In this article, we describe how we deployed our own laboratory stand emulating a mobile operator network, which components we used, and which scenarios we validate in this infrastructure.
Why We Needed Our Own Test Lab
A complete verification of component interaction is only possible under conditions as close to real-world operation as possible — with actual user traffic, a functioning billing system, and full interaction between network elements.
In practice, testing new features on an operator’s infrastructure is almost always inconvenient. Access to the stand may be temporary, resources are often occupied by other tasks, and the environment itself is unavailable for extended and repeatable debugging.
That is why we decided to build our own laboratory environment, which allows us to independently reproduce key scenarios, test integrations, and identify errors before deployment at a customer’s site.
How the Stand Is Structured
Core Network Architecture
The stand is based on the classic EPC architecture with plane separation according to the CUPS (Control and User Plane Separation) model.
This separation can be described as “logic and data”: the control plane determines which services are available to the subscriber, while the user plane handles the actual transfer of traffic.
The core consists of several interconnected components:
| Service | Function |
| MME | handles subscriber registration in the network and manages attachment procedures |
| HSS | stores subscriber data, including SIM profiles and service parameters |
| SGW | transfers user traffic between the radio network and the PGW |
| PGW/PCEF | provides the subscriber’s internet access, assigns IP addresses, and enforces charging rules |
Implementation diagram according to the CUPS concept
The user plane is handled by DPI from VAS Experts acting as the UPF (User Plane Function). In our implementation, DPI not only passes traffic through but also classifies applications and protocols, tracks traffic by category, and enforces operator policies in real time.
To extend the stand’s functionality, we connected the infrastructure of our partners at Media-Tel, who provided the PCRF and OCS components.
Billing System Integration
Charging is managed by Media-Tel partner components. PCRF handles service policies — tariffs, restrictions, QoS. OCS provides online charging and real-time balance deduction.
Our PCEF communicates with both systems via the Diameter protocol over the Gx and Gy interfaces.
Call Flow diagram, connection and disconnection
Base Stations: Software Emulator and Industrial Equipment
Two types of base stations are used in the laboratory.
srsRAN is a software emulator running on a standard server with an SDR module. This open-source solution allows a full eNodeB to be deployed and radio parameters to be flexibly configured: frequency band, channel bandwidth, signal power, and other characteristics. The main advantage of srsRAN is its flexibility — the ability to quickly change configurations, analyze the radio interface, and test non-standard scenarios.
Baicells small cell is an industrial base station. It is full-featured operator equipment with support for dedicated voice channels. It is less flexibly configurable, but provides scenarios close to production. We use Baicells specifically to test VoLTE calls using dedicated bearers and QCI=1.
IMS, ePDG, and VoWiFi Support
A separate element of the stand is the ePDG — a component that enables VoWiFi support. When connecting via Wi-Fi, a smartphone establishes a secure IPSec tunnel to the ePDG, after which traffic is forwarded to the core network in the same way as an LTE connection.
From the user’s perspective, VoWiFi is virtually indistinguishable from regular mobile communication: the same phone number, voice services, and charging logic are preserved. However, for the network this is a distinct traffic type that must correctly traverse DPI and PCEF and be processed according to the same rules as LTE sessions.
ePDG support also enabled us to test LTE-to-Wi-Fi handover scenarios without session interruption.
Deployment Pitfalls
To deploy the stand, we prepared a virtual infrastructure, hosted our own PCEF, PGW, and ePDG components, connected DPI, and integrated PCRF and OCS from Media-Tel. The result was a fully functional mobile test network.
Simplified stand diagram
The main challenge arose during billing integration. To make PCEF work correctly with PCRF and OCS, a large number of parameters had to be configured in detail:
- subscriber identifier formats
- MCC/MNC encodings
- session parameters
- quota rules
Even minor discrepancies led to request rejections and errors whose diagnosis required deep knowledge of 3GPP specifications and analysis of Diameter session logs.
A separate challenge arose with srsRAN. The solution has limitations — in particular, there is no support for dedicated bearers, without which full VoLTE is not possible.
To work around this limitation, we adapted the Kamailio IMS server: even if the radio network does not create a dedicated bearer, the voice call continues to be served over the default bearer. For testing purposes, this proved sufficient.
Scenarios We Test
After the stand was launched — we named it VAS Expert Mobile Network — practical verification of charging scenarios in the mobile network began.
First and foremost, we reproduce the situations that most commonly arise during operator integrations.
Quota Exhaustion
One of the primary tests involves traffic quota management. A subscriber is allocated a 100 MB package, after which we verify how DPI accounts for traffic, how accurately PCEF requests a new quota from OCS, and how the system responds when the limit is exhausted. During blocking, we verify the whitelist — DNS and operator services must remain accessible.
Charging Exemptions
Unlimited tariff scenarios and traffic prioritization are tested separately: cases where specific application categories — for example, messaging apps or navigation services — do not consume the subscriber’s main data package. In such cases, DPI identifies the traffic type and PCEF decides whether to charge for it or not.
Roaming
A phone connects with a different MCC/MNC, after which the entire component chain — from HSS to OCS — must correctly process such a subscriber. To emulate this scenario, a different PLMN is loaded onto the SIM card.
Voice and Video Testing via IMS
A separate category of tests involves voice and video services. The stand reproduces the full VoLTE cycle — from SIP registration through IMS to the establishment of a media session and voice transmission between two subscribers within the network.
LTE-to-Wi-Fi Switching
An additional mixed scenario is tested using ePDG: one subscriber is connected via LTE, the other via Wi-Fi, and both devices are registered in the same IMS network. The call must proceed normally and the media stream must be transmitted without restrictions.
After one subscriber switches from Wi-Fi to LTE, the handover must complete without session interruption. For voice and video services such scenarios are especially important, since even a brief connection drop affects call quality.
Project Results
The deployed stand has enabled us to improve the quality of testing and accelerate the development of mobile products.
Today the laboratory is used to verify new features, test integration scenarios, reproduce complex network situations, and demonstrate solutions to customers.
As part of this project, we have already successfully tested the interaction of our solutions with the billing platforms of Media-Tel, Bercut, and FORWARD, and have obtained a fully independent environment for further development and debugging of mobile core products.
