diff --git a/lib/base/types.h b/lib/base/types.h
index e4404280d..2ed25afe2 100644
--- a/lib/base/types.h
+++ b/lib/base/types.h
@@ -143,6 +143,7 @@ typedef struct _pdn_t {
     c_uint8_t       pre_emption_vulnerability;
 
     void *context;
+    void *ip_pool;
 } pdn_t;
 
 /**************************************************
diff --git a/src/pgw/pgw_context.c b/src/pgw/pgw_context.c
index 12a87a547..c88cff8a4 100644
--- a/src/pgw/pgw_context.c
+++ b/src/pgw/pgw_context.c
@@ -416,10 +416,6 @@ pgw_bearer_t *pgw_sess_add(c_uint8_t id)
     d_assert(bearer, pgw_sess_remove(sess); return NULL, 
             "Can't add default bearer context");
 
-    sess->ip_pool = pgw_ip_pool_alloc();
-    d_assert(sess->ip_pool, pgw_sess_remove(sess); return NULL,
-            "Can't alloc IP pool");
-
     return bearer;
 }
 
@@ -427,8 +423,6 @@ status_t pgw_sess_remove(pgw_sess_t *sess)
 {
     d_assert(sess, return CORE_ERROR, "Null param");
 
-    pgw_ip_pool_free(sess->ip_pool);
-
     pgw_pdn_remove_all(sess);
     pgw_bearer_remove_all(sess);
 
@@ -488,6 +482,10 @@ pdn_t* pgw_pdn_add(pgw_sess_t *sess, c_int8_t *apn)
 
     memset(pdn, 0, sizeof(pdn_t));
     strcpy(pdn->apn, apn);
+
+    pdn->ip_pool = pgw_ip_pool_alloc();
+    d_assert(pdn->ip_pool, pgw_pdn_remove(pdn); return NULL,
+            "Can't alloc IP pool");
     
     pdn->context = sess;
     list_append(&sess->pdn_list, pdn);
@@ -503,6 +501,8 @@ status_t pgw_pdn_remove(pdn_t *pdn)
     sess = pdn->context;
     d_assert(sess, return CORE_ERROR, "Null param");
 
+    pgw_ip_pool_free(pdn->ip_pool);
+
     list_remove(&sess->pdn_list, pdn);
     pool_free_node(&pgw_pdn_pool, pdn);
 
diff --git a/src/pgw/pgw_context.h b/src/pgw/pgw_context.h
index 4e099a74d..1e7c66b3e 100644
--- a/src/pgw/pgw_context.h
+++ b/src/pgw/pgw_context.h
@@ -49,12 +49,6 @@ typedef struct _pgw_context_t {
     list_t          ip_pool_list;
 } pgw_context_t;
 
-typedef struct _pgw_ip_pool_t {
-    lnode_t         node; /**< A node of list_t */
-
-    c_uint32_t      ue_addr;
-} pgw_ip_pool_t;
-
 typedef struct _pgw_sess_t {
     lnode_t         node;       /**< A node of list_t */
     index_t         index;      /**< An index of this node */
@@ -69,7 +63,6 @@ typedef struct _pgw_sess_t {
 
     list_t          pdn_list;
     list_t          bearer_list;
-    pgw_ip_pool_t   *ip_pool;
 } pgw_sess_t;
 
 typedef struct _pgw_bearer_t {
@@ -89,6 +82,12 @@ typedef struct _pgw_bearer_t {
     pgw_sess_t      *sess;
 } pgw_bearer_t;
 
+typedef struct _pgw_ip_pool_t {
+    lnode_t         node; /**< A node of list_t */
+
+    c_uint32_t      ue_addr;
+} pgw_ip_pool_t;
+
 CORE_DECLARE(status_t)      pgw_context_init(void);
 CORE_DECLARE(status_t)      pgw_context_parse_config(void);
 CORE_DECLARE(status_t)      pgw_context_final(void);
diff --git a/src/pgw/pgw_handler.c b/src/pgw/pgw_handler.c
index 3e67e61c3..fb1e58e0f 100644
--- a/src/pgw/pgw_handler.c
+++ b/src/pgw/pgw_handler.c
@@ -151,8 +151,6 @@ void pgw_handle_create_session_request(
     d_assert(bearer, return, "No Bearer Context");
     sess = bearer->sess;
     d_assert(sess, return, "Null param");
-    ip_pool = sess->ip_pool;
-    d_assert(ip_pool, return, "Null param");
 
     memcpy(apn, req->access_point_name.data, req->access_point_name.len);
     apn[req->access_point_name.len] = 0;
@@ -163,6 +161,9 @@ void pgw_handle_create_session_request(
     }
     d_assert(pdn, pgw_sess_remove(sess); return, "No PDN Context");
 
+    ip_pool = pdn->ip_pool;
+    d_assert(ip_pool, pgw_sess_remove(sess); return, "No IP Pool");
+
     memset(&gtp_message, 0, sizeof(gtp_message_t));
 
     memset(&cause, 0, sizeof(cause));