s
Control
Server
Control
Server
BICC BICC
Access
Signaling
Access
Signaling
Figure 1-19. General use of BICC
BICC is used between Control Servers such as the MSC and the
TSC as in Figure 1-19.

1 Introduction
LZT 123 8482 R1A © 2006 Ericsson - 45 -
Bearer Setup Direction
BICC call setup procedures may be classified according to the
direction of the bearer set-up relative to the direction of call setup.
If the bearer is established in the same direction as the call setup
(that is, from the Initial address message (IAM) sender to the IAM
receiver) as in Figure 1-20, the bearer setup is said to be in the
forward direction.
ISN-A
CSF-N
BCF-N
TSN
CSF-T
BICC
SWN-1
BCF-R
SWN-2
BCF-R BCF-T
Call Set-up (IAM)
Bearer Set-up
ISN-A
CSF-N
BCF-N
TSN
CSF-T
BICC
SWN-1
BCF-R
SWN-2
BCF-R BCF-T
Call Set-up (IAM)
Bearer Set-up
Figure 1-20. Forward Bearer Setup
If the bearer is set up in the opposite direction to the call setup as in
Figure 1-21, then the bearer setup is said to be in the backward
direction.
ISN-A
CSF-N
BCF-N
TSN
CSF-T
BICC
SWN-1
BCF-R
SWN-2
BCF-R BCF-T
Call Set-up (IAM)
Bearer Set-up
ISN-A
CSF-N
BCF-N
TSN
CSF-T
BICC
SWN-1
BCF-R
SWN-2
BCF-R BCF-T
Call Set-up (IAM)
Bearer Set-up
Figure 1-21. Backward Bearer Setup

- 46 - © Ericsson 2006 LZT 123 8482 R1A
When is a CIC not a CIC? - Call Instance Codes
In an N-ISUP network, each PCM bearer channel is allocated a
Circuit Identification Code (CIC). At call setup, an incoming and
outgoing circuit is seized and the respective CIC values are
associated with a call instance within each node (for example, in an
RE individual in AXE10). Since the bearer resource (and hence the
CIC value) is the same at each end of the transmission link, the
CIC can be said to uniquely associate the call instances in both
nodes. That is, when sending SS7 messages, a CIC value is
sufficient information to identify the call instance to which the
message belongs. The ISUP specification states that.
The CIC in ISUP, in conjunction with the OPC/DPC/NI
combination serves two purposes:
• Identification of the physical circuits.
• Identification of the signaling relation between the peer ISUP
entities and association of all signaling messages to that
relation.
CI CIC
7
513
CIC CI
728
7
CI 513 CI 728
Circuit CIC=7
SETUP CIC=7
MGW MGW
Control
Server
Control
Server
CI CIC
7
513
Call CIC=7
CEID or VPI/VCI
Mapping
Mapping Mapping
CIC CI
728
7
Mapping
CBC SIG
CBC SIG
LE LE
CI CIC
7
513
CI CIC
7
513
CIC CI
728
7
CIC CI
728
7
CI 513 CI 728
Circuit CIC=7
SETUP CIC=7
SETUP CIC=7
MGW MGW
Control
Server
Control
Server
CI CIC
7
513
CI CIC
7
513
Call CIC=7
CEID or VPI/VCI
Mapping
Mapping Mapping
CIC CI
728
7
CIC CI
728
7
Mapping
CBC SIG
CBC SIG
LE LE
CI CIC
7
513
CIC CI
728
7
CI 513 CI 728
Circuit CIC=7
SETUP CIC=7
MGW MGW
Control
Server
Control
Server
CI CIC
7
513
Call CIC=7
CEID or VPI/VCI
Mapping
Mapping Mapping
CIC CI
728
7
Mapping
CBC SIG
CBC SIG
LE LE
CI CIC
7
513
CI CIC
7
513
CIC CI
728
7
CIC CI
728
7
CI 513 CI 728
Circuit CIC=7
SETUP CIC=7
SETUP CIC=7
MGW MGW
Control
Server
Control
Server
CI CIC
7
513
CI CIC
7
513
Call CIC=7
CEID or VPI/VCI
Mapping
Mapping Mapping
CIC CI
728
7
CIC CI
728
7
Mapping
CBC SIG
CBC SIG
LE LE
Figure 1-22. Circuit Identification Code / Call Instance Code
The horizontally integrated network architecture does not allow the
notion of a physical circuit in the same way as SS7, yet the call
instances in each node must still be associated with each other in
order to relate signaling messages to specific calls. For this reason,
the Call Instance Code is defined.

