Editor’s Note Maintenance Experience

Quarterly for IMS Core Network Products

No. 3 Issue 271, May 2012

Adhering to the “sincere service for customers” customer

service philosophy, making ZTE products create more value for Maintenance Experience
customers, providing better service for customers, providing the Editorial Committee
best and most practical maintenance experience and methods
for customers, improving service knowledge and skills of related
Director: Qiu Weizhao
professional and technical personnel, and here we come to fulfill
Deputy Director: Zeng Li
the above missions with this volume of Maintenance Experience, Editors:
which is for ZTE IMS core network products. Fang Xi, Wang Zhaozheng, Xu Xinyong,
With the growing fierce competition of telecom market, high Zhang Jian, Zhang Jiebin, Zhao Cen,
quality telecom network is the basic of customer service, and Zhou Guifeng, Xiao Shuqing, Ge Jun,
every network operator pays important attention to equipment’s Zhao Haitao, Huang Ying, Xu Zhijun,
maintenance. This volume of Maintenance Experience contains 18 Jiang Haijun, Dong Yemin, Dong Wenbin
articles of ZTE IMS core network maintenance experience; most
of these articles come from the outfield application failure of ZTE Technical Senior Editors:
IMS products, which should have a significant value for tackling Li Peng, Wang Fangfang, Zhu Xiaopei
with IMS related problems. We sincerely hope this journal will help
you a lot for your maintenance work. Executive Editor:
If you would like to subscribe to this magazine (electronic Chen Xinglong
version) or review additional articles and relevant technical
materials concerning ZTE products, please visit the technical
Maintenance Experience
support website of ZTE CORPORATION (http://ensupport.zte.
Newsroom
com.cn).
If you have any ideas and suggestions or want to offer your
Address: ZTE Plaza,No. 55, Hi-tech Road
contributions, you can contact us at any time via the following
South, ShenZhen, P.R.China
email: doc@zte.com.cn.
Postal code: 518057
Thank you for making ZTE a part of your telecom experience!
Contact: Ning Jiating
Tel: +86-755-26776049
Maintenance Experience Editorial Committee Fax: +86-755-26772236
ZTE Corporation Document support Email: doc@zte.com.cn
May, 2012
Technical support website: http://ensupport.
zte.com.cn
Contents

Technical Specials
IMS Off-line Billing Overview........................................................................................................................2
Introduction to IMS NMS Security Management..........................................................................................3
IMS On-line and Registered Users Query....................................................................................................5

Maintenance Instances
Undefined Operation is Prompted After an SSS Command is Executed.....................................................8
Failed to Log in Because the Default USCC Password is Modified.............................................................10
IMS Processes 200 Telephone Problems.....................................................................................................10
SCSCF Fails to Route Numbers in user=phone Format..............................................................................14
Unregistered Callee Gave No Reply............................................................................................................16
Registration Flow Terminal Fails to Subscribe to UP10................................................................................20
Failed to Call User=phone Number..............................................................................................................21
TD Mobile Phone Fails to Dial IMS Video....................................................................................................23
503 Error is Return.......................................................................................................................................27
LINUX Establishes a Mounting Partition Larger Than 2T.............................................................................30
SIP Error Code 422......................................................................................................................................31
The PP Board Fails to Load Version Properly..............................................................................................33
SSS Modifies Play-Tone by Interior Failure Code........................................................................................35
May 2012 Issue 271 Technical Specials
IMS Off-line Billing Overview
⊙Sun Ming / ZTE Corporation
1 Overview
The IMS billing mechanism falls into
off-line billing and on-line billing.
● In the case of off-line billing,
billing information does not affect related
services in real time. The ZXUN CG is a
ZTE IMS off-line billing device.
● In the case of on-line charging,
billing information affects related services
in real time. As a result, the billing system
must interact with the session/service
control system. The OCS is an IMS on-line
billing device.
2 ZXUN CG Functions
IMS CDRs fail to satisfy the
requirements of the billing center in
content and format. Therefore, CDRs must
be pre-processed before transmitted to the
billing center. Between the IMS NE and
the billing center, the ZXUN CG buffers
and pre-processes CDRs. The ZXUN CG
shields the differences among IMS NEs
from different vendors for the billing center,
and eases the processing burden on the
billing center. The billing center works out
the final billing bills based on the expense
settings of carriers.
The ZXUN CG can process at most
15000 CDRs per second, and collects,
constructs, combine, sorts, filters, stores,
and transmits CDRs.
3 CDR Processing Flow
The following flow shows how the
ZXUN CG collects IMS CDRs through the
Rf interface:
 Maintenance Experience
1. The Signal Main Processor (SMP) of the IMS
NE monitors network resource occupation status,
and generates AC counting Requests (ACR).
2. The IMS NE sends ACRs to the ZXUN CG.
3. After receiving ACRs, the ZXUN CG replies
Accounting Answer (ACA) to the IMS NE, indicating
that the ACR message is received.
4. The ZXUN CG saves received ACRs into the
original ACR file.
5. The ZXUN CG filters , screens , sorts and
constructs CDRs.
6. The ZXUN CG removes repeated ACRs,
constructs corresponding CDRs, and saves them
in the original CDR file.
7. After combining, associating, filtering some
CDRs, the ZXUN CG generates complete CDRs
and saves CDRs in the final CDR file.
4 ACR Overview
For a session-irrelavant event, such as a
message, the IMS NE only sends an ACR. After
receiving this ACR, the ZXUN CG generates a
CDR and save the CDR into the CDR file. For a
session-relavant , such as a call, the IMS NE sends
several ACRs (Start/Interim/ Stop ACR).
1. Start ACR indicates the start of a session.
2. If billing condition varies during a session,
such as media change or the billing interim timer
expires, the IMS NE will send an Interim ACR.
3. When a session is completed, the IMS NE
sends a Stop ACR to end the session,
In conclusion, for a session, an IMS NE may
send a Start ACR, no or multiple Interim ACR, and
a Stop ACR.
After receiving all related ACRs of a session,
the ZXUN CG extracts corresponding billing
information, and finally generates CDRs. ■
 www.zte.com.cn

Introduction to IMS NMS Security

Management
Sun Ming / ZTE Corporation

1 Overview ● Command set operation

Security management ensures that only legal
users can log in to the system, and implements
user and role management. Security management
prevents illegal users accessing a system, and
provides operators with security control through
operation authentication methods.
Security management is implemented by the
cooperation of the Web client and the server.
The clients implement data disposal and display
functions in the login window and the Security
Management window, including:
● User operation
● Role operation
● Password, unlocking and policy
operation
The server implements logical
processing of login authentication and
operation authentication.
2 Interior Relations of
Security Management
User, role and command set together
construct the affiliation relations of security
management.
Affiliation relations among user, role
and command set are shown in Figure 1.

