Skip to main content

PCRF (Policy and Charging Rules Function)

Overview

The HSS includes a built-in PCRF (Policy and Charging Rules Function) that provides policy control and charging rules for mobile data sessions. The PCRF controls Quality of Service (QoS) policies, bandwidth allocation, and charging rules for both default and dedicated bearers in LTE networks.

Key Capabilities

  • Gx Interface: Policy control for PGW/PCEF (Packet Data Network Gateway / Policy and Charging Enforcement Function)
  • Rx Interface: Authorization and QoS for IMS (IP Multimedia Subsystem) media flows
  • Dynamic Policy Management: Real-time policy updates via Re-Auth Requests (RAR)
  • VoLTE Support: Dedicated bearer creation for voice calls with guaranteed QoS
  • Charging Rules: Define charging behavior and speed profiles using Traffic Flow Templates (TFTs)
  • REST API: Programmatic control of policy enforcement and rule management

Architecture

Diameter Interfaces

InterfaceApplication IDPeerPurpose
Gx16,777,238PGW (PCEF)PDN session management, QoS enforcement, charging rules
Rx16,777,236P-CSCF (AF)IMS media authorization, bandwidth reservation

Session State Management

The PCRF maintains session state for active PDN connections and VoLTE calls:

Gx Interface

Supported Operations

1. Credit Control Request - Initial (CCR-I)

Trigger: PGW creates new PDN connection for subscriber

Request AVPs:

  • Session-Id
  • Origin-Host, Origin-Realm
  • Subscription-Id (contains IMSI)
  • Called-Station-Id (APN name)
  • IP-CAN-Type (IP Connectivity Access Network type)
  • RAT-Type (Radio Access Technology)
  • Framed-IP-Address (UE IP address)

PCRF Actions:

  1. Lookup subscriber by IMSI
  2. Retrieve APN profile and QoS configuration
  3. Create session tracking entry
  4. Build QoS policies from APN profile

Response AVPs:

  • Result-Code: 2001 (DIAMETER_SUCCESS)
  • QoS-Information (APN aggregate bandwidth limits)
  • Default-EPS-Bearer-QoS (QCI, ARP, priority)
  • Bearer-Control-Mode
  • Online / Offline (session-level default charging method — see Session-Level Online/Offline Charging)

2. Credit Control Request - Update (CCR-U)

Trigger: PGW reports session changes (location update, RAT change, etc.)

PCRF Actions:

  1. Locate existing session by session ID
  2. Update session parameters (RAT type, location, etc.)
  3. Return updated policies if needed

Response: Result-Code 2001 with optional policy updates

3. Credit Control Request - Terminate (CCR-T)

Trigger: PGW terminates PDN connection

PCRF Actions:

  1. Locate session by session ID
  2. Delete session and associated call records
  3. Confirm termination

Response: Result-Code 2001

Session-Level Online/Offline Charging

The Online (AVP 1009) and Offline (AVP 1008) AVPs sent at the top level of a Gx CCA-I set the default charging method for the whole IP-CAN session (the default bearer), as defined in 3GPP TS 29.212. This is distinct from the per-rule Online/Offline carried inside a Charging-Rule-Definition, which only governs the traffic matched by that specific rule.

By default the PCRF echoes whichever values the PGW/PCEF advertised in the CCR-I. The APN QoS profile can instead pin the session-level charging method, overriding the echo. This is controlled by two optional fields on the APN QoS profile:

FieldTypeAVPEffect
online_charging_enabledBooleanOnline (1009)trueENABLE_ONLINE (1), falseDISABLE_ONLINE (0)
offline_charging_enabledBooleanOffline (1008)trueENABLE_OFFLINE (1), falseDISABLE_OFFLINE (0)

Each field is resolved independently:

Charging Method AVP Values (TS 29.212):

AVPCodeValueNameMeaning
Online10090DISABLE_ONLINEOnline charging (OCS / Gy) not applied to the session
Online10091ENABLE_ONLINEOnline charging applied — credit must be granted before traffic flows
Offline10080DISABLE_OFFLINEOffline charging (CDR / Gz) not applied to the session
Offline10081ENABLE_OFFLINEOffline charging applied — usage recorded for billing

How it works: When online_charging_enabled/offline_charging_enabled are left unset (the default for every existing profile), behaviour is unchanged — the PCRF mirrors the PGW's request, so the network's existing charging posture is preserved. Setting either field forces that charging mode on every CCR-I for any APN using the profile, regardless of what the PGW advertises.

