So far we have explore, EMM and ECM aspects of NAS. EMM and ECM apply to per UE. So UE has single entity for EMM and ECM. This is not the case for ESM. At least theoretically... I mean to say, practically the earlier implementation may restrict one bearer per UE and connectivity with single PDN. However theoretically a UE can have multiple bearers per PDN and also connectivity with multiple PDNs. ESM is per EPS bearer. Each bearer has its own ESM FSM.

PDN is some network external to operator’s LTE infrastructure. LTE infrastructure includes eUTRAN and EPC. Ultimately LTE or any other wireless network provides layer 2 connectivity for a mobile UE. So that end-user can transfer its layer-3 user packets (most likely IP packets) to some external network (most likely Internet). UE has layer 3 user data IP packets, that go (and come also from) beyond LTE infrastructure to PDN. The ‘name of PDN’ is ‘APN value’. Internet, corporate intranet, MMS, IMS etc are popular example of such PDN. P-GW is at boundary between EPC and PDN.

UE needs an EPS bearer starting from UE to exit gateway (P-GW) of LTE network. Generally UE has one default bearer per PDN. Default bearer does not have neither QoS treatment nor TFT filters for user data. It just provides a basic connectivity between UE and P-GW for a single PDN. Some mobile application like VoIP call needs QoS treatment for user data. Dedicated bearers are meant for that. Here UE can demand QoS and TFT, but not new UE IP address. UE has single IP address per PDN. If UE and PDN both support both IPv4 and IPv6 dual stack, then only UE can have two default bearers and two IP addresses (IPv4 address and IPv6 address) per PDN.

If UE and network both capable to provide connectivity to multiple PDNs, then UE can have multiple default bearers and multiple IP addresses. It is like your desktop PC has multiple Ethernet cards, so you can connect your PC to multiple networks and configure it with multiple IP address. UE has single invisible OFDMA based LTE air interface towards network. However still it can emulate like two different Ethernet cards. At user plane UE can have multiple Layer 3 IP layers, with common Layer 2 LTE network. Each layer 3 connected to different PDNs. So UE have multiple bearers from UE to across LTE infrastructure till P-GW. Within single layer 3, UE can have default bearer for best effort treatment and possible dedicated bearer(s) for QoS treatment.

All EPS bearers (i.e. default and dedicated) have EPS Bearer ID (EBI). Network assigns its value. Earlier in 2.5G GPRS 3G UMTS network we had NSAPI, for EBI. So at UE few EBI values are used for default bearer(s) and rest are for dedicated bearer(s). UE can have one default bearer and zero or more dedicated bearer(s) per PDN. With EBI value, one can not discriminate whether it’s for default bearer or dedicated bearer. LBI plays important role to link them and bundle them together. All dedicated bearer related messages contain LBI IE. Its value is EBI of default bearer for that PDN.

UE may have static IP address configures with OTA for per APN/PDN. Most of the case, P-GW acts as DHCP server and assign dynamic IP address to UE at the time of default bearer creation. Yes in some P-GW implementations, it consult radius server to allocate IP address for UE. Dynamic IP address allocation happens during default bearer allocation. This IP address remain same and valid for all other subsequent new dedicated bearer(s) for that PDN.

The following tree makes this concept clearer.

  1. LTE layer 2 connectivity with eUTRAN+EPC
    1. Layer 3 IP (IPv4 or IPv6)connectivity to PDN1, UE IP = IP1
      1. Default bearer. No QoS, EBI = EBI1
      2. Dedicated bearer 1 with QoS1, EBI = EBI2, LBI = EBI1
      3. Dedicated bearer 2 with QoS2, EBI = EBI3, LBI = EBI1
    2. Layer 3 IP (IPv4 or IPv6)connectivity to PDN2, UE IP = IP2
      1. Only single default bearer. No QoS, EBI = EBI4
    3. Layer 3 IP (IPv4)connectivity to PDN3, UE IP = IP3
      1. Default bearer. No QoS, EBI = EBI5
      2. Dedicated bearer 1 with QoS3, EBI = EBI6, LBI = EBI5
    4. Layer 3 IP (IPv6)connectivity to PDN3, UE IP = IP4
      1. Default bearer. No QoS EBI = EBI7
      2. Dedicated bearer 1 with QoS4, EBI = EBI8, LBI = EBI7

Here PDN1, PDN2 and PDN3 all are different, having different APN values. IP1, IP2, IP3 and IP4 may or may not be different. QoS1, QoS2, QoS3 and QoS4 may or may not different. EBI1 to EBI8 all are different values, not necessary they are in sequence.

Practically the minimum implementation without QoS lookes like:

  1. LTE layer 2 connectivity with eUTRAN+EPC
    1. Layer 3 IP (IPv4)connectivity to only single PDN 1, UE IP = IP1
      1. Only single Default bearer. No QoS, EBI = EBI1

It looks like this article about NAS ESM is becoming lengthy. So let’s have break after some details about PCO IE.

PCO IE is used to carry UE address. It also carries Primary and Secondary DNS addresses for that particular PDN. So the application can query and resolve any domain name to IP address by contacting the DNS server, within that PDN. All these three IP addresses can be IPv4 address or IPv6 address or both. It depends. If UE already knows their values, it mentions them in PCO, to confirm. Else, UE mention value as (for IPv4 case) to request network for new assignment. PCO IE contains, PPP. PPP contains IPCP for all these IP addresses. PPP can also contain PAP and/or CHAP protocol(s) for user authentication. PCO and TFT are IEs, that are initiated at UE, transparently carried by intermediate nodes (eNB, MME and S-GW) and reached ‘as they are’ at P-GW.

