EPS Bearer / PDN Management (ESM) in LTE 4G

Introduction

EPS bearer management is the signalling that turns an authenticated, registered device into one that can actually move packets with a promised quality of service. It lives on the ESM half of NAS (TS 24.301), runs end to end between the UE and the MME, and is the last thing that happens on an Attach before your phone shows data connectivity — and the first thing that happens again whenever an application (most importantly IMS/VoLTE) needs a treatment the always-on pipe cannot promise.

Where does it sit in the lifecycle? Cell search, random access and RRC get the UE a signalling connection; EMM authenticates and registers it; then ESM creates the default bearer so IP traffic can flow, and later hangs dedicated bearers on top for specific flows. Every VoLTE call, every policy change from the PCRF, every "why is my video call not getting priority" ticket ultimately resolves to an ESM procedure that did or did not run.

Because ESM is a compact request/accept protocol, a bearer problem almost always lives in one specific message — a rejected PDN Connectivity Request, a missing Activate Dedicated EPS Bearer Context Request, a TFT that steers the wrong packets. Knowing which message broke, and what each IE in it should contain, is most of the debugging.

Why bearer management is needed

Concretely, three things must be true before your IP traffic can flow with the treatment it needs. First, a pipe must exist: user data cannot flow until a bearer has an IP address and a QoS profile agreed by both UE and core. Second, different flows must be separated: a VoLTE call cannot be allowed to compete on equal terms with a background download, so its packets need their own bearer with a guaranteed rate. Third, that state must be kept in sync: if the UE and core disagree about which bearers exist or what each carries, packets are dropped or mis-scheduled. ESM is the protocol that establishes, modifies and releases that shared bearer state.

What ESM Is and Where It Sits

NAS (Non-Access Stratum) has two halves that run in parallel between the UE and the MME. EMM (EPS Mobility Management) handles who you are and where you are — Attach, Tracking Area Update, authentication, identity. ESM handles the sessions that carry your data — the EPS bearers and the PDN connections they belong to. This page is purely ESM. Every ESM procedure is exchanged end to end between the UE and the MME; the eNB simply relays the NAS message inside an RRC container and never inspects the ESM content.

Everything ESM does is organised around the PDN connection: a logical link between the UE and a Packet Data Network — the internet, an operator IMS network — identified by an APN (Access Point Name) and assigned an IP address. Each PDN connection is anchored by exactly one default bearer that lives for the whole life of the connection, and the network may hang additional dedicated bearers on it, each carrying a subset of the traffic with its own quality of service. A UE needing two packet networks at once — internet plus IMS — simply holds two PDN connections, each an independent island of one default bearer plus zero or more dedicated bearers.

Default vs Dedicated EPS Bearers

There are exactly two kinds of EPS bearer, and the distinction shapes almost everything else on this page. The default bearer is created automatically when a PDN connection is established and stays up for its entire lifetime; it is the always-on catch-all path. A dedicated bearer is an extra bearer created on demand, always linked to an existing default bearer, to give a particular flow — a voice call, a video stream — treatment the default bearer cannot guarantee.

The default bearer carries everything not matched by some other bearer's filter, so it never needs a traffic filter of its own. It is always non-GBR: it has no guaranteed bit rate, only a ceiling shared with other non-GBR bearers through the APN-AMBR. Its QCI and ARP come from the subscription and APN configuration. A dedicated bearer, by contrast, always carries a TFT (Traffic Flow Template) that decides which packets ride it, and it may be either GBR (for real-time media) or non-GBR (for a prioritised best-effort flow). Crucially, a dedicated bearer is never standalone: it is bound to a default bearer by a Linked EPS Bearer Identity, sharing that PDN connection's APN and IP address.

The Traffic Flow Template

The default bearer treats all of its traffic identically, which is fine until one flow needs something the rest must not disturb. A VoLTE call needs a guaranteed, low-latency channel that ordinary web browsing cannot be allowed to congest. The mechanism that separates that flow onto its own bearer is the TFT (Traffic Flow Template): the set of packet filters that map IP traffic to a dedicated bearer.

A TFT is a list of packet filters, each matching on the IP 5-tuple and header: source/destination IP address (with prefix), source/destination port ranges, the transport Protocol Identifier / Next Header, the Type of Service/Traffic Class, the IPSec SPI, and the IPv6 flow label. Each filter has an evaluation precedence so filters apply in a deterministic order, and a packet filter identifier so individual filters can later be added or removed. Uplink filters live in the UE and steer outgoing packets; downlink filters live in the P-GW and do the same for incoming packets. The UE receives the full TFT in the activation message so both ends classify traffic consistently.

