Volte IMS registration issue on CBRS 315010 PLMN - Issue making phone calls to Open5gs via Nova 430H


 
 
herlesupreeth
on Oct 26, 2023
MaintainerAuthor
________________
No smartphone natively supports automatic out-of-the-box IMS registration on a private CBRS network unless it is explicitly configured via an enterprise MDM profile or manually overridden by the user.
[1, 2]
While almost all modern flagships support the required physical frequencies (LTE Band 48 and 5G NR Band n48), smartphone operating systems inherently restrict IMS (VoLTE/VoNR) stacks to commercial public carriers. If you insert a private SIM card (such as a PLMN 999-01 or 315-010), the phone will attach for data but will intentionally ignore the IMS network. [3, 4, 5, 6, 7]
To achieve functional IMS registration on CBRS, you must look at how specific phone ecosystems handle configuration overrides.

1. Apple iPhone (The Most Reliable for Enterprise)

Apple provides robust, native support for private cellular networks. However, an iPhone will not try to register for IMS/VoLTE on a non-public PLMN unless it receives a customized configuration payload. [6, 8, 9]
 
  • Supported Models: iPhone 11 through iPhone 17 (and newer) natively feature Band 48/n48 hardware.
  • The IMS Requirement: You must use an MDM (Mobile Device Management) system or Apple Configurator to push a Private Cellular Network Payload (.mobileconfig profile). Within this configuration payload, you must explicitly enable voice capability and explicitly define the IMS APN (usually ims) for your specific private PLMN. [3, 6, 8, 10, 11]

2. Google Pixel (The Most Flexible for Labs)

Google Pixel devices are highly favored in private cellular labs because their OS does not strictly lock down the IMS stack, allowing engineers to bypass carrier restrictions manually. [2]
 
  • Supported Models: Google Pixel 5 through Pixel 9/10 (and newer).
  • The IMS Requirement: On standard firmware, a Pixel may require an override to force IMS registration on an unlisted network. You can use root access or debugging tools (like Shizuku paired with the Pixel IMS app) to manually inject a customized carrier configuration, force-enable VoLTE/VoNR, and map the IMS APN to your private core.

3. Samsung Galaxy (Strict Carrier Profiles)

Samsung flagships possess excellent CBRS radios but feature heavily restricted, carrier-dependent IMS software architectures. [3]
 
  • Supported Models: Galaxy S21 through S26 Series, Z Fold/Flip lines, and the Galaxy XCover 6 Pro/7 rugged enterprise phones.
  • The IMS Requirement: If you insert a blank/test SIM into a US-market Samsung phone, the device defaults to a generic carrier profile that completely locks out the IMS settings menu. To achieve IMS registration, you must use an enterprise MDM to push a custom APN profile, utilize Samsung Knox configuration tools, or use a specialized tool (such as Alliance Shield or hidden service menus like *#27663368378#) to manually activate Voice over Packet Switched (VoPS) and specify the IMS APN. [3, 5]

4. Enterprise-Grade / Rugged Android Devices

If you want to avoid struggling with commercial carrier software locks, look toward specialized enterprise hardware designed explicitly for private networks:
 
  • Zebra Technologies: Handheld computers/phones (e.g., TC58, TC78) feature unlocked firmware built to support private enterprise IMS configurations natively.
  • Sonim / Rhino Mobility: Rugged industrial smartphones (e.g., Sonim XP10) allow direct engineering-level access to configure APNs and toggle IMS registration without OS-level restrictions. [12]

Key Requirements Checklist for the Core Network (Open5GS)

Even if the phone is configured correctly, IMS registration will fail if your private network core isn't mirroring what the phone expects: [4]
 
  • The IMS APN/DNN: You must have an independent data network name explicitly named ims (all lowercase) configured in your Open5GS subscriber profiles. [3]
  • IPv4/IPv6 Support: The ims APN should support IPv4v6 dual-stack, as modern phone operating systems frequently reject IPv4-only IMS attempts. [3]
  • PCSCF Discovery: Your network must send the P-CSCF (Proxy-Call Session Control Function) IP address to the phone during the initial data session establishment. [4]
Quick questions if you have time:
  • Are you configuring these devices via an MDM?
     
