Skip to main content

P-CSCF Operations & Reference

The Proxy-CSCF is the SIP entry point of the IMS for User Equipment. Every REGISTER and every session from the UE arrives here first. The P-CSCF establishes and enforces the access-security association that protects the UE signalling. The P-CSCF inserts itself into the routing path. It adds a Path header on registration and a record-route on sessions. All subsequent traffic then traverses this node. This traffic includes terminating requests and in-dialog messages. The P-CSCF detects the UE access technology to drive media-bearer policy. The P-CSCF also provides the emergency-session entry point (E-CSCF) with a usable calling-line identity per TS 23.167. The P-CSCF is a signalling proxy only. Media flows directly between the UE and the terminating side. Media never flows through this node.

IMS Functions​

Registration proxy & IPsec security association​

The P-CSCF is the UE registrar-facing proxy. The P-CSCF relays the REGISTER toward the home network (I-CSCF/S-CSCF). On the challenge/response exchange the P-CSCF establishes an IPsec ESP security association with the UE. This is part of the IMS-AKA procedure. During registration the UE and the P-CSCF negotiate the SA parameters through the Security-Client / Security-Server headers. From the authenticated re-REGISTER onward, the SA carries all signalling for that UE.

On the forwarded REGISTER the P-CSCF inserts a Path header. This routes terminating requests back through this same node. The P-CSCF forces the registration expiry to a network-controlled value. The P-CSCF advertises path support. On the successful 200 OK the P-CSCF stores the contact binding. The P-CSCF caches the returned Service-Route and P-Associated-URI. This steers subsequent requests through the correct home-network path.

Each registered UE uses one security association from a per-deployment resource pool. The P-CSCF releases the SA when the UE de-registers (expiry 0) or its registration lapses. The P-CSCF rejects a REGISTER whose Contact marks an emergency (;sos) registration. The P-CSCF handles emergency sessions directly on the INVITE, not through emergency registration.

Access detection & QoS / policy control​

The P-CSCF never relays media. The P-CSCF still authorises the dedicated media bearer with the policy plane. The P-CSCF classifies the UE access from the P-Access-Network-Info header (per TS 24.229 §5.2.6.3). LTE reports 3GPP-E-UTRAN. 5G NR reports 3GPP-NR. WiFi access has no dedicated bearer. The P-CSCF excludes WiFi access from dynamic QoS.

  • 4G / LTE - the P-CSCF authorises the media bearer QoS over Diameter Rx to the PCRF. On the answering leg (the 200 OK carrying SDP) the P-CSCF issues an Authorization/Authentication Request (AAR). The AAR describes the audio media flow, and the video media flow where present. The PCRF then installs the corresponding dedicated bearer. The P-CSCF refreshes the authorisation on in-dialog re-INVITEs. The P-CSCF releases the authorisation when the dialog ends.
  • VoNR (5G NR) - the P-CSCF authorises the bearer QoS over the N5 interface to the PCF. The P-CSCF uses the Npcf_PolicyAuthorization service. The P-CSCF acts as an Application Function. When the far end answers the media, the P-CSCF creates an application session on the PCF. This session uses afAppId VoNR, an AUDIO media component with ENABLED flow status, and a flow descriptor for the UE media. It also includes an AF notification URI for the PCF to call back on. The P-CSCF deletes that application session when the dialog ends.

The QoS authorisation runs on both the originating (MO) and terminating (MT) legs. It is keyed on the UE own IP address. UE address binding: the P-CSCF encodes the UE address to match the PDU-session/bearer binding the policy node holds. The P-CSCF signals an IPv6 UE as ueIpv6 and an IPv4 UE as ueIpv4. A v6 address placed in the v4 field never matches the PCF binding. The PCF then installs no dedicated bearer.

For VoNR the P-CSCF locates the serving PCF via NRF discovery. The P-CSCF registers as an AF. For each session, the P-CSCF resolves the PCF bound to the UE PDU session through the NRF→BSF chain. This is the only PCF discovery path.

Emergency calls (E-CSCF) & calling-line identity - TS 23.167​

The P-CSCF is the emergency entry point. The P-CSCF detects an emergency session by the emergency service URN (urn:service:sos) on the INVITE. The P-CSCF routes it directly to the emergency application server. This bypasses the normal registration check. An emergency INVITE frequently carries no MSISDN. The P-CSCF therefore supplies a usable calling-line identity for the PSAP. This applies even for callers that are unknown or anonymous. This complies with TS 23.167 Annex K and TS 29.214 §4.4.6a.