Figure 1. Affiliation Relations Between User, Role and Command Set

IMS Core Network Products 

May 2012 Issue 271 Technical Specials

3 User Define the operation command set by adding a

Users are a set of operators who finally command set for a role.
log in to the NM system and perform 4.1 Initiated Role
related operations. The following roles are created in the ZXUN
When creating a user, the administrator SSS while the system is initiating, as shown in
determines the permission of the user by Table 1.
defining the role of the user. 4.2 Role Command Set
You can manage users by defining The role command set of the administrator is
users’ passwords, and setting whether to listed in Table 2.
restrict date, time segment and week. The role command set of the operator is listed
in Table 3.
4 Role The role command set of the maintenance
A role implements operation permission personnel is listed in Table 4.
of a group of users by defining an operation The role command set of the supervisor is
command set. listed in Table 5. ■
Table 1. Initiated Role

Role ID Role Name Role Description Effective or not

1 Administrator The supreme permission is administrator’s permission Y
2 Operator The supreme permission is data configuration permission Y
Maintenance
3 The supreme permission is maintenance permission Y
personnel
4 Supervisor The supreme permission is data view permission Y

Table 2. Role Command Set of the Administrator

Role Name Role Description Role ID Command Set Name

The supreme 1 The command set of 0&M permission

permission is 2 The command set of data configuration
Administrator
administrator’s 3 The command set of system maintenance
permission 4 The command set of data view

Table 3. Role Command Set of the Operator

Role Name Role Description Role ID Command Set Name

The supreme 2 The command set of data configuration

Operator permission is data 3 The command set of system maintenance
configuration 4 The command set of data view

Table 4. Role Command Set of the Maintenance Personnel

Role Name Role Description Role ID Command Set Name
The supreme 3 The command set of system maintenance
Maintenance
permission is system
Personnel 4 The command set of data view
maintenance

Table 5. Role Command Set of the Supervisor

Role Name Role Description Role ID Command Set Name
The supreme
Supervisor permission 4 The command set of data view
is data view

 Maintenance Experience
 www.zte.com.cn

IMS On-line and Registered Users Query

⊙Li Peng / ZTE Corporation

You can use different methods to query the

number of the on-line IMS users and the number
of registered IMS users. The followings are several
methods to query the numbers.

1 AGCF NE
(1) Query the number of the users already
allocated with numbers.
Use the probe to query the R_SUB table, the
number of the users is equal to the number of the
users allocated with number on the AGCF, as shown
in Figure 1.
Figure 1. Querying the Number of Users
(2) Query the number of the registered users.
Already Allocated with Numbers on AGCF
Method one: run the query agcf regnum command.
Command result:

Command(No.1):query agcf regnum

Registered Subscriber Number
Unregistered State Subscriber Number
--------------------------------------
0 30
--------------------------------------
1 Record(s)
Execute command successfully(elapsed
0.074s)

Execute command successfully (elapsed

Figure 2. Querying the Number of Registered
0.074s).
Users on AGCF
Method two: use the probe to log in to the front
end and sort the users. Query the R_PUI table to
see the number of on-line PUI users, as shown
in Figure 2. You obtain the number of registered
users by dividing the number by 2.

2 SSS NE
(1) Query the number of the users already
allocated with numbers.
Method one: query the number by performance
statistics after creating the statistics of number of users.

IMS Core Network Products 

May 2012 Issue 271 Technical Specials

a. Create a task for statistics on the number of OSU users, as shown in Figure 3.

Figure 3. Creating a Task for Statistics on the Number of OSU Users

b. Query the existing measurement tasks, as shown in Figure 4.

Figure 4. Querying the Existing Measurement Tasks

c. Query the statistics, and query the number of the users already allocated with numbers, as
shown in Figure 5.

Figure 5. Querying the Number of the Users Already Allocated With Numbers

 Maintenance Experience
 www.zte.com.cn

Method Two: Use the command to query the number of the users already allocated with
numbers, as shown in Figure 6.

Figure 6. Querying Number of the Users Already allocated With Numbers

(2) Query the number of on-line users.

Method One: Use the same query method as above. Execute the SHOW SRV PUI
STATISTICS command, as shown in Figure 7.
Method Two: Use the same query method to access the front-end. View the R_PUIINFO table
to query the number of registered users. ■

Figure 7. Query the Number of On-Line Users

IMS Core Network Products 

May 2012 Issue 271 Maintenance Instances
Undefined Operation is Prompted After
an SSS Command is Executed
⊙Miao Feng / ZTE Corporation
1 Fault Symptom
To comply with the group billing
091 CDR format specifications, SSS
patches ZXUN SSS V4.00.30.P7 with the
SSS V4.00. 30.3.P13.B4.hotpatch010.
Nevertheless, after selecting the SSS NE
on the U31 maintenance terminal, all the
configuration commands are unavailable,
and the system prompts that the operation
is undefined, as shown in Figure 1.
2 Troubleshooting
1. After logging in to the SSS
maintenance terminal, the engineer can
successfully execute the same commands
in the configuration management. That is
to say, the SSS NE is not faulty.
2. On the U31, the engineer can
successfully excute the configuration
management commands in the P-CSCF NE.
Maybe the SSS model loading is faulty.
3. View the logs in the directory
export/netnumen/ums-server/utils/
operationmodel/log/, for example, opmode
lserver-20110720-1532-00141.log, search
for the key words read operationtree file,
and find the NE command packets loaded
Figure 1. Current NE Command Packet Loaded by the EMS Version
 Maintenance Experience
by current EMS version, as shown in Figure 1. The
current loaded SSS model is ZXUN-SSS(OMM)
[V4.00.30.B050.0].
4. View the model in the /ums-server/works/
global/runtime/operationmodel/original/
directory, as shown in Figure 3. The latest module
loaded by corresponding SSS version is ZXUN-
SSS(OMM) [V4.00.30.3.P13.B40.0]. You must
reload the version.
5. Model Loading Flow:
(1) Delete the mml zip file of the wrong
version. For example, if the wrong zip file is
ZXUN-SSS(OMM)_V4.00.30.B050.0-configfiles.
zip, you need to delete ums-server/works/
global/runtime/operationmodel/original/ZXUN-
SSS(OMM)_V4.00.30.B050.0-configfiles.zip.
(2) Delete the cache. Delete /ums-server/
works/global/runtime/operationmodel/server/
uca-mml-model.desc and /ums-server/works/
global/runtime/ppus/uca.ppu/uca-role.pmu/
ZXUN-SSS(OMM)[V4.00.30.B050.0].
(3) Stop the server and restart the service
model. In the /export/netnumen/ums-server
directory, execute the shutdown-console.
sh command, and then the ums-server\utils\
operationmodel\operationmodel.sh command.
Wait for some time because all the NEs must be