1 Introduction
LZT 123 8482 R1A © 2006 Ericsson - 47 -
The Call Instance Code can be thought of as a “virtual” SS7 CIC –
it does not correspond directly to a physical circuit, yet it ties
together the call instances in each node. Unlike the SS7 CIC, the
BICC CIC is four full octets in length. The total number of
provisioned CIC values for any particular signaling association
indicates the maximum number of signaling relations between the
BICC peer entities; that is, the maximum number of BICC calls
that can be simultaneously handled between two adjacent control
servers.
The actual association between the call instance and the bearer is
handled by the Mapping Function.
It should be noted that where M-MGWs peer with TDM / ISUP
based vertically integrated networks, Circuit Identification Codes
and physical circuits are still used on the access side.
H.248 - GATEWAY CONTROL PROTOCOL (GCP)
The MSS architecture in horizontally integrated networks
necessitates the use of a protocol for remote control of M-MGWs
by control servers. GCP was developed for this purpose.
Control Layer
Connectivity Layer
MGW
BICC
Call Control
MGW
H.248/GCP
MGC MGC
H.248/GCP
Commands
Slave
Master
Slave
Master
Commands
Control Layer
Control Layer
Connectivity Layer
MGW
BICC
Call Control
MGW
H.248/GCP
MGC MGC
H.248/GCP
Commands
Slave
Master
Slave
Master
Commands
Figure 1-23. The use of H.248/GCP in horizontally integrated networks
GCP operates in a master-slave configuration. Control servers, or
Media Gateway Controllers (MGCs) as they are called in H.248,
act as masters while M-MGWs act as slaves (see Figure 1-23).

- 48 - © Ericsson 2006 LZT 123 8482 R1A
GCP is used between the Server and Media Gateway. The GCP
protocol is used by the Call Server to control remote resources and
requests bearer/media related services from the Media Gateway.
That is, to control network access resources, to create connections
between network access resources, and to insert devices (for
example, announcement machine) into the media stream. The C-M-
MGw can control the load by asking the MSC Server to reduce
traffic in case of over load.
M-MGWs enact MGC commands and usually respond with
notifications. This network architecture minimizes the impact on
the control layer when changing the transmission technology.
The Gateway Control Protocol uses MTP3b over AAL5 over ATM
or M3UA over SCTP (Stream Control Transmission Protocol) over
IP as the transport bearers.
GCP signaling in this release is based on ITU-T H.248 V2.
SIGNALING OVER ATM
The protocol stack used for SS7 user part transport over the
broadband ATM architecture is shown in Figure 1-24. The
narrowband protocol is included for comparison
TCAP
MAP/CAP/
INAP
SCCP
GCP
GCP
SAAL-NNI
ATM
SDH
MAP/CAP
BICC
BICC
N-ISUP
N- ISUP
MTP3b
SAAL-NNI
ATM
SDH
SAAL-NNI
ATM
SDH
MTP3b MTP3b
MTP2
MTP1
MTP3
TCAP
MAP/CAP/
INAP
SCCP
GCP
GCP
SAAL-NNI
ATM
SDH
MAP/CAP
BICC
BICC
N-ISUP
N- ISUP
MTP3b
SAAL-NNI
ATM
SDH
SAAL-NNI
ATM
SDH
MTP3b MTP3b
MTP2
MTP1
MTP3
TCAP
MAP/CAP/
INAP
SCCP
GCP
GCP
SAAL-NNI
ATM
SDH
MAP/CAP
BICC
BICC
N-ISUP
N- ISUP
MTP3b
SAAL-NNI
ATM
SDH
SAAL-NNI
ATM
SDH
MTP3b MTP3b
MTP2
MTP1
MTP3
TCAP
MAP/CAP/
INAP
SCCP
GCP
GCP
SAAL-NNI
ATM
SDH
MAP/CAP
BICC
BICC
N-ISUP
N- ISUP
MTP3b
SAAL-NNI
ATM
SDH
SAAL-NNI
ATM
SDH
MTP3b MTP3b
MTP2
MTP1
MTP3
Figure 1-24. Broadband and Narrowband SS7 protocol stacks
A brief description of each of the layers follows:

1 Introduction
LZT 123 8482 R1A © 2006 Ericsson - 49 -
SDH
Synchronous Digital Hierarchy (SDH) is an optical fiber
technology that provides high bandwidth voice and data transport.
It was primarily designed to carry multiplexed speech trunks, but it
is also suitable for the transport of ATM cells (or any other data
packets). Although SDH specifies a frame format, it does not
provide any higher layer functionality such as reliable transport and
flow control. To the user, SDH provides what is effectively a high
speed “wire”. Current SDH bit rates fall between 155 Mbps and 10
Gbps per link. (It should be noted that a technology called Dense
Wavelength Division Multiplexing (DWDM) allows several SDH
links to be multiplexed onto a single fiber.)
ATM
Asynchronous Transfer Mode (ATM) networks are designed to
transport data in 53 octet cells and are connection-oriented; that is,
a connection (corresponding to a fixed route and reserved
resources) must be established before data transfer can take place.
Data is guaranteed to arrive in sequence. Public ATM networks
typically use SDH as the transport technology.
SAAL-NNI
The ATM Adaptation Layer for Signaling on the Network-to-
Network Interface, (SAAL-NNI) is made up of several sublayers,
conforming to standard ATM design. It is responsible for
performing most of the MTP-2 equivalent functionality such as
reliable SP-to-SP transport, flow control, and so on.
MTP-3B
MTP-3B is the broadband equivalent of MTP-3, performing
network layer functions in the broadband architecture. MTP-3B
supports SS7 Signaling Point (SP) functionality in a manner that is
almost identical to MTP-3.