  • What external IMS core are you connecting to?

https://github.com/magma/magma/issues/15393
________

7/28/2026: I did more research and it looks like phones on CBRS network does not initiate IMS registration. 
Solution: I need to find a phone that initiates IMS registration on 315 001 PLMN.
               The chat bot also recomended to check the sim card configuration, basically compare the 001010 test PLMN that works with CBRS 315001 that does not.
________________________________

Baicells is basically telling you the phone is not attempting VoLTE, and instead is trying to place the call using CSFB (Circuit-Switched Fallback) — which cannot work in your setup with CBRS + Open5GS.

Let’s break their message down piece by piece and translate it into plain terms.


1. “I checked the eNB Wireshark packet and see ESR (Sent by UE IMSI:5481)”

ESR = Extended Service Request

This is an LTE signaling message sent by the UE (phone) to the eNB when:

  • The phone wants to make or receive a voice call

  • VoLTE is not available

  • The phone requests fallback to a circuit-switched (2G/3G) network

So this line means:

Your phone is telling the network:
“I want to make a call, but I don’t see VoLTE, please hand me off to 2G/3G.”


2. “The call is CSFB not VoLTE”

This confirms the above.

CSFB (Circuit-Switched Fallback)

  • Requires a 2G or 3G core network (MSC)

  • LTE is only used for data

  • Voice is handled by legacy circuit-switched infrastructure

Why this is a problem

  • CBRS LTE is LTE-only

  • Open5GS is LTE/5G packet-switched only

  • There is no 2G/3G network to fall back to

?? Result: The call will always fail


3. “Please check your core network and Phones”

This is Baicells politely saying:

The eNB is working correctly.
The issue is VoLTE is not properly configured or supported in:

  • Your core (Open5GS)

  • Your IMS / SIP setup

  • Or the phone’s VoLTE profile


What this means for your call flow

Your current call attempt looks like this:

UE → LTE Attach → Dial Call
      ↓
UE sends ESR (CSFB request)
      ↓
No 2G/3G network exists
      ↓
Call fails

What must happen instead:

UE → LTE Attach
UE → IMS Registration (SIP REGISTER)
UE → VoLTE SIP INVITE
IMS ↔ Open5GS ↔ SIP server

Root causes (most common)

One or more of these is true:

1. Phone does NOT see VoLTE as available

  • VoLTE disabled in phone settings

  • Carrier profile missing or incorrect

  • CBRS PLMN not recognized as VoLTE-capable

2. IMS is not fully configured

  • SIP server reachable but:

    • No proper IMS APN

    • No P-CSCF advertised

    • Missing DNS records

  • Open5GS not integrated with IMS correctly

3. Phone not provisioned for VoLTE

  • Many phones refuse VoLTE on private LTE

  • Some require:

    • Specific MCC/MNC

    • Root access

    • Custom carrier config


How to confirm this yourself

On the UE:

  • Check VoLTE / LTE Calling is ON

  • Check IMS registration status (often hidden menu *#*#4636#*#*)

On the eNB / core:

  • In Wireshark:

    • ? ESR = CSFB attempt (bad)

    • ? SIP REGISTER / INVITE = VoLTE working

  • In Open5GS logs:

    • Look for IMS APN attach

    • Look for SIP traffic to P-CSCF


Bottom line

Baicells is saying:

Your network is data-only right now.
The phone is trying to make a legacy voice call (CSFB), but CBRS + Open5GS only supports voice via VoLTE, and VoLTE is not active in your setup.

If you want, tell me:

  • Phone model(s)

  • MCC/MNC you’re using

  • IMS/SIP server (Asterisk, Kamailio, etc.)

and I can help you pinpoint exactly why VoLTE isn’t being triggered and how to fix it.


RESEARCH
published
v.1.00



Please log in to continue


For BGP peering opportunity ASN: AS401345 Custom Software Development at ErnesTech Email Addresspeering@ernestech.com