loaded. The old NE modules should be deleted,
otherwise, the loading will take a long time.
(4) Start the server and reload the SSS model.
In the /export/netnumen/ums-server directory,
execute the nohup console.sh command to restart
the server. Query the start process by executing the
ps -ef|grep zte command. Select the SSS NE on the
U31 maintenance terminal, right-click it, and select
Load Model, as shown in Figure 3.
6. After loading the model successfully, restart
the U31 maintenance terminal, and execute the same
Figure 2. Querying Model
Figure 3. Executing”Load Module”
www.zte.com.cn
command in configuration management.
3 Lesson Learned
1. Try to recall what you have done
before the fault takes place, which
operation may possibly result in this fault,
and then locate the fault quickly.
2. Be good at analyzing logs, especially
the logs containing ERR and FAIL fields.
With abundant information in the logs, you
can locate the fault easily. ■
IMS Core Network Products 
May 2012 Issue 271 Maintenance Instances

Failed to Log in Because the Default

USCC Password is Modified
⊙Li Peng / ZTE Corporation

1 Fault Symptom then enter c, finally press the Enter key.

When debugging the USCC, the
engineer cannot log in by the default user
name and password.
2 Troubleshooting
1. Wait for five seconds, press the
Enter key to stop automatic startup, and
2. In the boot menu, run the c command to
modify the enable password option, and modify
the password to zxr10.
3. Save the modification and restart the USCC
board.
4. You can log in to the USCC by using the
password zxr10. ■

IMS Processes 200 Telephone Problems

⊙Li Peng / ZTE Corporation

1 Fault Symptom
This function modifies the DAS of command to query the Centrex configuration
the Centrex to 0. Run the SHOW CTX before the modification, as shown in Table 1.

Table 1. Centrex Configuration Before Modification

CENTREX Calling Centrex Called Centrex Outgoing dial

Name Centrex Type
ID DAS DAS prefix

1379 1501 1100 0 Xx holiday hotel Common Centrex

1510 1510 1100 0 Xx detention house iVPN Centrex
1316 1503 1100 9 Xx coporation Centrex Common Centrex
25 1504 1100 7 Xx coporation Centrex Common Centrex
19 1505 1100 0 xx VPN Common Centrex
20 1521 1100 9 Xx coporation Centrex Common Centrex

10 Maintenance Experience
 www.zte.com.cn

Refer to Table 2 for the Centrex configurations after modification.

Table 2. Centrex Configuration After Modification

CENTREX Calling Centrex Called Centrex Outgoing

Name Centrex Type
ID DAS DAS dial prefix
1379 0 0 0 Xx holiday hotel Common Centrex
1510 1510 0 0 Xx detention house iVPN Centrex
1316 0 0 9 Xx coporation Centrex Common Centrex
25 0 0 7 Xx coporation Centrex Common Centrex
19 0 0 0 xx VPN Common Centrex
20 0 0 9 Xx coporation Centrex Common Centrex

After modification, some Centrex short number cannot be connected. These numbers are
started with 2 or 8. From the common office code analysis, the engineer can find that local
numbers of this area are started with 2 and 8. You should perform number transform to such
prefix. During short number processing, number transform must be performed in advance, and
then use the transformed number to query the relation table between Centrex short number and
long number. Number match is failed and an empty number is reported.
Refer to Table 3 for the local SSS office code before modification.

Table 3. Local SSS Office Code Before Modification

Max. Digit Min. Digit Number

Analyzer Analysis High-fee Number Length
Length of Digit Length of Digit Transform
Entrance Prefix Flag Range Match
Stream Stream Index
1014 1 31 3 0 OFF Not matched
1014 2 31 3 103 OFF Not matched
1014 3 31 3 0 OFF Not matched
1014 4 31 3 0 OFF Not matched
1014 5 31 3 0 OFF Not matched
1014 6 31 3 0 OFF Not matched
1014 7 31 3 0 OFF Not matched
1014 8 31 3 103 OFF Not matched
1014 9 31 3 0 OFF Not matched

To solve this problem, you should modify the SSS common office code configuration, which
means to modify digit length from 3-32 to 7-32, and match the digit length. This solution is used
because the incoming calls and local calls of the numbers longer than the short number are
normal. Refer to Table 4 for the local office code configuration after modification.

Table 4. Local Office Code Configuration After Modification

Max. Digit Min. Digit
Analyzer Analysis Number High-fee Number Length
Length of Digit Length of Digit
Entrance Prefix Transform Index Flag Range Match
Stream Stream
1014 1 31 3 0 OFF Not matched
1014 2 31 7 103 OFF Matched
1014 3 31 3 0 OFF Not matched
1014 4 31 3 0 OFF Not matched
1014 5 31 3 0 OFF Not matched
1014 6 31 3 0 OFF Not matched
1014 7 31 3 0 OFF Not matched
1014 8 31 7 103 OFF Matched
1014 9 31 3 0 OFF Not matched

IMS Core Network Products 11

May 2012 Issue 271 Maintenance Instances

After upgrade, there are 200 calls, complaining that all calls are prompted to be empty
numbers.