- 50 - © Ericsson 2006 LZT 123 8482 R1A
Q.2630
Since AAL2 involves an additional layer of multiplexing, an AAL2
LLC needs to be established before user communication can take
place. This involves negotiating a common CID value as well as
specifying various traffic parameters that allow AAL2 to take
advantage of the underlying ATM QoS. This negotiation is the role
of Q.2630.
In formal terms, Q.2630 is a bearer independent signaling protocol
used to establish, release and maintain dynamic, on-demand AAL2
LLCs between AAL2 Service Endpoints. It does not perform call
control functionality; this is left to other entities.
MTP-1
The SS7 physical layer is MTP-1.The following physical layers are
supported
64 Kbps PCM time slots on EE1 physical connections
56 Kbps PCM time slots on T1 physical connections
MTP-2
The data link layer is MTP-2. Both the basic and preventative
cyclic methods for error correction are supported. The supported
features include.
Processor outage handling
Normal and emergency initial alignment
Flow Control
MTP-3
MTP-3 is the SS7 network layer. It provides load sharing between
different redundant links in the same or different set

1 Introduction
LZT 123 8482 R1A © 2006 Ericsson - 51 -
SS7 SIGNALLING OVER IP (SIGTRAN)
The SS7 Signaling over IP feature allows SS7 signaling messages
to be carried on an IP bearer.
TCAP
MAP/CAP/
INAP
SCCP
M3UA
SCTP
IP
GCP
GCP
SCTP
IP
LL
MAP/CAP
LL
BICC
SCTP
IP
LL
BICC
M3UA
N-ISUP
SCTP
IP
LL
N-ISUP
M3UA
M3UA
TCAP
MAP/CAP/
INAP
SCCP
M3UA
SCTP
IP
GCP
GCP
SCTP
IP
LL
MAP/CAP
LL
BICC
SCTP
IP
LL
BICC
M3UA
N-ISUP
SCTP
IP
LL
N-ISUP
M3UA
M3UA
Figure 1-25. SIGTRAN protocol stacks
An existing IP backbone can be used also as signaling network,
thus simplifying the overall transport solution. IP as a bearer of
SS7 signaling also allows the signaling network to use bandwidth
in a more efficient way than in a TDM based solution. Signaling
network capacity is also easy to increase in an IP based network.
The SS7 Signaling over IP feature uses the SIGTRAN protocols
M3UA (Message Transfer Part 3 – User Adaptation Layer) and
SCTP, defined by the IETF, to provide an IP based SS7 signaling
network.
M3UA allows MTP L3 messages to be carried over an IP network.
A part of the functionality of M3UA is network management
mechanisms, comparable to similar functions in MTP L3. The
Ericsson implementation is based on IETF M3UA (RFC 3332) and
3GPP TS 29.202 v4.3.0. Additionally, Ericsson has specified a
number of extensions in order to support signaling scenarios not
covered in RFC 3332. An example of such a scenario is SGW to
SGW communication.

- 52 - © Ericsson 2006 LZT 123 8482 R1A
SCTP
Stream Control Transmission Protocol (SCTP, IETF RFC3309) is
designed to transport PSTN signaling messages over IP networks.
It is a reliable transport protocol operating on top of a connection
less packet network such as IP. It offers the following services to its
users:
• Acknowledged error-free non-duplicated transfer of user data.
• Data fragmentation to conform to the discovered path MTU
size.
• Optional bundling of multiple user messages into a single
SCTP packet.
• Network-level fault tolerance through supporting of multi-
homing at either or both ends of an association.
• Congestion avoidance behavior and resistance to flooding and
masquerade attacks.
The connection between two nodes is called an SCTP association
and can consist of multiple paths through an IP network. If the
primary path becomes unavailable, one of the other available paths
is used. Availability of paths is monitored using a heartbeat
mechanism. An association can support multiple streams. A stream
can be seen as an independent communication channel in the sense
that a retransmission on one stream doesn’t stop or slow down the
traffic in another stream. Within a stream, the order of transmitted
messages can be guaranteed.
M3UA
When two signaling endpoints, which support both IP as signaling
bearer, exchange signaling information the M3UA protocol is used.
In this case the M3UA layer provides the same set of primitives
and services at its upper layer as the MTP3. The procedures to
support these services are a subset of the MTP3 procedures. MSC
and TSC servers are still addressed by Signaling Point Code (SPC)
and Network Indicator (NI). Redundancy on M3UA level for a
connection between two nodes can be achieved by specifying
parallel SCTP associations.