Use case: Pin online charging on for a prepaid APN (so the PGW must consult the OCS even if it requested offline), or force offline charging on a postpaid/IoT APN to guarantee CDR generation. Because the setting lives on the APN QoS profile, it applies uniformly to every APN that references that profile.

Note: This controls the session default only. Per-traffic charging is still governed by the online_charging_enabled/offline_charging_enabled fields on individual Charging Rules, which appear inside Charging-Rule-Definition AVPs.

4. Re-Auth Request (RAR)

Direction: PCRF → PGW (HSS initiates)

Trigger:

  • IMS call setup (Rx AAR triggers Gx RAR)
  • IMS call teardown (Rx STR triggers Gx RAR)
  • Manual re-auth via REST API

RAR AVPs:

  • Session-Id (PGW session ID)
  • Auth-Application-Id: 16,777,238
  • Re-Auth-Request-Type (0 = Authorize only)
  • Charging-Rule-Install/Remove
  • QoS-Information (for dedicated bearers)

PGW Actions: Create/modify/delete dedicated bearers based on charging rules

Charging Rules and Traffic Flow Templates

The PCRF supports defining charging rules with Traffic Flow Templates (TFTs) to control:

  • Service-specific charging - Different rates for video, gaming, social media, etc.
  • Speed profiles - Throttle or prioritize traffic matching specific patterns
  • Usage-based policies - Apply different QoS based on traffic type or destination

Charging rules can be:

  • Installed dynamically via Gx RAR based on application detection
  • Pre-defined and triggered by specific conditions (time of day, location, quota)
  • Associated with TFTs using packet filter rules (5-tuple: protocol, source/dest IP, source/dest port)

Common Use Cases:

  • Zero-rating - Unlimited access to specific services (Spotify, WhatsApp, Facebook) without consuming data quota
  • Post-quota access - Allow self-care portal and support sites even after subscriber exhausts data allowance
  • Tiered speed - High-speed for premium services, throttled for standard content
  • Time-based policies - Off-peak unlimited streaming, peak-time prioritization
  • Roaming policies - Different charging for international vs domestic data usage
  • Enterprise SLAs - Guaranteed QoS for business-critical applications

QoS Policy Structure

Default Bearer QoS (from APN profile):

{
"QoS-Class-Identifier": 9, // QCI (9 = default bearer)
"APN-Aggregate-Max-Bitrate-UL": 50000, // kbps
"APN-Aggregate-Max-Bitrate-DL": 100000, // kbps
"Allocation-Retention-Priority": {
"Priority-Level": 8,
"Pre-emption-Capability": 1, // May preempt
"Pre-emption-Vulnerability": 1 // May be preempted
}
}

Dedicated Bearer QoS (for VoLTE):

{
"QoS-Class-Identifier": 1, // QCI 1 = Conversational Voice
"Max-Requested-Bandwidth-UL": 128000, // bps
"Max-Requested-Bandwidth-DL": 128000, // bps
"Guaranteed-Bitrate-UL": 128000,
"Guaranteed-Bitrate-DL": 128000
}

Rx Interface

Supported Operations

1. AA Request (AAR) / AA Answer (AAA)

Trigger: P-CSCF requests authorization for IMS media session (VoLTE call setup)

Request AVPs:

