Circuit-Switched Fallback (CSFB) in LTE 4G

Introduction

Circuit-Switched Fallback is the LTE-era answer to a problem the first packet-only 4G networks could not solve on their own: how to place and receive an ordinary voice call when the radio the UE is camped on has no circuit-switched (CS) voice domain at all. It is defined in TS 23.272, and it lives at the boundary between the LTE packet core (the MME) and the legacy circuit core (the MSC/VLR).

CSFB is active across the whole life of an LTE attachment, but in two very different ways. There is a persistent part — a dual registration in both the packet and circuit domains, kept alive from attach onward by signalling over the SGs interface — and a momentary part, the actual fallback, in which the radio is physically relocated to 2G/3G only when a voice call is placed or answered. Most of what SGs carries (location updates, SMS, resets) never triggers a fallback at all.

Because a CSFB call is a chain of discrete steps across four or five nodes — UE, eNB, MME, MSC/VLR, and the target legacy RAN — a failure almost always lives in one specific step. "The phone never rang," "the call took forever to connect," "data stalled during the call" each map to a different link in that chain. Learning to walk the steps in order is exactly what turns a vague voice complaint into a specific, testable root cause.

Why CSFB is needed

Early LTE networks were pure packet networks — excellent for data, but with no native way to carry a traditional voice call. LTE has no circuit-switched (CS) domain at all: there is no dedicated 64 kbit/s bearer, no MSC in the data path, nothing that resembles a legacy call. The clean long-term answer is VoLTE — voice carried as VoIP over an IMS core on a QoS-guaranteed bearer — but IMS took operators years to deploy and certify. Meanwhile the voice service already existed and worked flawlessly in the CS domain of 2G (GERAN) and 3G (UTRAN), backed by a fully mature MSC/VLR infrastructure. CSFB is the pragmatic bridge: let the UE enjoy LTE data, but for a voice call temporarily move it back to a radio access that does own a CS domain.

It helps to see CSFB in the family of LTE voice solutions. VoLTE carries voice over IMS on LTE with no fallback. VoLGA (a short-lived generic-access approach) tunnelled CS voice over LTE and never gained traction. CSFB is the middle path that shipped first and most widely: the network keeps the subscriber reachable in the CS domain at all times, and only physically relocates the radio when a call is placed or answered. Understanding CSFB therefore means understanding two things that operate on very different timescales — a persistent dual registration that lasts as long as the UE is attached, and a momentary radio relocation that lasts only for the call.

The SGs Interface and the Combined Attach

CSFB does not work out of thin air. Two things must be in place before a single call can fall back, and both are established the moment the UE attaches.

1. The SGs interface. This is a signalling-only link between the LTE core's MME and the legacy circuit core's MSC/VLR. It is the modern reincarnation of the old Gs interface (which linked the SGSN and MSC in 2G/3G), and it runs the SGsAP application protocol over SCTP. Crucially, SGs carries no user-plane voice — it is purely a control channel for location updates, paging, and short messages. It is the reason an incoming CS call can find a subscriber who is currently sitting on LTE, and the reason the MSC believes that subscriber is registered in a location area even though the UE is really on an E-UTRAN cell.

2. A combined EPS/IMSI attach. When a CSFB-capable UE attaches to LTE, it sets the EPS attach type to "combined EPS/IMSI attach" in its Attach Request. The MME reads this, and on the UE's behalf performs a Location Update toward the MSC/VLR over SGs using an SGsAP-LOCATION-UPDATE-REQUEST. To do so the MME must map the LTE tracking area to a CS location area — it derives a Location Area Identity (LAI) and selects the serving MSC. The MSC/VLR creates a record for the subscriber, allocates a CS temporary identity, and returns an SGsAP-LOCATION-UPDATE-ACCEPT carrying the LAI and a TMSI. The MME stores these and passes the relevant identities back to the UE in the Attach Accept.

The upshot is a UE that is dual-registered without owning two active radios. To the packet core it is a normal LTE subscriber with EPS bearers. To the circuit core it looks like a subscriber that has done a location update and is now idle in some location area, ready to be paged. The MME sits between the two, translating tracking areas to location areas and shuttling paging and SMS across SGs. If this combined attach fails or is not performed, the MSC has no record of the subscriber via LTE, and mobile-terminated CS calls simply cannot reach it — a very common real-world cause of "missed calls on 4G."