Two complementary mechanisms resolve the identity:

  1. Cached IMEI→MSISDN binding (fast path). On each successful REGISTER the P-CSCF caches a binding. The binding maps the UE IMEI (from the Contact +sip.instance) to the MSISDN (from P-Associated-URI). The P-CSCF replicates the binding across all P-CSCF nodes. Any node can then resolve the identity regardless of where the UE registered. On the emergency INVITE the P-CSCF extracts the IMEI and looks up the cached MSISDN.
  2. Asynchronous subscription query (unknown/anonymous callers). If no cached binding exists, the P-CSCF issues an asynchronous Rx subscription query to the PCRF. The query is keyed on the UE source IP address. The P-CSCF suspends the INVITE until the answer returns. The PCRF returns the EPC-level identities. The P-CSCF chooses one by precedence MSISDN → IMSI → IMEISV. The P-CSCF caches an IMEISV result back for reuse.

The P-CSCF asserts the resolved identity as the caller From URI and as a P-Asserted-Identity on the sos.apn domain. The P-CSCF restores the identity consistently on replies and in-dialog requests. The PSAP then sees a usable callback identity even for an originally anonymous caller. Whichever path resolves the identity, the emergency INVITE receives the same media/QoS and header treatment as any other originating request. The P-CSCF then forwards it to the emergency application server.

Security / anti-flood​

The P-CSCF applies source-based flood protection. The P-CSCF rate-limits requests per source IP. The P-CSCF bans an IP that exceeds the sampling threshold for a hold-off period. The P-CSCF tracks failed registration authentication per source IP in a short-lived counter. The P-CSCF bans a source that exceeds the failed-attempt threshold within the window. This defeats credential-guessing. The P-CSCF drops requests that a UE addresses to the node itself. The P-CSCF also drops malformed messages. Under memory pressure the node sheds new requests with 503.

Cluster replication​

The P-CSCF replicates registration-related and emergency state across P-CSCF nodes. In particular the P-CSCF synchronises the IMEI→MSISDN emergency binding between nodes. The P-CSCF does a full sync on start-up. Any node in the cluster can then serve terminating traffic and resolve emergency-call identity. This works regardless of which node originally registered the UE. The P-CSCF needs no per-node provisioning.

Deployment Configuration (Ansible-injected)​

Ansible renders the P-CSCF runtime configuration and its Diameter peer table (pcscf.xml) at deploy time. Most values derive from the network PLMN identity (MCC/MNC) and the node inventory hostname. Ansible emits the 5G SBI and PCF blocks only when the deployment inventory contains the relevant network functions.

Identity​

NameWhat it controlsValue / derivation
NETWORKNAMEHome IMS domain used in P-Visited-Network-ID and identity rewritesims.mnc<mnc>.mcc<mcc>.3gppnetwork.org
HOSTNAMEThis node's FQDN (also its host alias)<inventory_hostname>.ims.mnc<mnc>.mcc<mcc>.3gppnetwork.org
URIThe P-CSCF's own SIP URIsip:<hostname>:5060
PCSCF_URLSource URI used for NAT-keepalive OPTIONS pingssip:<hostname>:5060
PCSCF_USER_AGENTUser-Agent header the node emitsUser-Agent: Omnitouch Proxy-CSCF <inventory_hostname>
PCSCF_SERVERServer header the node emitsServer: Omnitouch Proxy-CSCF <inventory_hostname>
DMQ_NOTIFICATION_ADDRCluster notification address for state replication between P-CSCF nodessip:pcscf.ims.mnc<mnc>.mcc<mcc>.3gppnetwork.org:5090

Ansible templates the SIP listen sockets (UDP/TCP 5060, plus IPv6 5060 where an IPv6 address is defined) and the Prometheus HTTP socket (TCP 9090) from the inventory host address. The P-CSCF fronts UEs on IPv6 where available. Peers behind it remain IPv4. Ansible also builds the PATH_HEADER and P_VISITED_NETWORK_ID_HEADER from the hostname and PLMN.

Rx / policy control (4G)​

NameWhat it controlsValue / derivation
RX_DEST_REALMDiameter destination realm for Rx toward the PCRF{{ diameter_realm }}
PCRF_REALMPCRF realmepc.mnc<mnc>.mcc<mcc>.3gppnetwork.org
RX_AF_SIGNALING_IPAF-signalling IP carried in the Rx AAR (this P-CSCF)node ansible_host (override only for double-NAT)
RX_IMS_REG_DIALOG_DIRECTIONDialog-direction mode for Rx registration3

Fixed Rx media parameters include video authorisation on, a 64 kbit/s default/minimum audio bandwidth, RTCP flow inclusion, and a 24-hour maximum authorised session duration.