When a packet needs sending, the UE walks its bearers' uplink packet filters in precedence order; the first bearer whose filter matches carries the packet. Anything that matches no dedicated bearer's TFT falls through to the default bearer — which is exactly why the default bearer needs no TFT of its own. This is how the RTP media of a voice call is steered onto a QCI 1 GBR bearer while SIP signalling and everything else stays on the default bearer.

EPS Bearer QoS: QCI, ARP, GBR and AMBR

Every EPS bearer carries a QoS profile, and understanding it is understanding why bearers exist at all. Two parameters apply to every bearer, GBR or not: the QCI (QoS Class Identifier), a single scalar that indexes a standardised set of packet-forwarding characteristics, and the ARP (Allocation and Retention Priority), which governs admission and pre-emption — not day-to-day scheduling.

The QCI is the heart of the model: a number that maps, through a table standardised in TS 23.203, to a resource type (GBR or non-GBR), a priority level, a packet delay budget and a packet error loss rate. The eNB scheduler does not negotiate these; it looks up the QCI and applies the corresponding treatment. The ARP is orthogonal: it carries a priority level plus pre-emption capability and vulnerability flags, and is used only when resources are scarce — to decide whether a new bearer may be admitted, and if so whether it may bump a lower-priority one. Once a bearer is established the ARP plays no further role in scheduling.

The bit-rate parameters split cleanly along the GBR/non-GBR line. A GBR bearer gets a reserved GBR and an MBR (the ceiling it may burst to), both per direction. Because that reservation consumes admission-controlled resources, GBR bearers are almost always dedicated bearers for a specific media flow. Non-GBR bearers reserve nothing individually; they share aggregate ceilings. The APN-AMBR caps the total bit rate of all non-GBR bearers to a given APN — enforced downlink at the P-GW, uplink at the UE. The UE-AMBR caps the total across all of a UE's non-GBR bearers over all APNs, enforced by the eNB. The default bearer, always non-GBR, lives entirely under these AMBR ceilings.

Bearer Identifiers and the End-to-End Bearer

An EPS bearer is not one object in one box — it is a concatenation of segments across the network, each with the same QoS treatment, named by a small family of identifiers. The end-to-end bearer between the UE and the P-GW is the join of three legs: the DRB (Data Radio Bearer) over the air between UE and eNB, the S1 bearer (an S1-U GTP tunnel) between eNB and S-GW, and the S5/S8 bearer (a GTP tunnel) between S-GW and P-GW. A packet keeps its QoS class as it is mapped from one leg to the next, which is what makes the pipe truly end to end.

Two identifiers name the bearer at the NAS level. The EPS Bearer Identity (EBI) is a value in the range 5–15 that uniquely names a bearer for a UE; the MME allocates it when the bearer is activated and it appears in every ESM message about that bearer. The Linked EPS Bearer Identity (LBI, carried as the Linked EPS Bearer Identity IE) is how a dedicated bearer points at the default bearer it hangs off — it is simply the EBI of that default bearer, which is how the network knows the two belong to the same PDN connection. A default bearer has no LBI; it is the anchor. Below the NAS, each leg is addressed by its own tunnel identifiers — the DRB by its radio bearer ID, and the S1/S5/S8 legs by GTP TEIDs (Tunnel Endpoint Identifiers) at each end — but the EBI is the thread that ties them all to one logical EPS bearer.

The ESM Messages

ESM is a compact protocol: nearly every procedure is a request/accept pair (with an optional reject if the peer cannot comply). They group by what they do to bearer or PDN state, and by who starts them. The recurring theme is that the network activates, the UE accepts — the UE can ask for connectivity or ask for a resource, but it cannot itself create a bearer.

Bearer activation comes in two forms. Activate Default EPS Bearer Context Request creates the always-on anchor; it carries the assigned APN, the PDN Address, the EPS QoS (default QCI and ARP) and the allocated EBI, confirmed by Activate Default EPS Bearer Context Accept. Activate Dedicated EPS Bearer Context Request creates a linked bearer; it carries the Linked EPS Bearer Identity, the EPS QoS (including GBR/MBR for a GBR bearer) and the Traffic Flow Template, answered by Accept.