1 Introduction
LZT 123 8482 R1A © 2006 Ericsson - 53 -
IPBCP
IP Bearer Control Protocol (IPBCP) information is transferred
between the M-MGW’s through specified tunneling mechanisms
through MSC server nodes.
The call control protocol, BICC (Bearer Independent Call Control),
and the Gateway Control Protocol (GCP) support the transfer of the
IPBCP, as shown in Figure 1-26 on the right side. This figure also
shows a comparison between the bearer control in IP and ATM
based core networks.
Server
Server
MGW
MGW
ATM user plane
BICC msg.
GCP
msg.
GCP
msg.
Server
Server
MGW
MGW
IP user plane
BICC msg.
GCP
GCP
Q.IPBCP messages
tunneled via GCP
messages
Q.IPBCP messages
tunneled via BICC CS2
messages
BICC with ATM Bearer BICC with IP Bearer
Q.AAL2msg.
Server
Server
MGW
MGW
ATM user plane
BICC msg.
GCP
msg.
GCP
msg.
Server
Server
MGW
MGW
IP user plane
BICC msg.
GCP
GCP
Q.IPBCP messages
tunneled via GCP
messages
Q.IPBCP messages
messages
Q.AAL2msg.
Server
Server
MGW
MGW
ATM user plane
BICC msg.
GCP
msg.
GCP
msg.
Server
Server
MGW
MGW
Server
Server
MGW
MGW
ATM user plane
BICC msg.
GCP
msg.
GCP
msg.
Server
Server
MGW
MGW
IP user plane
BICC msg.
GCP
GCP
Q.IPBCP messages
tunneled via GCP
messages
Q.IPBCP messages
messages
BICC with ATM Bearer
IP user plane
BICC msg.
GCP
GCP
Q.IPBCP messages
tunneled via GCP
messages
Q.IPBCP messages
messages
Q.AAL2msg.
Server
Server
MGW
MGW
ATM user plane
BICC msg.
GCP
msg.
GCP
msg.
Server
Server
MGW
MGW
BICC with IP Bearer
Q.AAL2msg.
Server
Server
MGW
MGW
ATM user plane
BICC msg.
GCP
msg.
GCP
msg.
Server
Server
MGW
MGW
IP user plane
BICC msg.
GCP
GCP
Q.IPBCP messages
tunneled via GCP
messages
Q.IPBCP messages
messages
Q.AAL2msg.
Figure 1-26. IPBCP tunneling
The bearer control messages are tunneled over the GCP and BICC
protocols. The IPBCP is used for the exchange of media stream
characteristics, port numbers and IP addresses of the source and
sink of a media stream to establish the IP bearers. IPBCP uses the
text based SDP (Session Description Protocol) to encode this
information.
The MSC Server supports the Delayed Backward bearer set-up
procedure and the Delayed Forward bearer set-up procedure on the
server’s incoming and outgoing side for IP bearer establishment.
The MSC Server supports also Fast Forward bearer set-up
procedure on the server’s incoming side for IP bearer
establishment. The MSC Server never initiates a request for Fast
Forward set-up procedure, but supports it due to multi-vendor
inter-working within the same PLMN.

2 Message Transfer Part
LZT 123 8482 R1A © 2006 Ericsson - 55 -
Objectives:
Explain the MTP network and briefly detail the MTP
functions.
ƒ Use MML printout commands to obtain a view of the MTP
configuration and use the Active Library Explorer to interpret the
results.
ƒ Set up MTP definitions in exchange data as outlined in the
Customer Product Information CPI and training material
ƒ Explain the function of High Speed Signaling Links
ƒ Explain the SS7 signaling over IP concept
Figure 2-1. Objectives

LZT 123 8482 R1A © 2006 Ericsson - 57 -
MESSAGE TRANSFER PART (MTP)
INTRODUCTION
The signaling between the nodes in a GSM/WCDMA network
requires a powerful signaling system to exchange information.
Powerful signaling is needed to perform call control signaling and
other types of information transfer between different exchanges.
The International Telecommunications Union-Telecommunications
Standards Sector (ITU-T) Signaling System No.7 (SS No.7)
provides an internationally standardized, general-purpose Common
Channel Signaling (CCS) system that can support different
applications, including Public Switched Telephony Network
(PSTN), Integrated Services Digital Network (ISDN), Global
System for Mobile Communication (GSM), and WCDMA.
This is possible, due to its various functional elements, such as
Message Transfer Part (MTP), Signaling Connection Control Part
(SCCP), Telephony User Part (TUP), ISDN User Part (ISUP) and
Mobile Application Part (MAP).
Note: International Telecommunications Union (ITU)
recommendations for SS No.7 are the Q.7xx-series.
Henceforth, the ITU Signaling System number 7 and ANSI
Signaling System 7 are referred to as SS7, if common functions of
both signaling systems are described.
In Japan, the TTC (Telecommunication Technology Committee)
has defined a specific variant referred to as J7.
MTP is the SS7/J7 function that provides the common platform
between the different user parts and functional elements. The figure
2-2 illustrates this relationship