Reading the combined attach in the logs

The combined attach is where every later CSFB call succeeds or dies. The two log lines that tell the whole story are the NAS attach type on the LTE side and the SGsAP location-update exchange on the SGs side; if the location update is rejected, the UE ends up EPS-only and no MT call will ever ring.

Representative MME/SGs log — illustrative, values vary by vendor/build:

What SGs Actually Does

The SGs interface earns its keep across the entire life of the attachment, not just at call time. It handles three distinct jobs, and it is worth separating them because only one of them ever triggers an actual fallback.

Notice how little of SGs is about fallback. Location update keeps the CS registration alive; SMS over SGs delivers texts without the UE ever leaving LTE; reset and detach handling keep the two cores consistent. Only MT paging for a voice call leads to a radio relocation, and even then only if the UE accepts the page. This is the key mental model: SGs is a permanent bridge for CS signalling, and CSFB proper is the rarer event in which that signalling escalates to physically moving the radio.

Mobile-Originated CSFB — You Dial Out

The outgoing case is conceptually the simplest because the UE already knows it wants a call. When you press dial, the UE — camped on LTE, either already RRC-connected or coming out of idle via a Service Request — sends an Extended Service Request NAS message to the MME with the service type set to "mobile originating CS fallback." That single message tells the MME the subscriber wants to place a CS call.

The MME then triggers the radio-level move. It signals the eNB with an S1AP UE Context Modification Request carrying a CS Fallback Indicator, and the eNB relocates the UE to a suitable UTRAN/GERAN cell. It does this in one of two ways: an RRCConnectionRelease carrying redirectedCarrierInfo that points the UE at a target 2G/3G carrier, or a PS handover / cell change order that prepares the target cell in advance. Once camped on the legacy cell, the UE performs normal CS call establishment — a location update if needed, then a CM Service Request and the subsequent Mobility Management / Call Control signalling — and the voice call is placed. When the call ends, the UE returns to LTE, usually by cell reselection back to the higher-priority LTE layer.

Reading MO CSFB in the logs

MO CSFB is a short S1AP/NAS conversation followed by a leap to another RAT. The signature is the Extended Service Request with the MO CSFB service type, then the UE Context Modification Request carrying the CS Fallback Indicator, then the release-with-redirect. If the last line is a release without redirection, the UE has nowhere to go and CSFB stalls.

Representative eNB/MME log — illustrative, values vary by vendor/build:

Mobile-Terminated CSFB — an Incoming Call

The terminated case is where SGs truly shows its value. Follow the path of an incoming voice call to a UE that is currently camped on LTE. The call arrives in the CS core first, and the network must reach a subscriber who is not actually on 2G/3G at that instant.

The MSC receives the incoming call, looks up its VLR record, sees the subscriber is registered via SGs, and sends an SGsAP-PAGING-REQUEST to the serving MME. The MME, knowing the UE is on LTE, pages it over the E-UTRAN air interface — the Paging message carries a CN Domain indicator = CS, telling the UE "this page is for a circuit-switched service." The UE responds with an Extended Service Request (service type "mobile terminating CS fallback"), and the MME acknowledges the page to the MSC with an SGsAP-SERVICE-REQUEST. From here the flow is identical to the MO case: the MME sends the eNB a UE Context Modification Request with the CS Fallback Indicator, the eNB relocates the UE via RRCConnectionRelease with redirectedCarrierInfo (or PS handover / cell change order), and once on the legacy cell the UE completes CS setup by sending its paging response and the call rings through.

One subtlety worth naming: the MSC does not know in advance which RAT the UE will end up on, so it relies entirely on the MME's page succeeding over LTE. If the combined attach or a later combined TAU had failed, the VLR record would be stale, the MSC would page into the void, and the incoming call would go straight to voicemail — the archetypal "phone never rang" fault that field engineers trace back to a broken SGs association.

Reading MT CSFB in the logs

MT CSFB begins on the SGs interface, not the air interface. The tell-tale sequence is the MSC's SGsAP-PAGING-REQUEST, the LTE Paging with CN domain = CS, and the UE's Extended Service Request answering it. A paging request with no answer is the classic "phone never rang" signature.

Representative MME/SGs log — illustrative, values vary by vendor/build:

How the UE Moves — Redirection vs PS Handover

The "move to 2G/3G" step can be done in several ways, and they trade speed against continuity. This is the part of CSFB that most affects the user-perceived call-setup delay, so it deserves a careful comparison.