5G SBI / PCF (VoNR)​

Emitted when the deployment inventory contains a PCF and an NRF.

NameWhat it controlsValue / derivation
VONR_AF_NOTIF_URIAF notification endpoint the PCF calls back onhttp://<this host>:<pcscf_af_notif_port|9999>/af
NRF_URINRF base URI for AF registration and discoveryhttp://<nrf host>:<nrf_sbi_port|7777>
IMS_NRF_NF_IPV4This P-CSCF's NF IPv4 for its AF registrationnode ansible_host
IMS_NRF_PLMN_MCC / IMS_NRF_PLMN_MNCPLMN advertised in NRF registration/discoveryfrom plmn_id

PCF discovery: the P-CSCF registers with the NRF as an AF. For each VoNR session, the P-CSCF resolves the PCF bound to that UE PDU session via the NRF→BSF chain. App-sessions then always reach the correct per-subscriber PCF. This includes multi-PCF 5G cores. This is the only supported discovery path.

Sizing / transport​

NameWhat it controlsValue
CAPTURE_NODEHomer SIP-capture target (templated only when Homer capture is enabled)sip:<homer host>:9060

The base configuration tunes the number of SIP (UDP) worker processes and the registrar hash-table size for the deployment scale. iOS UEs get a shortened TCP connection lifetime to match their transport behaviour.

Diameter peer configuration​

The P-CSCF Diameter peer table (pcscf.xml) advertises the Rx application (16777236) toward the PCRF. All CSCFs share the file structure and the Ansible variables that fill it. See Diameter → Peer Configuration (Deployment). Rx is only active when WITH_RX is defined.

Troubleshooting​

Registration / IPsec connectivity​

Users that cannot register, or registration timeouts, often point to the P-CSCF access-security or discovery layer rather than the home network:

  • IPsec SA establishment - mobile devices must complete the IMS-AKA Security-Client / Security-Server negotiation. If the authenticated re-REGISTER never arrives inside the SA, check two things. Confirm that the UE and P-CSCF agreed on SA parameters. Confirm that no middlebox strips the security headers.
  • NAT traversal - for devices behind NAT, verify the far-end NAT handling. Verify that keepalive OPTIONS pings reach the UE. The pinhole for terminating traffic then stays open.
  • P-CSCF discovery - verify that the UE discovers the correct P-CSCF address (via DNS, DHCP, or static configuration). Verify that the SIP listen sockets are reachable on the access network.

Emergency call issues​

Symptoms: Emergency calls not routing to the PSAP, or the PSAP receives no usable calling-line identity (CLI) / callback number.

  • Emergency detection - the P-CSCF routes on the emergency service URN (urn:service:sos), plus the dialled emergency numbers. Confirm that the INVITE carries the expected emergency indication. Confirm that emergency routing bypasses the normal registration check.
  • CLI resolution for anonymous / unknown callers - the P-CSCF supplies the caller identity from the cached IMEI→MSISDN binding (cluster-replicated, 4-hour TTL). For a caller with no cached binding, the P-CSCF falls back to an asynchronous Rx subscription query to the PCRF. The query is keyed on the UE source IP. The P-CSCF resolves an EPC identity by precedence MSISDN → IMSI → IMEISV (TS 23.167 Annex K). If the PSAP sees an anonymous caller, verify one of two things. Verify that the P-CSCF cached the binding at registration. Otherwise verify that the Rx subscription query returned an identity. OmniWeb shows the cached binding map.
  • Location availability - verify that location information is available for E911/E112. Verify that the location retrieval leg (LRF) is reachable.
  • Test routing - you can exercise emergency call routing without an actual PSAP connection. This confirms detection, identity assertion on the sos.apn domain, and routing to the emergency application server.

Emergency sessions succeed even for unregistered users, users with no SIM or invalid credentials, and roaming users. See Emergency calls (E-CSCF) & calling-line identity - TS 23.167 for the underlying mechanism.

Call Flows​

The sequence diagrams appear with the functions they document. The full session ladders appear below:

Mobile Originating call (MO)​

The P-CSCF routes originating calls through the S-CSCF (via the cached Service-Route) to the TAS for service logic and charging. Media stays direct.

Mobile Terminating call (MT)​

Terminating calls arrive back through the P-CSCF recorded in the Path at registration. The P-CSCF authorises QoS when the called UE answers.

Last updated on