- 58 - © Ericsson 2006 LZT 123 8482 R1A
MTP
Dusseldorf
TUP
ISUP
SCCP
MTP
Berlin
TUP
ISUP
SCCP
MTP
Dusseldorf
TUP
ISUP
SCCP
MTP
Dusseldorf
TUP
ISUP
SCCP
MTP
Berlin
TUP
ISUP
SCCP
MTP
Berlin
TUP
ISUP
SCCP
Figure 2-2. Signaling System N° 7
The Signaling System No.7 messages between MSC and RNC will
be transported over ATM. Therefore a new common platform
(MTP) is defined to interconnect MSC and UTRAN. The Signaling
ATM Adaptation Layer (SAAL) and the ATM Layer protocol are
used.
SS7 APPLICATIONS
MTP3
MTP3b
M3UA
MTP2
SSCF
SCTP
MTP1 (64k)
SSCOP
AAL5/ATM
IP
ETH STM-1
SIGTRAN SS7 BROADBAND SS7 NARROWBAND
SS7 APPLICATIONS
MTP3
MTP3b
M3UA
MTP2
SSCF
SCTP
MTP1 (64k)
SSCOP
AAL5/ATM
IP
ETH STM-1
SIGTRAN SS7 BROADBAND SS7 NARROWBAND
Figure 2-3. Protocol Stack of Signaling System N° 7
SSCF, SSCOP and AAL5 are also called SAAL – Signaling ATM
Adaptation Layer.
SSCF: Service Specific Co-ordination Function Q.2140
SSCOP: Service Specific Connection Oriented Protocol Q.2110

LZT 123 8482 R1A © 2006 Ericsson - 59 -
AAL5: ATM Adaptation Layer, type 5 I.363
EXAMPLE
In this example, the Signaling ATM Adaptation Layer (SAAL) and
the ATM Layer protocol are not treated; only the SS7 signaling
over the MTP part is concerned.
A telecommunication network, for example, a PLMN served by a
CCS system is composed of a number of switching and processing
nodes, interconnected by transmission links. To communicate using
SS7, each of these nodes has the necessary “within node” features,
for example, exchange data. This section provides an overview of
MTP from an Operatio120n standpoint. To explain MTP, an
example and relevant exchange data printouts are used (see Figure
2-4).
Note1: The major focus of this chapter is on basic SS7 exchange
data. Therefore, the example does not show SS7 supervision data.
Note2: The printouts, illustrated in this example, are exclusively
made in the switching node Düsseldorf.
Berlin
Hamburg
Other
Network
Other
Network
RNC BSC
RNC
BSC
RNC
BSC
Integrated MSC
GMSC/HLR
Traffic
Signaling
Dusseldorf
Berlin
Hamburg
Other
Network
Other
Network
RNC BSC
RNC
BSC
RNC
BSC
Integrated MSC
GMSC/HLR
Traffic
Signaling
Dusseldorf
Figure 2-4. Example

- 60 - © Ericsson 2006 LZT 123 8482 R1A
PREREQUISITES
The PLMN in this example consists of three switching nodes,
Düsseldorf, Hamburg, Berlin, interconnected by transmission, or
traffic and signaling links. Each node is integrated using the
Gateway Mobile services Switching Center (GMSC), Home
Location Register (HLR), Mobile services Switching Center
(MSC), and Visitor Location Register (VLR) on the AXE platform.
Each switching node has one BSC or RNC connected. Düsseldorf
is the gateway to other national and international networks.
The direct path between two cities, for example, Düsseldorf –
Hamburg, is preferred. An indirect route, for example, Düsseldorf –
Berlin – Hamburg, is the second alternative.
ANALOGY BETWEEN CALLS AND S7 MESSAGES
The “sequence” of handling a call is similar to that of an SS7
message.
Figure 2-5 provides an overview of the similarities in the early
stages of the sequence.
CALL:
SS7
MESSAGE:
A - No (SENDER ID)
B - No (RECEIVER ID)
OWN SP
SP
RC ROUTE DEVICES
ETC
(HW)
TERMINATING
TERMINATING
DEST LS SLC
SIGNALING
TERMINAL (HW)
CALL:
SS7
MESSAGE:
A - No (SENDER ID)
OWN SP
SP
RC ROUTE DEVICES
ETC
(HW)
TERMINATING
TERMINATING
DEST LS SLC
SIGNALING
TERMINAL (HW)
CALL:
SS7
MESSAGE:
A - No (SENDER ID)
OWN SP
SP
RC ROUTE DEVICES
ETC
(HW)
TERMINATING
TERMINATING
DEST LS SLC
SIGNALING
TERMINAL (HW)
Figure 2-5. Analogy between Calls and an SS7 Message
SIGNALING POINT
In a node, a signaling message is originated, terminated, or
transferred. Instead of using an A and a B number, the signaling
method uses an address called a Signaling Point (SP). See Figure 2-
6.
Each node has its own address, called OWNSP, for example,
OWNSP for Düsseldorf = 2-6017. See Figure 2-6 and Figure 2-7.