  • Session-Id (P-CSCF session identifier)
  • Subscription-Id (IMSI or SIP URI)
  • Media-Component-Description
    • Media-Type (audio, video)
    • Max-Requested-Bandwidth-UL/DL
    • Codec-Data
    • Flow-Description (5-tuple packet filters)
  • AF-Application-Identifier

PCRF Actions:

  1. Lookup subscriber by IMSI or SIP URI
  2. Find active IMS session
  3. Extract media parameters (codec, bandwidth, flow rules)
  4. Create call tracking entry
  5. Trigger Gx RAR to PGW to create dedicated bearer
  6. Wait for Gx RAA response
  7. Return Rx AAA with authorization result

Response AVPs:

  • Result-Code: 2001 (success) or 5063 (service not authorized)
Emergency (SOS) calls, including unauthenticated / SIM-less callers

Emergency calls (urn:service:sos) are authorized even when the caller is not a known subscriber (a SIM-less device, or a roaming subscriber with no credentials on file). This is required so that emergency calls always obtain the correct QoS (TS 23.167).

How the PCRF recognises and authorizes an emergency AAR:

  1. Emergency detection. The request is treated as emergency if either the Subscription-Id is a SIP URI containing sos, or the AAR's Framed-IP-Address resolves to a PDN session that was already created as an emergency PDN by the Gx CCR-I (the Gx side flags emergency by the APN / Called-Station-Id containing sos). The second path is what lets an anonymous emergency INVITE (no usable identity) still be authorized.
  2. Subscriber resolution. Looked up by Subscription-Id, else by Framed-IP-Address. An emergency orphan PDN (created by Gx for an unknown subscriber) has no subscriber (subscriber_state_id: nil); the AAR then takes the orphan path rather than the normal-subscriber path.
  3. SOS APN profile. The dedicated-bearer QoS is taken from the SOS APN profile (see "Built-in default SOS APN profile" below).
  4. A Gx RAR installs the dedicated voice bearer (QCI 1) on the (orphan) PDN, and the AAA returns 2001.

Note: a Framed-IP-Address only yields authorization if it maps to a PDN that Gx already created as emergency. A non-emergency request from an unregistered UE is still rejected at the P-CSCF (it never reaches the PCRF as an emergency AAR).

Built-in default SOS APN profile. Emergency authorization no longer depends on an operator having pre-provisioned a sos APN profile in the database. The PCRF resolves the SOS APN profile as:

  • an operator-defined APN profile whose APN identifier is sos, if one exists; otherwise
  • a built-in default (Hss.Control.Common.default_sos_apn_profile/0).

The built-in default is a transient profile (no DB row, apn_profile_id: nil on the orphan PDN — the column is nullable) with emergency QoS:

ParameterValue
Default SOS bearer QCI5
Dedicated voice bearer QCI1 (ARP priority 2)
Allocation-Retention-Priority1
Pre-emption-Capabilityenabled
Pre-emption-Vulnerabilitydisabled
APN-AMBR UL/DL10000 kbps

To override these values (or to set per-operator charging rules via a PCRF profile), create a sos APN profile in the DB — it takes precedence over the built-in default.

2. Session Termination Request (STR) / Session Termination Answer (STA)

Trigger: P-CSCF terminates IMS session (call hangup)

PCRF Actions:

  1. Locate call session by P-CSCF session ID
  2. Trigger Gx RAR to PGW to remove dedicated bearer
  3. Delete call tracking entry
  4. Return STA confirmation

Response: Result-Code 2001

Common Message Flows

Flow 1: PDN Session Establishment

Flow 2: VoLTE Call Setup (Rx AAR → Gx RAR)

Flow 3: VoLTE Call Teardown (Rx STR → Gx RAR)

Flow 4: PDN Session Update

Flow 5: PDN Session Termination

Flow 6: Manual Re-Auth via REST API

REST API

PCRF Re-Auth Endpoint

Endpoint: POST /api/operation/pcrf_re_auth

Purpose: Manually trigger Gx Re-Auth Request to refresh policies

When to Use: This manual endpoint is typically used for troubleshooting or forcing policy refresh on specific subscribers. For routine policy updates (changing APN QoS profiles), the system automatically triggers re-auth for all affected sessions - no manual action needed.