2 Troubleshooting
After receiving 200 calls, you may remember the digit length modification of the common office
code analysis started with 2 and 8, and the digit lengths of 200 and 201 calls are under 7.
After communicating with the carriers about the fault causes, performing signaling trace and
viewing the configurations, the carriers agree to add the 200 number analysis configuration.
Through configuring 20 prefix analysis from 20-19 and 80-89, the fault is solved, see Table 5.

Table 5. Adding Digit Analysis Configuration

Max. Digit Min. Digit Number

Analyzer Analysis High-fee Number Length
Length of Digit Length of Digit Transform
Entrance Prefix Flag Range Match
Stream Stream Index
1014 20 1 6 3 0 Matched
1014 21 1 6 3 0 Matched
1014 22 1 6 3 0 Matched
1014 23 1 6 3 0 Matched
1014 24 1 6 3 0 Matched
1014 25 1 6 3 0 Matched
1014 26 1 6 3 0 Matched
1014 27 1 6 3 0 Matched
1014 28 1 6 3 0 Matched
1014 29 1 6 3 0 Matched

3 Further Analysis
1. For the short numbers starting with
0 in some Centrex, modify the common
office code 0 prefix (toll), otherwise, empty
numbers will be reported.
2. The 200 prefix fails to match bit
length during SSS digit analysis, but the
200 call is reported to be empty number,
refer to Figure 1.
According to normal flow, although the
bit length fails to be matched, the calls in
sip user=phone mode still will be routed to
MGCFS. The Tel digit analysis of SCSCF
is shown in Table 6. Figure 1. Empty Number is Reported for 200 Call

Table 6. Tel Digit Analysis of SCSCF

Route Selector Unified Resource ID Service Tyoe DNS/ENUM Query HSS Query

2 fj.ctcims.cn Other domain Query DNS Not query

12 Maintenance Experience

For the URI analysis whose service type is
other domain, user=phone dos not take affect, and
thus calls are routed to ICSCF according to domain
name. Only when the service type is local domain,
SCSCF will route calls to MGCF after tel digit
analysis, refer to Figure 2.
From above flow, you can find the 200 call
failure is caused by three conditions as follows:
1. The format of AGCF outgoing call is sip
user=phone.
2. Due to the modification of SSS digit analysis
bit length, the 200 number failes to be matched.
3. In the SCSCF tel digit analysis, the analysis
property of the prefix 2 is other domain.
As normal configuration, you do not have to
modify condition 1.
Reconfigure condition 2 because it is modified
temporarily and no scenario is considered.
Condition 3 is not configured properly, and its
URI analysis should be modified to local domain.
4 Lesson Learned
Before the end of 2010, the engineer must
Figure 2. Local Domain Flow
www.zte.com.cn
configure Centrex DAS for SSS, and then
enter Centrex intra-group short number
analysis from this DAS. The engineer cannot
configure a DAS for each Centrex because
the number of Centrex may be tremendous.
As a result, it is recommended to share
a DAS by different Centrex for ease of
Centrex migaration and configuration. The
engineer does not have to configure DAS for
Centrex service implementation, instead, the
engineer only needs to scan the relation list
of long and short numbers of this Centrex
From above analysis, the engineer
should handle related NEs comprehensively
for digit analysis and route. Espacially the
number processing of SSS and CSCF:
1. Consider local number, toll number
and Centrex short number configurations
during SSS digit analysis, especially digit
analyaisis of the called numbers.
2. Pay much attention to the differences
among local domain, other domain and local
in CSCF digit analysis. ■
IMS Core Network Products 13
May 2012 Issue 271 Maintenance Instances
SCSCF Fails to Route Numbers in
user=phone Format
⊙Ge Huaxiang / ZTE Corporation
1 Fault Symptom
The CSCF routes numbers in
user=phone format as numbers in tel
format. If a call (sip:999777@ims.tisca
li.net;user=phone) is accessed, the
S-CSCF transfers messages to tel:999777
for analysis and to VMS, but actually, it
transfers messages to the I-CSCF.
2 Troubleshooting
During route analysis, the service
module performs TEL digit analysis
according to user part, and obtains route
set. In the request sent to the SIP platform,
the request URI in SIP URI format still
carries the “user=phone” . The SIP
platform judges the request URI format. If
the format is TEL, the SIP platform routes
the calls by the route set of services. If the
format is SIP URI format, the SIP platform
performs route analysis again, and routes
Figure 1. Default Policies of SSS Number Regulation
14 Maintenance Experience
the calls by host part without judging whether
“user=phone” is carried. As a result, route results
of the SIP platform do not agree with the expected
results.
Firstly, the service module routes the numbers
in tel format based on 999777, and then obtains
correct route set which will be handled by the SIP.
Because the request-uri is not the tel format, the
SIP platform will perform another route analysis
without judging “user=phone”. Instead, it uses the
domain name ims.tiscali.net for number routing
directly. For the S-CSCF, the outgoing domain
name analysis is sent to the I-CSCF, and thus
messages are sent to the I-CSCF finally. I-CSCF
finds that 999777 does not exist, and returns 404.
Solution one: The calling SSS regulates
numbers, sends numbers in “user=phone” format of
caller to the calling S-CSCF after caller triggering,
and the format changes to tel. Refer to Figure 1 for
default policies of SSS number regulation.