Recap: This article covers, some important concepts about bearer and few important IEs like EBI, LBI, APN, PCO. I will continue ESM in next article and we will explore various ESM procedures.


samirpatry said...


Nice article,Do u have any article which distinguish QoS,EPS Brarer ID and TFT parameter.

Anonymous said...

quite confusing..

Ezra said...

Not to sound lame, but to clear my doubt..

Why does the PDN need a DNS when the UE can find the right PDN using the APN resolution?

Manish Panchmatia said...

Hi Ezra,

Private DNS server used by S-GW / MME / SGSN for APN resolution and get IP address for P-GW / GGSN. It may also used to resolve P-CSCF for IMS network.

However within PDN, we have primary and secondary DNS servers. If the Internet is PDN, then they are public DNS servers. UE contacts those DNS servers within that particular PDN to resolve DNS query to reach the end-to-end destination content server. If PDN is the Internet then these DNS server resolve query for

Pravi said...

Hi Manish,
The article is really good. I got to know some of the basic things which i always used to wonder or wander about :) Thanks for that!!!
I anyway, have one small confusion.
why is that 'APN' and 'PDN' are interchangeably used? What is the exact relation between the two?
please explain me simple words.
Thanks in advance.

Manish Panchmatia said...

Hi Pravi

It is very simple. PDN's name is APN.

PDN is network, represent with cloud in diagram. Packet Data NETWORK.

APN is its name. Access Point Name. It resolves to IP address with DNS query to private DNS server. This IP address belongs to gateway (GGSN or P-GW) which core network (CN) and PDN.

Sandeep said...

Hi Manish, I am still confused about difference in ESM State and ECM connected state

(a) As my understanding ECM Connected - is state where UE already got IP address, and there is a signalling connection from UE to MME (but nothing exist at SGW/PDN-GW)

(b) and in case of ESM active state - there is a resource allocated for UE from eNB to PDN-GW and UE actively transfers the data over selected bearer; in case of ESM inactive state - there is a resource allocated from MME/SGW to PDN-GW (but no resource at RRC level)

Please let me know whether my understanding is correct?

Anonymous said...


How to understand "IP1, IP2, IP3 and IP4 may or may not be different. "

Manish Panchmatia said...

It is simple.

They all are some IP address.

Basically, I mean to say generally a UE will get different self IP from different PDNs. However it is not mandatory. In rare case it may get identical IP address.

For analogy, suppose, you have a PC with 2 Ethernet card. You connect your PC to 2 different networks. When run ifconfig (ipconfig for Windows) command, both Ethernet Interfaces will show different IP addresses. However, by choice, you can configure same IP address for both your Ethernet card connected to different network.

Different PDN is like different networks, that UE is attached to with like virtual Ethernet cards known as PDP context or bearer or session in wireless network

I hope, this make it clear.

Anonymous said...

Hi Manish,
Could you please tell me the date rate associated with the SRBs in LTE..??

Anonymous said...

data rate actually...

Manish Panchmatia said...

Hi all

Please have a look to this complete white paper about "LTE NAS Procedure"

-Manish V. Panchmatia

Unknown said...

following are the some basic doubts..
it looks bearer and pdp contexts are much similar. what are the main differences ?
How the QoS is triggered ? can both ue and network initiate the QoS bearers ( ue initiated and network initiated dedicated bearers )
same comparison in lte vs WCDMA ?
connection between application(http, ftp , rtp ) to bearers mapping
Is WCDMA & LTE both will retain their IP address in idle mode that is till they detach?
what is the maximum default & dedicated bearers can be triggered in LTE ? i see the bearer id goes till 31. but for data 5 to 15 11 data bearers ? so can a ue have 11 bearers ( default + dedicated )?
what is always ip connected in LTE ?
how about wcdma combined attach ? how it works ?

Anonymous said...

Does EBI value of default bearer of 3 PDN can has the same value?

Manish Panchmatia said...


Manish Panchmatia said...

As per my knowledge. No. EBI is like index for all bearers for a subscriber/UE. Default + Dedicated. So all default bearers for different PDN/APN will have different values.

Manish Panchmatia said...

Yes PDP context and default bearer both are similar.

As per my knowledge the major diff are:

1. There is no default PDP context. PDP context is established when user start data session (read start surfing). In case of LTE, when UE attach to the network, a default bearer is established without QoS. Thus, LTE UE is always IP connected.

2. bearer has IEs as per GTPv2. So they are in TLIV format. Few additional IEs.

3. As you know, for data plane, bearer is from NodeB to S-GW to P-GW. For control plane it is from MME to S-GW to P-GW

4. QoS mapping are different.

Generally RTP is over dedicated bearer, as it has stringent latency requirement. However it is implementation specific. For Gold/platinum plan customer http, ftp everything can be on dedicated bearers. I guess, ftp is generally background task so no need of QoS treatment. So it can be on default bearer.

WCDMA combined attached is to save some radio resources. if UE and network both are capable then UE will perform combined attached. 3G-SGSN will intimate to 3G-MSC over Gs interface for CS-attach.

Unknown said...

Story of four different IP address is well brought out

Keep it up

Unknown said...

When a UE includes a DNS address in the PCO other than, will the network accept it and send the same back to the UE.

Post a Comment