If you know at least a little bit of IMS, you would know the first place all IMS message go through is CSCF. Now you may ask how a UE can figure out where the CSCF is. I am not talking about the physical location of CSCF. Simply put, a UE knows IP address of CSCF. Roughly there can be several different ways of finding (discovering) CSCF as listed below.

• PCO (Protocol Configuration Option) in Activate default EPS bearer context request
• DHCP process
• UE provisioning (Configuration Files or variables stored in UE)
• UICC(USIM/ISIM)
• IKE over ePDG

If the IMS is serviced over ordinary wireline network, it would be more likely for a UA (User Agent) to discover CSCF IP address by DHCP mechanism (or DHCP + DNS). However, if the IMS is serviced via a mobile network (e.g, LTE), it would be more likely for a UA to find CSCF IP address via PCO or some predefined configuration in UE (Refer to 3GPP 23.228 E.1.1 Procedures for P-CSCF discovery for the details of this case)

Exactly which method to be used is up to UA implementation or the agreement between UA maker and Service Provider. So you need to know how your UA/UE is finding CSCF. This discovery issue is one of the most common trouble you would see while you are testing IMS.

Now some network operators are introducing ePDG (for WiFi Offload) and there can be some case UE connects to core network via WiFi Network. In this case, UE can get the information about CSCF during IKE process with ePDG. For the details, refer to IP Allocation via ePDG page.