When regulation is required, associate CSCF
node ID and this policy, as shown in Figure 2.
Solution two: When analyzing 999777, the
S-CSCF inserts “top route”, and then the SIP
platform will analyze the number based on the
correct “top route” instead of the domain name of
the “user=phone” number.
Figure 2. Associating CSCF Node ID and Policy
www.zte.com.cn
Solution one is recommended.
3 Lesson Learned
This instance helps you to learn the
interior route processing mechanism of the
service module and the SIP platform. ■
IMS Core Network Products 15
May 2012 Issue 271 Maintenance Instances

Unregistered Callee Gave No Reply

⊙Ge Huaxiang / ZTE Corporation

1 Fault Symptom 2 Analysis

The callee subscribes to the called If the callee does not subscribe to the called

unregistered triggering template. The unregistered triggering SP, the I-CSCF rejects the

S-CSCF sends SAR messages to the HSS call after interacting with HSS LIR/LIA. The HSS

for subscription data downloading, but the returns failure codes in the DIAMETER messages,

HSS makes no reply to SAR messages, see Figure 1.

and the flow is failed after timeout. If a user subscribes to the called unregistered

Figure 1. HSS Returns Failure Codes in the DIAMETER Messages

16 Maintenance Experience

triggering SP, the HSS returns Diameter information
in the DIAMETER messages, see Figure 2.
After receiving LIA messages, the I-CSCF
transfers SIP messages to the S-CSCF. Because
the user is not registered and the S-CSCF does
not save related information, SAR messages must
Figure 2. HSS Returns Diameter Information
www.zte.com.cn
be sent to the HSS to download user data.
The HSS makes no response because the
SAR messages contain no host name of
the opposite end. The HSS fails to process
such SAR messages.
IMS Core Network Products 17
May 2012 Issue 271 Maintenance Instances
Check SAR requests sent from the
S-CSCF and make sure there is no HSS
host name, see Figure 3.
3 Solution
Add HSS host name in corresponding
routing analysis. The I-CSCF analyzer is
used in this route analysis, but the CSCF
Figure 3. Checking SAR Requests
18 Maintenance Experience
handles the calling/called unregistered SP differently.
If the caller/callee does not registered, the
S-CSCF sends SAR to the HSS to download user
data during a call. At this time, the UC module
invokes digit analysis by using a routing selector,
and analyzes callee/caller numbers. Nevertheless,
the domain selector and the routing analysis of this
domain selector together form the routing analysis

which is used by the calling S-CSCF for transferring
messages to the I-CSCF. As a result, the HSS host
name and domain name must be configured on this
analysis. The HSS host name corresponds to the
Destination host name in DIAMETER messages,
and the Home domain name corresponds to
Destination realm name. After configuration, the
DIAMETER messages carry HSS host name, and
Figure 4. Detailed Decoding
www.zte.com.cn
the flow recovers, see Figure 4.
4 Lesson Learned
A common route analysis is performed
based on entrance selector and top route/
request line. The UC module is a little
different, so the engineer needs to pay
much attention to the difference. ■
IMS Core Network Products 19
May 2012 Issue 271 Maintenance Instances
Registration Flow Terminal Fails to
Subscribe to UP10
⊙Ge Huaxiang / ZTE Corporation
1 Fault Symptom
After a soft-terminal is registered
successfully, the Wiphone soft terminal
originates service subscription failure
messages to UP10. The same user
uses SoftDA to register the subscription
successfully.
Figure 1. SoftDA Registration Flow
Figure 2. Wiphone Registration Flow
20 Maintenance Experience
2 Cause Analysis
It won’t be the user subscription data or user
data problem because the user is the same. When
comparing two registration flows on different
terminals, the engineer finds the problem.
There are two ASs, one is SSS, and the other
is UP10. For third party registration, ASs will be
triggered according to triggering priority. SSS takes
priority of UP10 in subscription, so the S-CSCF
triggers SSS and then triggers UP10. The process
from successful registration to UP10 third-party
registration, S-CSCF sends messages to SSS,
SSS returns 200 OK, and finally S-CSCF sends
messages to UP10. Here it is assumed that the
entire process takes 0.5s, if terminal sends a
message to UP10 in 0.5s, a problem is raised
because UP10 has not implemented third-party
registration.
Before sending registration, the SoftDA
interacts HTTP with UP10, so the time of
sending subscription is always longer than 0.5s.
Nevertheless, the Wiphone has no interaction, and
the subscription is sent within 0.5s, as a result, the
subscription is failed.
See Figure 1 for SoftDA registration flow.
See Figure 2 for Wiphone registration flow.
3 Solution
Because the UP10 performs third-party
registration after the SSS, the SSS third-party
registration interaction flow costs most of time.
 www.zte.com.cn

After adjusting third-party registration priority, the

problem is solved and UP10 third-party will be
originated first
See Figure 3 for the adjusted registration flow.

4 Lesson Learned
If a user subscribes to several third-party
registrations, the registrations will be performed
according to priority. All ASs operate properly. The
next AS will be triggered after the first AS 200 OK
message is received.
Figure 3. Adjusted Registration Flow
In case of SESSION_ CONTINUED, the flow
will continue no matter what failure response the In case of SESSION_ TERMINATED,
AS returns or the AS makes no response. The the flow is stopped no matter what failure
next AS will be triggered if there is a third-party response AS returns, or the AS makes no
registration, if not, the flow is ended and the user response. The S-CSCF will send user logout
will not be logged out. and trigger third-party logout request. ■

Failed to Call User=phone Number

⊙Zhao Yanhua / ZTE Corporation

1 Fault Symptom
For all the end-to-end calls generated by AGCF, transferred by calling S-CSCF, an error
calling numbers are in siptel format (user=phone). occurs during outgoing route analysis. See
After the I-CSCF receives INVITE request Figure 1 for flow tracing.

Figure 1. Flow Tracing

IMS Core Network Products 21

May 2012 Issue 271 Maintenance Instances
2 Analysis
Based on user=phone function
configuration, select global soft parameter
28 on I-CSCF, set the 22th digit to “1”, and
the 23th digit to 0. See Figure 2 for switch
definition and value range.
Enable failure observation on the
NMS. You cannot locate problems based
on URI configuration analysis, because
local domain analysis of the domain
name is configured properly. Although
route analysis is reported in failure, local
domain name analysis is configured
in URI configuration. As a result, you
cannot locate fault causes based on route
analysis.
Enable the full flow trace function on
the NMS, see Figure 3. Through this flow,
you find that you fail to get route set if the
outgoing route analysis is performed based
on the domain name of the SIP number
converted from SIPTEL number. After
further analyzing the user=phone functional
Figure 2. User=phone Switch Selection and Configuration
Figure 3. Full Flow Trace
22 Maintenance Experience
configuration instructions, if you select SIPtel number
routing in SIP format, only common routing analysis
policy can be performed, such as setting the route set
to other domain NEs. Other policies are unavailable,
such as HSS query. Nevertheless, the next-hop of
this route analysis should be called S-CSCF. This
route analysis handles all HSS query functions based
on domain name.
3 Solution
To avoid above faults, during user=phone
outgoing route analysis, you can analyze SIPtel
number in TEL format, configure related digit
analysis in TEL digit analysis, configure HSS query
function, and finally get corresponding home hosts
of the callees. The flow is processed properly after
configurations, and the calls can be made and
released properly.
4 Lesson Learned
Master NE functions and how to implement
functions logically, and then you can locate the root
causes promptly. ■
 www.zte.com.cn