LZT 123 8482 R1A © 2006 Ericsson - 61 -
Each node in a network must know all its potential receivers
(cooperating SPs). In this example, Düsseldorf knows the SPs
(receiver addresses) for Hamburg and Berlin, and for at least one
address in the other network(s).
SP = 2-6050
SPID = HAMBMSC
SP = 2-6113
SPID = BRLMSC
OWNSP = 2-6017
SPID = DUDMSC
OWNSP = 0-1007
SPID = DUDMSC
SP = 2-6025
SPID = DUDBSC
SP = 0-1111
SPID = OTHER
SP = 2-6026
SPID = DUDRNC
Berlin
Hamburg
Other
Network
Other
Network
RNC BSC
RNC
BSC
RNC
BSC
Integrated MSC
GMSC/HLR
Traffic
Signaling
Dusseldorf
SP = 2-6050
SPID = HAMBMSC
SP = 2-6113
SPID = BRLMSC
OWNSP = 2-6017
SPID = DUDMSC
OWNSP = 0-1007
SPID = DUDMSC
SP = 2-6025
SPID = DUDBSC
SP = 0-1111
SPID = OTHER
SP = 2-6026
SPID = DUDRNC
Berlin
Hamburg
Other
Network
Other
Network
RNC BSC
RNC
BSC
RNC
BSC
Integrated MSC
GMSC/HLR
Traffic
Signaling
Dusseldorf
Figure 2-6. The Network and the Signaling Points (SPs)
On the Mobile Switching Center (MSC) – Base Station Controller
(BSC) or Radio Network Controller (RNC) link, the network also
uses SS7. Therefore, the DUDMSC switching node knows the SP
for DUDBSC or DUDRNC. It does not know the SP for BSC
(Berlin) or RNC (Berlin) and BSC (Hamburg) or RNC (Hamburg)
because Düsseldorf will never send an SS7 message to one of these
BSC’s or RNCs, according to the GSM/WCDMA specification.
Normally, a Signaling Point IDentifier (SPID) is tied to an SP.

- 62 - © Ericsson 2006 LZT 123 8482 R1A
<C7SPP:SP=ALL;
CCITT7 SIGNALING POINT DATA
SP SPID
0-1007 OWNSP DUDMSC
0-1111 OTHER
2-6017 OWNSP DUDMSC
2-6025 DUDBSC
2-6026 DUDRNC
2-6050 HAMBMSC
2-6113 BRLMSC
END
Figure 2-7. Signaling Points (SPs) in Düsseldorf
The SP is identified by the Network Indicator (NI) and the
Signaling Point Code (SPC), [SP=NI-SPC].
In Figure 2-7, the network indicator distinguishes between the
different networks, national and international. The Düsseldorf node
has two OWNSPs, one for “internal” PLMN (2-6017) usage, and
another for other networks (0-1007).
Note 1: SP addresses in ANSI are structured in a different way than
the ETSI addresses used throughout this example. Whereas ETSI
SP addresses consist of a Network Indicator (NI) plus a Signaling
Point Code (SPC), ANSI SP addresses are structured as network-
cluster-member numbers, for example, 251-10-230 or 251-10-20.
Note 2: The TTC nodes can handle both 14 and 16 bits for the SPC
length. The 16 bits SPC length is used within the TTC network, the
14 bits is used within the international ITU-T network. Both
formats can be associated with the same NI simultaneously. The NI
is not enough to identify international nodes in a Japanese
exchange. Therefore, an additional indicator is introduced in the
corresponding data structure to distinguish ITU international nodes
from TTC national nodes.

LZT 123 8482 R1A © 2006 Ericsson - 63 -
MTP ROUTING AND LINK SET
To generate an originating labeled message, the node uses the SPC
of the OWNSP as the Originating Point Code (OPC), and the SPC
of the cooperating SP as the Destination Point Code (DPC).
Whether terminating or transferring a message, a node always
compares the DPC of the incoming message to its OWNSP. If they
are not equal, the node must transfer the message. This requires a
routing function called MTP routing.
Figure 2-8 and Figure 2-9 shows the MTP routing for DUDMSC.
DEST=2-6050
DEST=2-6113
DEST=0-1111
LS=2-6113
SLC=0
LS=2-6050
SLC=0
LS=0-1111
SLC=0&1
SP = 2-6050
SPID = HAMBMSC
SP = 2-6113
SPID = BRLMSC
OWNSP = 2-6017
SPID = DUDMSC
OWNSP = 0-1007
SPID = DUDMSC
SP = 2-6025
SPID = DUDBSC
SP = 0-1111
SPID = OTHER
SP = 2-6026
SPID = DUDRNC
Berlin
Hamburg
Other
Network
Other
Network
RNC BSC
RNC
BSC
RNC
BSC
Integrated MSC
GMSC/HLR
Traffic
Signaling
Dusseldorf
DEST=2-6050
DEST=2-6113
DEST=0-1111
LS=2-6113
SLC=0
LS=2-6050
SLC=0
LS=0-1111
SLC=0&1
SP = 2-6050
SPID = HAMBMSC
SP = 2-6113
SPID = BRLMSC
OWNSP = 2-6017
SPID = DUDMSC
OWNSP = 0-1007
SPID = DUDMSC
SP = 2-6025
SPID = DUDBSC
SP = 0-1111
SPID = OTHER
SP = 2-6026
SPID = DUDRNC
Berlin
Hamburg
Other
Network
Other
Network
RNC BSC
RNC
BSC
RNC
BSC
Integrated MSC
GMSC/HLR
Traffic
Signaling
Dusseldorf
Figure 2-8. MTP Routing in the Network