Request Body:

{
"imsi": "999999876543210",
"apn": "ims"
}

Success Response (HTTP 200):

{
"data": "Gx Re-Auth Request for 999999876543210 sent to pgw.epc.mnc999.mcc999.3gppnetwork.org, Result-Code: 2001"
}

Error Response (HTTP 400):

{
"error": "Unable to send Re-Auth Request for 999999876543210 on APN ims, no active PDN Session found"
}

Policy Configuration API

The PCRF retrieves QoS policies from APN configurations stored in the database. These policies can be created and managed via REST API.

Automatic Policy Enforcement: When you update an APN QoS profile (e.g., change bandwidth limits or QCI), the system automatically sends Gx Re-Auth Requests (RAR) to all PGWs with active PDN sessions using that APN. This ensures policy changes are applied immediately to all connected subscribers without manual intervention.

Policy Architecture

Policies are defined through a three-tier structure:

APN Identifier → APN QoS Profile → APN Profile
↓ ↓ ↓
"internet" QCI, AMBR, ARP Links both together

1. Create APN Identifier

Define the APN name and IP version support.

Endpoint: POST /api/apn/identifier

Request Body:

{
"apn_identifier": {
"apn": "internet",
"ip_version": "ipv4v6"
}
}

IP Version Options:

  • "ipv4" - IPv4 only
  • "ipv6" - IPv6 only
  • "ipv4v6" - Dual stack (both IPv4 and IPv6)
  • "ipv4_or_ipv6" - Network decides (either IPv4 or IPv6)

Response (HTTP 201):

{
"data": {
"id": 1,
"apn": "internet",
"ip_version": "ipv4v6"
}
}

Validation:

  • apn: Required, 1-254 characters, unique
  • ip_version: Required, must be one of the four options above

List APN Identifiers: GET /api/apn/identifier

2. Create APN QoS Profile

Define the QoS parameters (bandwidth, QCI, priority).

Endpoint: POST /api/apn/qos_profile

Request Body:

{
"apn_qos_profile": {
"name": "Best Effort Internet",
"qci": 9,
"allocation_retention_priority": 8,
"apn_ambr_dl_kbps": 100000,
"apn_ambr_ul_kbps": 50000,
"pre_emption_capability": false,
"pre_emption_vulnerability": true,
"online_charging_enabled": false,
"offline_charging_enabled": true
}
}

QoS Parameters:

FieldTypeRangeDescription
namestring1-254 charsProfile name (unique)
qciinteger1-254QoS Class Identifier (1-4 = GBR, 5-9 = Non-GBR)
allocation_retention_priorityinteger1-15ARP level (1 = highest priority)
apn_ambr_dl_kbpsinteger1-4,294,967,293APN Aggregate Maximum Bit Rate Downlink (kbps)
apn_ambr_ul_kbpsinteger1-4,294,967,293APN Aggregate Maximum Bit Rate Uplink (kbps)
pre_emption_capabilitybooleantrue/falseCan preempt lower priority bearers
pre_emption_vulnerabilitybooleantrue/falseCan be preempted by higher priority bearers
online_charging_enabledbooleantrue/false/nullSession-level Online AVP for the Gx CCA-I. null (default) echoes the PGW's CCR-I value. See Session-Level Online/Offline Charging
offline_charging_enabledbooleantrue/false/nullSession-level Offline AVP for the Gx CCA-I. null (default) echoes the PGW's CCR-I value. See Session-Level Online/Offline Charging

Common QCI Values:

  • 1 - Conversational Voice (VoLTE) - GBR, 100ms delay budget
  • 2 - Conversational Video - GBR, 150ms delay budget
  • 5 - IMS Signaling - Non-GBR, 100ms delay budget
  • 9 - Default Bearer (Internet) - Non-GBR, 300ms delay budget

Response (HTTP 201):

{
"data": {
"id": 1,
"name": "Best Effort Internet",
"qci": 9,
"allocation_retention_priority": 8,
"apn_ambr_dl_kbps": 100000,
"apn_ambr_ul_kbps": 50000,
"pre_emption_capability": false,
"pre_emption_vulnerability": true,
"online_charging_enabled": false,
"offline_charging_enabled": true
}
}

List QoS Profiles: GET /api/apn/qos_profile

3. Create APN Profile

Link the APN identifier with a QoS profile.

