I’ve covered how SS7/ISUP handles call forward before, but the HLR can also store call forwarding information.

This is returned to the MSC when the SendRoutingInfo dialog is performed against the HLR.

If it’s present the MSC will redirect the call to that destination, after bouncing it through CAMEL (if enabled).

A lot simpler than Call Forward in IMS, but same outcome.

A lot of HSSes we see are just HLRs under the hood and only implement a minimalist MMTel feature set for call forwarding for this reason to have it track across both.