- 64 - © Ericsson 2006 LZT 123 8482 R1A
<C7RSP:DEST=ALL;
CCITT7 MTP ROUTING DATA
SP SPID DST PRIO LSHB LS SPID RST
0-1111 OTHER ACC 1 0-1111 OTHER WO
2-6025 DUDBSC ACC 1 2-6025 DUDBSC WO
2-6026 DUDRNC ACC 1 2-6026 DUDRNC WO
2-6050 HAMBMSC ACC 1 2-6050 HAMBMSC WO
2 2-6113 BRLMSC SB
2-6113 BRLMSC ACC 1 2-6113 BRLMSC WO
2 2-6050 HAMBMSC SB
END
Figure 2-9. MTP Routing in Düsseldorf (DUDMSC)
A Signaling Point (SP) to which a message is destined is the
Destination point (DEST). The MTP routing ties a DEST to a Link
Set (LS). See Figure 2-9.
LS is a concept used for routing purposes and is similar to a route.
Its format is the same as for an SP: LS=NI-SPC.
Figure 2-9 shows that the MTP routing enables the originating
point to see whether or not the destination is accessible. For
flexible routing, a priority is tied to an LS, for example, the
destination Hamburg (DEST = 2-6050) is accessible via LS 2-6050
as first choice (PRIO = 1). If this link becomes “faulty”, LS 2-6113
(PRIO = 2) changes from Standby (SB) to working.
Note: This is optional. Berlin must support this alternative.
SIGNALING LINK AND SIGNALING TERMINAL
A Link Set (LS) is a group of Signaling Links (SLs) that directly
interconnect two SPs. The Signaling Link (SL) is similar to a
device in a route.
Each Signaling Link (SL) in a LS receives an individual number
called a Signaling Link Code (SLC). See Figure 2-10 and Figure 2-
11. One Signaling Link (SL) operates on 64 kbit/s.

LZT 123 8482 R1A © 2006 Ericsson - 65 -
DEST=2-6050
DEST=2-6113
DEST=0-1111
LS=2-6113
SLC=0
LS=2-6050
SLC=0
LS=0-1111
SLC=0&1
SP = 2-6050
SPID = HAMBMSC
SP = 2-6113
SPID = BRLMSC
OWNSP = 2-6017
SPID = DUDMSC
OWNSP = 0-1007
SPID = DUDMSC
SP = 2-6025
SPID = DUDBSC
SP = 0-1111
SPID = OTHER
SP = 2-6026
SPID = DUDRNC
Berlin
Hamburg
Other
Network
Other
Network
RNC BSC
RNC
BSC
RNC
BSC
Integrated MSC
GMSC/HLR
Traffic
Signaling
Dusseldorf
Signaling Terminal
DEST=2-6050
DEST=2-6113
DEST=0-1111
LS=2-6113
SLC=0
LS=2-6050
SLC=0
LS=0-1111
SLC=0&1
SP = 2-6050
SPID = HAMBMSC
SP = 2-6113
SPID = BRLMSC
OWNSP = 2-6017
SPID = DUDMSC
OWNSP = 0-1007
SPID = DUDMSC
SP = 2-6025
SPID = DUDBSC
SP = 0-1111
SPID = OTHER
SP = 2-6026
SPID = DUDRNC
Berlin
Hamburg
Other
Network
Other
Network
RNC BSC
RNC
BSC
RNC
BSC
Integrated MSC
GMSC/HLR
Traffic
Signaling
Dusseldorf
Signaling Terminal
Figure 2-10. Signaling Links (SLs) and Signaling Terminals (STs) in the
Network
The Signaling Terminal (ST) is connected to the Link Set (LS) via
the Signaling Link Code (SLC). As a backup, it is recommended
that more than one Signaling Link (SL) be assigned in each set,
even if one would be sufficient for the volume of signaling traffic
between two SPs.
For our example, let us assume only two Signaling Links (SLs)
exist to the international node (SP=0-1111). See Figure 2-10 and
Figure 2-11.