TD Mobile Phone Fails to Dial IMS Video

⊙Zhang Heng / ZTE Corporation

1 Fault Symptom
The TD mobile phone fails to dial IMS video of Dezhou, empty number is prompted.

2 Troubleshooting
1. When performing tracing, S-CSCF finds that the area code of Qingdao, rather than Dezhou,
is added before the message from VIG to SCSCF. As a result, CSCF replies a 404 message and
there is a problem occurs in VIG processing, see Figure 1.

Figure 1. INVITE Message

2. Check VIG configurations, and find that only
the area code of Qingdao is configured for digit
analysis. Based on on-site conditions, for an incoming
call, MGCF sends BICC messages to VIG in 0086/86
format. VIG sends SIP messages to SCSCF in +86
format. In conclusion, perform the following
operations on VIG:
When receiving 0086, delete 00 and add +
before the number. When receiving 86, add +
to the number directly as shown below:

number-operation create 1 operation remove-called digits 2 position 1

number-operation create 2 operation insert-called digits + position 1

number-operation-set create 1 number-operation-ids 1 2 name 3G_0086_IMS

number-operation-set create 2 number-operation-ids 2 name 3G_86_IMS

number-manipulation create 1 stage pre match-incoming-protocol bicc match-

called-number 0086[0-9]* number-operation-set-id 1
number-manipulation create 2 stage pre match-incoming-protocol bicc match-
called-number 86[0-9]* number-operation-set-id 2

3. For outgoing calls, VIG receives SIP When receiving +, delete + and add 00
messages from S-CSCF in +86 format. VIG sends before the number, as shown below:
BICC messages to MGCF in 0086 format.

number-operation create 3 operation remove-called digits 1 position 1

number-operation create 4 operation insert-called digits 00 position 1

number-operation-set create 3 number-operation-ids 3 4 name IMS_3G_0086

number-manipulation create 3 stage pre match-incoming-protocol sip match-

called-number [+]86[0-9]* number-operation-set-id 3

IMS Core Network Products 23

May 2012 Issue 271 Maintenance Instances

4. View the VIG digit analysis as shown below:

admin/config> show config number-analysis

match match match

incoming calling called selection route
id protocol number number priority id
-- -------- ------- ------ --------- -----
1 sip 100 1
2 bicc 100 11

admin/config> show config number-operation-set

id name number operation ids

-- ---- --------------------
1 3G_0086_IMS 1 2
2 3G_86_IMS 2
3 IMS_3G_0086 3 4

admin/config> show config number-operation

id operation digits position noa

-- --------- ------ -------- ---
1 remove called 2 1
2 insert called + 1
3 remove called 1 1
4 insert called 00 1

admin/config> show config number-manipulation

number
match match operation
incoming called selection set
id stage protocol number priority id
-- ----- -------- ------ --------- ---------
1 pre bicc 0086[0-9]* 100 1
2 pre bicc 86[0-9]* 100 2
3 pre sip [+]86[0-9]* 100 3

5. Redial the IMS user by a TD mobile
phone, and the call still fails. Through
signaling trace, the engineer finds the called
number from MGCF to VIG carries no area
code, but the called number from MGCF to
S-CSCF carries area code. When querying messages
from gateway office to MGCF, the engineer finds they
carry area code, see Figure 2. Therefore, the fault
may be caused by called number properties, VIG
digit analysis and trunk configurations.

Figure 2. Messages from Gateway to MGCF

24 Maintenance Experience
 www.zte.com.cn

6. This fault has nothing with the called number

properties because both the called number carrying
no area code and that carrying area code are
user numbers. Check the VIG digit analysis on the
MGCF and find no number transform is performed,
as a result, this fault must be related to VIG trunk
configurations, see Figure 3.
7. Check VIG trunk configurations and trunk
group flags on the MGCF. When comparing it with
SCSCF configurations, the engineer finds that the
InterNum flag is missing in the VIG trunk group,
which means that the called number in international
format is used. Add the trunk flag InterNum,
see Figure 4, and then the MGCF can carry the
flag normally. The command is SET TGFLG:
TG=3,ENABLE= “InterNum”.
8. Nevertheless, an empty number is still
prompted when you dial the video. After performing
signaling trace, the ISCSCF returns a 404
message, see Figure 5.
9. At this time, the I-CSCF has queried S-CSCF
server list to the HSS, and the LIA message is
queried successfully and the SCSCF1 domain
name is returned, see Figure 6. Figure 6. SCSCF1 Domain Name is Returned

Figure 3. Comparing Called Number Properties

Figure 4. Adding Trunk Group Flag InterNum

Figure 5. ICSCF Returns 404 Message

IMS Core Network Products 25

May 2012 Issue 271 Maintenance Instances
10. Perform SCSCF1 URI analysis
based on VIG entrance. If a 404 message is
returned, the data may be wrong. Query the
SCSCF1 URI analysis of the VIG entrance
and find it is not configured. Configure the
URI analysis and the fault is removed.
ADD URIANA:ID=231,NAME=
“QDA_VIG_JN_SCSCF1_ALL”
,RTSEL=190,URI=“scscf1.
sd.chinamobile.com”,METHOD=
“ACK”&”BYE”&”CANCEL”&”
INFO”&”INVITE”&”MESSAGE”&”
NOTIFY”&”OPTIONS”&”PRACK”&”
PUBLISH”&”REFER”&”REGISTER”&”
SUBSCRIBE”&”UPDATE”,SRVTYPE=
“HOMEDOMAIN”,SRVATTR=
“COMM”,DNSENUMQRY=“DNS”;
26 Maintenance Experience
3 Lesson Learned
1. If the call is failed, trace messages to check
which NE returns the release message.
2. VIG digit analysis configuration is too simple,
try to implement digit analysis on the MGCF. The
VIG analyzes and transforms digits between BICC
and SIP.
3. If MGCF carries no area code or digit
analysis is performed, check called/calling number
pre-analysis, digit analysis data, and query the
properties of the called number. Besides, check
various flags in the trunk group.
4. For the errors returned by ISCSCF, locate
the exact call flow of the errors. For digit analysis,
check TEL digit analysis and URI digit analysis. ■