Endpoint: POST /api/apn/profile

Request Body:

{
"apn_profile": {
"name": "Internet APN",
"apn_identifier_id": 1,
"apn_qos_profile_id": 1
}
}

Fields:

Response (HTTP 201):

{
"data": {
"id": 1,
"name": "Internet APN",
"apn_identifier_id": 1,
"apn_qos_profile_id": 1
}
}

Constraints:

  • apn_identifier_id and apn_qos_profile_id must reference existing records
  • Each combination of APN identifier and QoS profile must be unique

List APN Profiles: GET /api/apn/profile

Complete Policy Configuration Example

Step 1: Create IMS APN Policy (VoLTE)

# 1. Create APN Identifier
curl -X POST https://hss.example.com:8443/api/apn/identifier \
-H "Content-Type: application/json" \
-d '{
"apn_identifier": {
"apn": "ims",
"ip_version": "ipv4v6"
}
}'
# Response: {"data": {"id": 2, ...}}

# 2. Create QoS Profile (IMS Signaling)
curl -X POST https://hss.example.com:8443/api/apn/qos_profile \
-H "Content-Type: application/json" \
-d '{
"apn_qos_profile": {
"name": "IMS Signaling QoS",
"qci": 5,
"allocation_retention_priority": 2,
"apn_ambr_dl_kbps": 5000,
"apn_ambr_ul_kbps": 5000,
"pre_emption_capability": true,
"pre_emption_vulnerability": false
}
}'
# Response: {"data": {"id": 2, ...}}

# 3. Create APN Profile
curl -X POST https://hss.example.com:8443/api/apn/profile \
-H "Content-Type: application/json" \
-d '{
"apn_profile": {
"name": "IMS APN",
"apn_identifier_id": 2,
"apn_qos_profile_id": 2
}
}'
# Response: {"data": {"id": 2, ...}}

Step 2: Assign to Subscriber

Once created, the APN profile is assigned to subscribers via EPC profiles. See API Reference for linking APN profiles to subscribers.

Policy Update and Deletion

Update QoS Profile:

PATCH /api/apn/qos_profile/{id}
PUT /api/apn/qos_profile/{id}

Example - Increase Bandwidth for All Users:

# Update QoS profile ID 1 to increase bandwidth
curl -X PATCH https://hss.example.com:8443/api/apn/qos_profile/1 \
-H "Content-Type: application/json" \
-d '{
"apn_qos_profile": {
"apn_ambr_dl_kbps": 150000,
"apn_ambr_ul_kbps": 75000
}
}'

What Happens Automatically:

  1. QoS profile is updated in the database
  2. System identifies all active PDN sessions using APNs linked to this QoS profile
  3. For each active session, a Gx RAR is sent to the corresponding PGW
  4. PGWs update bearer QoS to reflect new bandwidth limits
  5. All connected subscribers immediately receive the updated policy

Example Scenario: If 100 subscribers are currently connected on the "internet" APN using QoS profile ID 1, all 100 will have their bandwidth limits updated to 150 Mbps down / 75 Mbps up within seconds of the API call completing.

Note: When you update an APN QoS profile, the system automatically triggers re-auth for all active PDN sessions using that APN, applying the new policies immediately to attached subscribers. No manual re-auth is required.