Redirection is the simplest option: the eNB just tells the UE which target frequency (and optionally a target cell) to go find, and the UE reselects there and starts CS setup from scratch. It is trivial to support and needs almost no coordination between RATs, but it is slower, because the UE must synchronise, read system information, and set up on the new cell before the call can proceed — and the packet session usually stalls in the meantime. An enhancement, deferred measurement control reading, lets the UE skip some SI acquisition to trim this delay.

PS handover or a cell change order with NACC (Network Assisted Cell Change) is smarter: the network prepares the target cell in advance and can carry the PS session across, so the move is faster and data need not drop. The price is complexity — it requires inter-RAT interfaces, neighbour cells that support the feature, and more signalling to prepare the target. Operators choose per deployment: redirection for its simplicity and universal support, PS handover where the extra machinery exists and call-setup KPIs demand it.

MO and MT Side by Side

Placing the two flows next to each other makes the symmetry obvious: the only real difference is the "kick-off" at the top. Everything from the CS Fallback Indicator onward is shared.

The take-away is that CSFB is a single mechanism with two entry points. Once the Extended Service Request reaches the MME — whether spontaneously (MO) or as a page response (MT) — the MME's job and the eNB's relocation are the same. That symmetry is why implementations share almost all of the CSFB code path across the two directions.

SMS over SGs, Returning to LTE, and Performance

Not every CS service needs the UE to leave LTE. SMS over SGs is the standout example: short messages are tunnelled between the MSC/VLR and the UE through the MME using SGsAP-DOWNLINK-UNITDATA and SGsAP-UPLINK-UNITDATA, with the actual SMS payload riding inside LTE NAS messages. Because a text needs no continuous 64 kbit/s voice path, there is nothing to fall back to — the message is delivered entirely on LTE, with no RAT change, no redirection, and no setup delay. This is why SMS "just works" on 4G even on networks where voice still uses CSFB, and it is often the first SGs feature an operator turns on.

Returning to LTE after a voice call is deliberately lightweight. When the CS call clears on the 2G/3G cell, the UE is left camped there in idle mode. It then relies on ordinary idle-mode cell reselection, with LTE configured as the higher-priority layer in the legacy cell's system information, to reselect back to E-UTRAN. Some deployments use fast return (also called deferred/fast return to LTE), where the legacy RAN steers the UE straight back to a specified LTE frequency at the end of the call to shorten the time spent off LTE. There is no dedicated "return handover" in basic CSFB — the UE drifts back up to LTE on its own once it is idle again.

Performance is CSFB's weak point, and it was the strongest argument for moving to VoLTE. Because the UE must physically change radio access before the call can even ring, CSFB adds noticeable call-setup delay — commonly several hundred milliseconds up to more than a second versus a native call, dominated by target-cell acquisition and CS setup. During the move the ongoing PS data session is interrupted or, at best, handed over; on a pure redirection the data can stall until the UE settles on 2G/3G and re-establishes packet service. And the voice call itself runs at legacy narrowband 2G/3G quality, not wideband. VoLTE removes all of this: voice is carried over IMS on a dedicated bearer on the LTE cell, so the UE never leaves LTE — no inter-RAT delay, no PS interruption, and wideband (HD) voice. The complementary feature SRVCC (Single Radio Voice Call Continuity) is the partner to VoLTE, not to CSFB: it hands an in-progress VoLTE call down to CS when the UE leaves LTE coverage mid-call.

Summary

CSFB is the stopgap that let LTE deliver voice before VoLTE was ready: keep the UE on LTE for data, register it in the legacy CS core over the SGs interface via a combined EPS/IMSI attach, and physically relocate the radio to 2G/3G only when a voice call is actually placed or answered. Everything hinges on two timescales — the persistent dual registration and the momentary fallback.

To root-cause a CSFB fault, walk the chain in order. If MT calls never ring, suspect the combined attach / TAU and the SGs registration (stale VLR record). If the call kicks off but never leaves LTE, check the Extended Service Request service type and the CS Fallback Indicator. If the UE leaves LTE but the call fails or is slow, look at the move mechanism — redirection target validity, neighbour relations, NACC, and target-cell acquisition. And remember that SMS over SGs never triggers a fallback at all, so an SMS problem and a voice problem point at different links.

The single most durable mental model: SGs is a permanent signalling bridge for CS location update, paging, and SMS; CSFB proper is the rarer escalation where a CS page or call forces a real radio relocation. Knowing which link broke tells you why the call failed.