503 Error is Return
⊙Yu Jiang / ZTE Corporation
1 Fault Symptom
When configuring the ENUM query during digit
analysis, the terminal makes a call, and the S-CSCF
returns a 503 error.
2 Troubleshooting
1. Capture packets on the terminal. The terminal
sends an INVITE message to the core network, and
then the core network returns a 503 error. Based on
the x-zte-cause head in the 503 message, this error
is caused by the S-CSCF (host name is scscf3.pplat.
com.cn), see Figure 1.
2. Start the Full-Trace on the S-CSCF. You can
www.zte.com.cn
find the ENUM query is performed on the
S-CSCF, see Figure 2.
Click GETALIVEDNSLINK interface
messages. You fail to obtain the dnslink(
returned retcode is a non-zero value, see
Figure 3.
3. Query the DNS link status by
executing the SHOW DNS LINK STATUS
command. The first DNS link is unreachable,
see Figure 4.
4. Start the link tracing and trace No.1
DNS link, and then execute the DNS link
continuity command, see Figure 5.
IMS Core Network Products 27
May 2012 Issue 271 Maintenance Instances

Figure 1. x-zte-cause Header

Figure 2. Start Full Trace on the S-CSCF

Figure 3. Failed to Obtain dnslink

Figure 4. Unreachable DNS Link

Figure 5. Start Link Tracing

28 Maintenance Experience

5. Through link tracing, you can find that the
10.5.16.103 address (S-CSCF) sends NAPTR
query to the 10.5.12.188 address (dns server).
After the DNS server replies, the NMS returns a
message dns link is reachable!, see Figure 6.
If the NMS makes no reply after the continuity
command is executed, you should configure
related records on the DNS server.
6. Re-query the DNS link status, and find it
turns to be reachable, see Figure 7. Re-make a
call, and the call is successful.
3 Lesson Learned
You can locate the faulty NE based on x-zte-
Figure 6. DNS Link Continuity Command
Figure 7. DNS Link Status Turns to Be Reachable
www.zte.com.cn
cause carried by the error response
from the core network. Start the failure
observation and full trace on this NE to
locate the exact flow. In this case, the fault
is caused by ENUM query. After querying
related interface messages, you find
that the fault is caused by no available
DNS link. To solve the unreachable DNS
link fault, start the DNS link tracing and
execute DNS link continuity command.
Trough tracing and MML command, you
find the CSCF is sending DNS query to
the DNS server. After receiving reply, the
CSCF changes the DNS link status to be
available. The fault is removed. ■
IMS Core Network Products 29
May 2012 Issue 271 Maintenance Instances

LINUX Establishes a Mounting Partition

Larger Than 2T
⊙Zhang Wei / ZTE Corporation

1 Fault Symptom
The GPT partition table, also called the GUID
During the charging system debugging,
partition table, supports up to 18EB (E:exabytes,
the CG disk array (ZTE S260 array) should
1EB=2(10) PB=1024PB, 1PB=2(10) TB=1024TB).
be larger than 2T based on customer
Each disk supports up to 128 partitions.
requests, but the MBR partition table used
As a result, you should change the S260
by Fdisk of the LINUX operating system
disk array from MBR format to GPT format by
supports 2T partition at most.
performing:

2 Troubleshooting 1. Unmounting the disk array from the CG Linux

system.
The partition table used by Fdisk is
2. Executing the following commands on two
MBR (Master Boot Record). The 0 panel, 0
CG blades:
channel, and 1 sector are the master boot
sectors. The Fdisk writes 512 bytes here, parted /dev/sdb
also called the MBR record. mklabel gpt
mklabel msdos
The MBR partition table supports up to
mkpart primary 0% 100%
2TB volume, and up to four main partitions
quit
or three main partitions and one expansion
partition. The expansion partition supports 3. Formatting the disk array by executing the
unlimited logic driver. mkfs.ext3 -F /dev/sdb1 command. ■

30 Maintenance Experience

SIP Error Code 422
⊙Yu Jiang / ZTE Corporation
1 Fault Symptom
The terminal sends an INVITE call request to
the IMS NE, and a 422 error code is returned.
2 Troubleshooting
1. Capture packets on the terminal. The terminal
sends an INVITE message to the core network, and
the core network returns a 422 error code.
As seen from the x-zte-cause head carried in
the 422 error code, this fault is caused by the No.
2 instance of No.1 SIP module of the P-CSCF (The
host name is pcscf3.pplat. com.cn). It generates
8F00 AC87:Tu session timer the value in
session-expires less than Min-SE of config, see
Figure 1.
2. Query the P-CSCF session timer
configuration by executing the SHOW SIP
GLOSESSIONTIMER command, and you find
that the P-CSCF session refresh mode is enabled,
and the minimum session refresh duration is 1800
Figure 1. Querying the x-zte-cause Header
Figure 2. Query P-CSCF Session Timer Configuration
www.zte.com.cn
seconds, see Figure 2.
3. Query the code stream which traces
INVITE, and you find that the terminal
supports the session timer and the carried
session-expires value is 90, see Figure 3.
4. Stipulated by the RFC4028, if the
proxy receives a session update request
which contains supported head and
session-expires head, and the head values
are timer, the session update request can
be rejected by 422 response when time
intervals in the session-expires head is
shorter than the minimum session time
intervals defined in local policy. Currently,
two request methods are available: INVITE
and UPDATE.
As seen from Figure 3, the terminal
carries the supported: timer and session-
expires headers, and the session-expires
IMS Core Network Products 31
May 2012 Issue 271 Maintenance Instances
Figure 3. Querying the Code Stream
value is smaller than the minimum time
interval (1800s) configured locally. As
a result, the Proxy(P-CSCF) return 422
response which complies with protocol.
5. There are five handling methods as
follows:
(1) Query the P-CSCF session refresh
configuration, and modify the minimum
session intervals to be smaller or equal
to the session-expires value carried
by the request. In this case, modify
1800s to 90s by executing SET SIP
GLOSESSIONTIMER:MINREFTIME=90;.
(2) Modify the session-expires value to
a larger value.
(3) Query the P-CSCF session
32 Maintenance Experience
refresh configuration, and modify the session
refresh mode to NOSESS by executing SET
SIP GLOSESSIONTIMER:REFMODE=
“NOSESS”;.
3 Lesson Learned
If receiving the 422 error response, the
service flow checks the x-zte-cause header
by capturing packets in 422 response, quickly
locate the faulty NE and service module type,.
Query the session refresh timer configuration.
And then modify the minimum time interval to a
proper value. Alternatively, you can disable the
session timer function or modify the session-
expires carried by the code stream sent from
the terminal. ■