Two more procedures keep bearers current after activation. Modify EPS Bearer Context Request / Accept changes an existing bearer's EPS QoS (for example a new GBR value) or edits its TFT (adding or removing packet filters) without recreating the bearer. Deactivate EPS Bearer Context Request / Accept removes a bearer — freeing just that bearer if it is dedicated, or tearing down the whole PDN connection if it is the default.

The UE-driven side of ESM is about asking. To reach a packet network the UE sends a PDN Connectivity Request (piggybacked on the Attach Request for the first PDN, or standalone to add another), and releases a connection with a PDN Disconnect Request. To ask for QoS resources on an existing PDN connection it sends a Bearer Resource Allocation Request (a new bearer resource for this traffic) or a Bearer Resource Modification Request (change the resource for an existing filter). In every case the network decides: it runs the corresponding Activate/Modify/Deactivate procedure, or rejects. The UE proposes; the MME disposes.

What carries ESM, physically

ESM messages are not scheduled on their own physical channel — they are NAS PDUs tunnelled over RRC and S1AP. But the RRC messages that carry them are scheduled, so a bearer that never activates can fail at the radio layer even when the ESM logic is correct. On LTE-Uu the carrying RRCConnectionReconfiguration (default/dedicated bearer setup) or DLInformationTransfer is delivered on PDSCH scheduled by a DCI format 1/1A whose CRC is scrambled with the UE's C-RNTI, in the UE-specific search space; the UE's RRCConnectionReconfigurationComplete / ULInformationTransfer reply goes on PUSCH granted by a DCI format 0 / C-RNTI. On S1-MME the same NAS PDU rides S1AP over SCTP. Keep this in mind when a bearer "activation" is missing: check whether the RRC container that should have carried the ESM message was even scheduled.

Putting It Together: A VoLTE Activation Flow

The message sequence below stitches the whole page together: the UE requests connectivity, the MME activates the always-on default bearer, and then — driven by IMS/PCRF policy when a call starts — the MME activates a dedicated GBR bearer whose TFT pulls the RTP media onto QCI 1. Signalling and browsing stay on the default bearer throughout.

Read as a lifecycle, the flow makes the whole model concrete. The default bearer persists for the entire session, sitting under the APN-AMBR ceiling and carrying signalling, browsing and anything without a more specific home. Dedicated bearers come and go on top of it — each linked back to the default by its LBI, classified by its TFT, torn down independently when its flow ends. The default bearer is the last to go, and when it does — via Deactivate of the default or a PDN Disconnect Request — the whole PDN connection goes with it.

Step 1 — Default bearer activation

The UE's PDN Connectivity Request (piggybacked on Attach Request) triggers the MME to create the session in the core and command Activate Default EPS Bearer Context Request, delivered to the UE inside Attach Accept. The UE answers Activate Default EPS Bearer Context Accept (inside Attach Complete). At the end the UE has an IP address and a non-GBR pipe.

Step 2 — Dedicated bearer activation

Triggered by PCRF policy (from IMS/VoLTE), the MME issues Activate Dedicated EPS Bearer Context Request carrying the Linked EPS Bearer Identity, the GBR EPS QoS and the TFT. The UE installs the TFT, binds the new DRB, and answers Accept.

Reading bearer management in the logs

On a NAS trace (UE-side QXDM/QCAT or MME signalling) the ESM procedure appears as a request/accept pair carried inside EMM or NAS-transport messages. The illustrative dump below shows a dedicated-bearer activation for a VoLTE call.

Representative NAS/ESM trace — illustrative, values vary by vendor/build:

Summary

EPS bearer management is ESM doing one job well: keeping the UE and MME agreed on which pipes exist and what each carries. Start from the PDN connection (an APN plus an IP address), anchored by exactly one always-on default bearer (non-GBR, no TFT), with zero or more dedicated bearers hung off it (each with a TFT and its own QoS, GBR or non-GBR, linked by LBI). QoS is QCI + ARP for every bearer, plus GBR/MBR for GBR bearers and the APN-AMBR/UE-AMBR ceilings for the non-GBR ones.

To debug it, find the one ESM message that broke. If there is no data at all, look at the PDN Connectivity Request and default-bearer activation — APN, PDN type, address allocation, reject causes. If a specific flow (voice) gets no priority, look at the dedicated-bearer activation — the PCRF trigger, the QCI/GBR, eNB admission against the ARP, and above all whether the TFT filters actually match the media 5-tuple. Read the trace field by field: EBI, LBI, QCI, GBR/MBR, TFT — the first one that does not line up is your root cause.