Delete Resources:

DELETE /api/apn/identifier/{id}
DELETE /api/apn/qos_profile/{id}
DELETE /api/apn/profile/{id}

Deletion Constraints:

  • Cannot delete APN identifiers or QoS profiles referenced by APN profiles
  • Cannot delete APN profiles assigned to active subscribers

Policy Templates

High-Speed Internet (100 Mbps down / 50 Mbps up):

{
"apn_qos_profile": {
"name": "High Speed Internet",
"qci": 9,
"allocation_retention_priority": 8,
"apn_ambr_dl_kbps": 100000,
"apn_ambr_ul_kbps": 50000,
"pre_emption_capability": false,
"pre_emption_vulnerability": true
}
}

Premium Internet (500 Mbps down / 100 Mbps up):

{
"apn_qos_profile": {
"name": "Premium Internet",
"qci": 8,
"allocation_retention_priority": 5,
"apn_ambr_dl_kbps": 500000,
"apn_ambr_ul_kbps": 100000,
"pre_emption_capability": true,
"pre_emption_vulnerability": false
}
}

IoT/M2M (Low Bandwidth):

{
"apn_qos_profile": {
"name": "IoT M2M",
"qci": 9,
"allocation_retention_priority": 10,
"apn_ambr_dl_kbps": 1024,
"apn_ambr_ul_kbps": 512,
"pre_emption_capability": false,
"pre_emption_vulnerability": true
}
}

Emergency Services (Highest Priority):

{
"apn_qos_profile": {
"name": "Emergency APN",
"qci": 5,
"allocation_retention_priority": 1,
"apn_ambr_dl_kbps": 10000,
"apn_ambr_ul_kbps": 10000,
"pre_emption_capability": true,
"pre_emption_vulnerability": false
}
}

Configuration

Diameter Service Setup

Gx Application (config/runtime.exs):

%{
application_name: :gx,
application_dictionary: :diameter_gen_3gpp_gx,
vendor_specific_application_ids: [
%{vendor_id: 10415, auth_application_id: 16_777_238}
]
}

Rx Application (config/runtime.exs):

%{
application_name: :rx,
application_dictionary: :diameter_gen_3gpp_rx,
vendor_specific_application_ids: [
%{vendor_id: 10415, auth_application_id: 16_777_236}
]
}

QoS Parameters

QoS parameters are sourced from:

  • Default Bearer: APN profile configuration in database

    • apn_qos_profile.qci (QoS Class Identifier)
    • apn_qos_profile.apn_ambr_ul_kbps (Aggregate Maximum Bit Rate Uplink)
    • apn_qos_profile.apn_ambr_dl_kbps (Aggregate Maximum Bit Rate Downlink)
    • apn_qos_profile.priority_level (Allocation Retention Priority)
  • Dedicated Bearer: Extracted from Rx AAR Media-Component-Description

    • QCI: 1 (Conversational Voice)
    • Guaranteed Bitrate: From Max-Requested-Bandwidth AVPs
    • Flow filters: From Flow-Description AVPs

Error Handling

Result CodeTypeMeaningCause
2001SuccessDIAMETER_SUCCESSRequest processed successfully
5001ExperimentalUser not foundIMSI not in subscriber database
5002ExperimentalSession not foundPDN session doesn't exist for update/terminate
5063ExperimentalService not authorizedIMS media authorization denied

Implementation Details

Session Management

The PCRF tracks:

  • Active PDN Sessions - One per APN, per subscriber
  • VoLTE Calls - Multiple calls per IMS session (supports conference calling)
  • QoS Policies - Applied dynamically based on APN configuration
  • Charging Rules - Traffic flow templates and service-specific policies

Advanced Policy Features

The PCRF supports advanced policy control including:

  • Charging rule installation/removal via Gx interface
  • Traffic Flow Template (TFT) matching for service differentiation
  • Dynamic speed profiles based on application or traffic type
  • Service-aware policies triggered by network conditions or subscriber behavior

Contact your system administrator for information on configuring advanced charging rules and TFT-based policies.