- 66 - © Ericsson 2006 LZT 123 8482 R1A
<C7LDP:LS=ALL;
CCITT7 LINK SET
LS SPID ASP
0-1111 OTHER
SLC ACL PARMG ST
0 A1 0 C7STC-1
1 A1 0 C7STC-4
LS SPID ASP
0-6025 DUDBSC
SLC ACL PARMG ST
0 A1 0 C7STC-0
LS SPID ASP
0-6026 DUDRNC
SLC ACL PARMG ST
0 A1 0 C7STH-0
LS SPID ASP
0-6050 HAMBMSC
SLC ACL PARMG ST
0 A1 0 C7STC-2
LS SPID ASP
0-6113 BRLMSC
SLC ACL PARMG ST
0 A1 0 C7STC-5
END
Figure 2-11. Link Set Data in Düsseldorf (DUDMSC)
From this point on, only the link between the MSC in Düsseldorf
and the MSC in Berlin will be discussed.

LZT 123 8482 R1A © 2006 Ericsson - 67 -
HARDWARE AND ROUTE CONNECTION (SS7)
CONNECTION OF THE SIGNALING TERMINAL TO THE GROUP SWITCH
There are different HW types and configurations for SS7 signaling
terminals, depending on the HW version, like BYB 202 or BYB
501.
The BYB 501 variant of signaling terminals is RPG controlled.
There are three versions of RPG. The RPG1 has a parallel bus and
the RPG2 and RPG3 a serial bus used with the BYB 501 hardware.
One RPG can have up to four signaling terminals implemented.
In the example, DUDMSC uses C7ST2C-5 to Berlin. Figure 2-11
shows that the terminal is directly connected to the GS and the
SNT C7SNT-1. The regional Processor 36 and the Extension
Module 0 control this terminal.
<C7STP:ST=C7ST2C-5;
CCITT7 SIGNALING TERMINAL DATA
ST ITYPE RP EM LS SPID SLC
C7ST2C-5 14 36 0 2-6113 BRLMSC 0
END
<NTCOP:SNT=C7SNT-1;
SWITCHING NETWORK TERMINAL CONNECTION DATA
SNT SNTV SNTP DIP DEV DEVP
C7SNT-1 1 TSM-0-10 C7ST2C-4&&-7
END
<C7STP:ST=C7ST2C-5;
CCITT7 SIGNALING TERMINAL DATA
ST ITYPE RP EM LS SPID SLC
C7ST2C-5 14 36 0 2-6113 BRLMSC 0
END
<NTCOP:SNT=C7SNT-1;
SWITCHING NETWORK TERMINAL CONNECTION DATA
SNT SNTV SNTP DIP DEV DEVP
C7SNT-1 1 TSM-0-10 C7ST2C-4&&-7
END
Figure 2-12. Signaling Terminal (C7ST2C) Connected to GS
GS PATH
Figure 2-12 and Figure 2-13 illustrate how a semi-permanent
connection builds the path through the GS from an ST (C7ST2C-
5), to a two-way trunk device (UPD-16).

- 68 - © Ericsson 2006 LZT 123 8482 R1A
C7ST2C-5
ITYPE=14
RPG3
GS
SEMI-BERLIN
RP BUS
2 Mbit/s
Signaling
Terminal
16 UPD
ETC
BRLMSC
DUDMSC R=BERLINO&BERLINI
R=BERLISO&BERLISI
2 Mbit/s
Semipermanent
Connection
C7ST2C-5
ITYPE=14
RPG3
GS
SEMI-BERLIN
RP BUS
2 Mbit/s
Signaling
Terminal
16 UPD
ETC
BRLMSC
DUDMSC R=BERLINO&BERLINI
R=BERLISO&BERLISI
2 Mbit/s
Semipermanent
Connection
Figure 2-13. Path through the Group Switch (GS)
<EXSCP:NAME=SEMI-BERLIN;
SEMIPERMANENT CONNECTION DATA
NAME CSTATE DISTC MISC
SEMI-BERLIN ACT
SIDE1 SSTATE ATT ES
DEV=UPD-16 ACT
SIDE2 SSTATE ATT ES
DEV=C7ST2C-5 ACT
END
Figure 2-14. Semi-permanent Connection Data
ROUTE DATA
Figure 2-14 illustrates how the two-way trunk devices (UPD) are
connected to traffic routes (FNC=3) and signaling routes (FNC=5).
Note: Regional Processor (RP), Extension Module (EM),
Switching Network Terminal (SNT), and Digital Path (DIP) data
are not explained.

GSM MSC/MSC-S R12 Configuration Guide

GSM MSC/MSC-S R12 Configuration Guide

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to GSM MSC/MSC-S R12 Configuration Guide

Similar to GSM MSC/MSC-S R12 Configuration Guide (20)

Recently uploaded

Recently uploaded (20)

GSM MSC/MSC-S R12 Configuration Guide