The PP Board Fails to Load Version
Properly
⊙Zhang Peng / ZTE Corporation
1 Fault Symptom
After a 13U shelf is upgraded and the
OMPversion is loaded successfully by DTF tool,
the PP board fails to obtain version from the OMP.
The PP board keeps restarting.
2 Troubleshooting
1. Confirm whether the OMP is powered on
Figure 1. Querying Process Poweron Status
www.zte.com.cn
successfully after version loading.
After the OMP version is loaded
successfully, connect it to the fore-end
OMP board by ssh, execute the SCS
ShowMcmInfo() command on fore-end
sh 0 to check the process poweron status,
see Figure 1.
IMS Core Network Products 33
May 2012 Issue 271 Maintenance Instances
After the command is executed
successfully, you find that all process
status is work. As a result, the fault is not
caused by OMP poweron failure. May be
the PP board is faulty.
2. Check the PP board.
(1) Enter exit at the admin prompt
of the OMP board, and enter su at the $
prompt.
(2) At the # prompt, ping the 128.129
IP address of the PP board.
The address cannot be pinged
successfully. May be the PP board is
damaged or the base cable between PP
board and OMP board is damaged, and thus
the PP board fails to download versions from
the OMP board, see Figure 2.
3. Query related information of OMP
and PP in the No. 3 directory of the OMP
board as follows:
● Abnormal record: /IDE0/
EXC_OMP.TXT/IDE0/EXC_PP.TXT
● Abnormal log: /IDE0/EXCINFO/
Figure 2. Pinging the IP Address of the PP Board
Figure 3. Board Island
34 Maintenance Experience
EXCLOG_rack_shelf_slot_CPU.TXT
Check PP logs, you find that the board is an
island and OMP cannot be found, see Figure 3.
Instead of fault reasons, the PP board cannot be
started because it cannot connect to OMP. The
BASE panel network interfaces of OMP and PP
are deployed on BASE panels of different GESs.
Therefore, the OMP board and the PP board cannot
connect to each other if connection between the
BASE panels on two GES boards is interrupted. As
a result, the PP board fails to download version from
the OMP board through BASE panels.
4. Solution: query BASE connection between
GES boards. Check whether the cables or network
interfaces are abnormal. Check the adjustment.
3 Lesson Learned
Once faults are detected, remove the faults
one by one. In case of power-on problem on
the bottom layer, check the logs on boards,
and locate fault causes by log print. Beside, the
network solution should be made in accordance
with criterion. ■

SSS Modifies Play-Tone by Interior
Failure Code
⊙Ge Huaxiang / ZTE Corporation
1 Fault Symptom
SSS supports too many services. Every
scenario corresponds to an independent failure
code. Use an unreachable callee for example, the
corresponding failure code is 2382365478. SSS
can modify corresponding tones of some failure
flows through using internal failure codes.
This section describes how to implement these
operations by locating internal failure codes quickly.
2 Troubleshooting
1. There are two methods to locate interior
failure codes:
Figure 1. Finding Failure Time
Figure 2. Locating the Interior Failure Code of the Unreachable Callee Scenario
www.zte.com.cn
(1) Flow trace by the NMS
Because there are too many flow
tracing messages, it is inefficient if you
try to find messages row by row. You can
open flow trace and trace by user first, and
then find the failure time in trace by user,
see Figure 1.
Later in flow trace, you can locate the
failure message quickly based on this time.
For example, the failure time is 58:30.064,
the time that the system generates this
failure is several milliseconds before, in
Figure 2, you can find it is 2 miliseconds
IMS Core Network Products 35
May 2012 Issue 271 Maintenance Instances
before, that is 58:30.062. From this failure
message, we can find the interior failure
code of this unreachable callee scenario is
2382365478, see Figure 2.
(2) Query by X-ZTE-Cause
Trough wireshark or signaling packet
capture on the NMS, we can find the
X-ZTE-Cause field from the failure
response reported by NEs. Convert this
field from hex to decimal notation to
acquire the failure reasons. This section
uses the unreachable callee failure as an
example; the X-ZTE-Cause value is as
follows:
In X-ZTE-Cause: SSS-CSS:8e000326,
SSS-CSS refers to the NE that generates
the failure response and a correspond
module, 8e000326 is the interior cause
value. The decimal notation after
conversion is 2382365478.
Two methods have their advantages
Figure 3. Showing Tone of the Interior Failure Code
Figure 4. Modifying the Tone ID or Deleting Tone Playing
36 Maintenance Experience
and disadvantages:
● Flow trace on the NMS: comprehensive
but low efficient.
● X-ZTE-Cause: quick but cannot feedback
the failure caused by abnormal version.
2. Modify or delete tone playing based on
interior failure code.
(1) The corresponding tone of the interior failure
code is displayed, see Figure 3.
(2) There is only one Mo Flag, meaning that the
tone playing function on the callee side is removed
and only the calling SSS can play tones. You can
modify Tone ID or delete tone playing based on
actual requirements, see Figure 4. If Mo Flag is set
to Yes, the calling tone playing is modified, while
No indicates to modify the called tone playing.
3 Lesson Learned
The X-ZTE-Cause helps to locate faults
and learn the interior failure code quickly, which
enhances efficiency greatly. ■