Every few years, it’s interesting to do a reality check of mobile device or network features considered as stable or perhaps even legacy. And that’s because every now and then, things do change while you are not looking, and sometimes even for the better! Case in point: Call forwarding settings for voice calls while roaming.
When I last checked this many years ago, VoLTE roaming was still in its infancy. When roaming abroad on an LTE network, voice calls would make the mobile device fall back to GSM or UMTS for the voice call. That’s called Circuit Switched Fallback (CSFB). The problem back then: Some network operators blocked the change of call forwarding settings via USSD short code 2G/3G signalling messages from abroad due to the fraud potential and the security limitations of the SS7 protocol. In other words: When you were abroad, you could not change those settings anymore. Pity.
Fast forward to today and VoLTE roaming has become the norm rather than the exception. When VoLTE is active for a subscriber, call forwarding settings are not changed by falling back to GSM or UMTS, but by using the XCAP protocol over IP, often by using the Home Operator Service (HOS) APN default bearer. This is much more secure because the subscription is authenticated during the process. So would this also work abroad? When I was recently in Hungary, I gave it a try in a network that had a VoLTE roaming agreement with my home network operator. And indeed, when I interrogated or changed my call forwarding settings, the HOS default bearer was opened, an XCAP HTTP GET/PUT request was sent, and the settings were changed as requested. Nice, problem solved!
But wait, what about roaming in a network without a VoLTE roaming agreement? Before trying, I had assumed that CSFB fallback would be used and probably rejected. But no! Much to my surprise, the device I tested this with also made an XCAP request of the HOS APN dedicated bearer, and I could interrogate and modify my call forwarding settings despite being on a network without VoLTE roaming support. How interesting, I did not expect that.
Hi Martin,
first of all, many thanks for your blog, which I have been reading with great interest for many years, especially the telco topics.
I was also surprised to read that XCAP was still being used even when there was no VoLTE roaming, but of course it makes sense, since no IMS is involved.
As a small note, I saw that you wrote “call forwarding settings via USSD short code”. Call Forwarding is not controlled via USSD. USSD is implemented in 4G via USSI (USSD using IMS), which uses SIP messages with a special MIME type. So if you had sent an actual USSD code (e.g. to request prepaid balance), your phone would have fallen back to 2G/3G in a network without VoLTE roaming.
(Since I kept confusing the different types of *# codes, I wrote down the differences many years ago: https://berlin.ccc.de/~tobias/mmi-ussd-ss-codes-explained.html )
By the way, I recently had the opposite experience from yours: CSFB for changing call forwarding settings, even though I had VoLTE (and I was in my home network). After a while I figured it out: my provider uses IPv6 by default, and I had switched to the v4-only APN to test something and had forgotten to switch back. I haven’t debugged it further, but maybe the XCAP server is only reachable via v6. It took even longer to debug because my Samsung phone keeps using CSFB for this if it couldn’t reach the XCAP server once. It has to be rebooted (flight mode doesn’t help) for it to try XCAP again.