What is the ePDG?

The ePDG is a network element designed for secure access and interworking between 3GPP networks (LTE/5G core) and non-3GPP networks (Wi-Fi). It acts as a security gateway, creating a secure connection from untrusted networks to the mobile core network. This connection is achieved through an IPsec tunnel, ensuring data is encrypted and protected from unauthorized access.

‍

‍

By enabling secure connectivity across networks, the ePDG significantly expands mobile networks' coverage and service potential. Notably, it allows service providers to:

• Extend their networks cost-effectively,
• Improve service accessibility in challenging areas (like in-building locations),
• Offer consistent, seamless connectivity,
• Enable high-speed, ultra-broadband services.

‍

Operators who want to supplement LTE coverage by offering VoWiFi to their end-users must add an Authentication, Authorization, and Accounting (AAA) server and ePDG to the Packet Core and the IP Multimedia Subsystem (IMS). AAA are managed through a 3GPP-compliant AAA server, which validates user credentials and authorizes access. Subscribers can then use Wi-Fi to access the mobile operator’s core EPC network when LTE coverage is unavailable. The AAA server also acts to protect the network from potential cyberattacks.

‍

How does the ePDG Work?

The main components and processes involved in the operation of the ePDG are:

1. IPsec tunnel establishment: When a device connects to a Wi-Fi network, the ePDG establishes an IPsec tunnel between the device and itself. This tunnel is essential for protecting data and ensuring a secure connection over non-3GPP networks. The IPsec tunnel is transparent to the Wi-Fi access point, meaning it doesn’t require special handling from the local network‍
2. SWu interface: This IPsec-based interface connects the WLAN (Wi-Fi) user equipment (UE) to the ePDG, ensuring data integrity and privacy.
3. AAA server integration: Authentication, Authorization, and Accounting (AAA) are managed through a 3GPP-compliant AAA server, which validates user credentials and authorizes access. The ePDG uses the Extensible Authentication Protocol-Authentication and Key Agreement (EAP-AKA) method to authenticate users and establish a secure, encrypted session.
4. Routing and packet management: Once the IPsec tunnel is established, the ePDG manages the routing of packets between the WLAN UEs and the Packet Data Network Gateway (PGW) within the mobile core. It supports bothIPv4 and IPv6 configurations, enabling compatibility across various networks.
5. Policy and quality enforcement: The ePDG enforces network policies, including Quality of Service (QoS) parameters, ensuring optimal performance and adherence to operator policies.
6. Session continuity: For applications like VoWiFi, session continuity is vital. The ePDG supports seamless handoff, enabling users to move between Wi-Fi and cellular networks without interruption. This is achieved since the UE session is anchored at the PGW transparently via the ePDG—for the application (e.g., the IMS), the session simply originates from the PGW independent of access technology.

‍

The ePDG beyond VoWiFi

While VoWiFi is one of the ePDG's most popular applications, its use cases extend far beyond voice services.

1. Traffic Offloading
   Operators can reduce congestion on their macro cellular networks by offloading traffic onto trusted and untrusted Wi-Fi networks. Wi-Fi provides a cost-effective alternative to boost coverage and relieve network stress in high-traffic areas such as shopping malls, airports, and stadiums. Trusted Wi-Fi networks, where the operator has control, can offer even more excellent service consistency by applying policies and managing traffic flow seamlessly.
   ‍
2. Seamless Network Integration and Session Handoff
   The ePDG supports seamless session handoff between Wi-Fi and cellular networks, allowing users to maintain their data sessions as they move between network types. This capability is crucial in applications that require uninterrupted connectivity, such as videoconferencing, streaming, and gaming.
   For example, consider a user in a large shopping mall. As they move from outdoors (on LTE) to indoors (on Wi-Fi), thee PDG ensures that their session continues without interruptions, providing a consistent, high-quality experience.
   ‍
3. Network Security Services and Parental Controls
   The ePDG can serve as a secure internet-traffic gateway, applying security policies and content filters. For instance, mobile operators can offer parental control services, allowing parents to filter inappropriate content for children on public Wi-Fi. Additionally, the ePDG enhances network security by blocking malware and unauthorized access, safeguarding users’ data from external threats.
   ‍
4. Backhaul Optimization
   By utilizing existing Wi-Fi infrastructure for backhaul purposes, mobile operators can reduce costs associated with data transport. Offloading data-heavy applications like video streaming to Wi-Fi helps minimize the strain on LTE and 5G networks, allowing operators to use their backhaul resources more efficiently.
   ‍
5. Premium Content Delivery and Video Optimization
   Operators can leverage the ePDG to offer premium services like video streaming and music playback. By connecting subscribers to operator-hosted content (like video and music libraries) through the ePDG, operators can deliver optimized, high-quality content without requiring users to switch networks. For example, a video streaming service could offer higher-resolution streaming on operator-owned Wi-Fi networks, ensuring an uninterrupted, superior viewing experience.

‍

ePDG in Virtualized Networks

Virtualization has made it possible to deploy the ePDG as a software-based solution, reducing costs and offering greater flexibility than traditional, hardware-based solutions. Virtualized ePDGs can run on commercial off-the-shelf (COTS) servers and integrate easily with third-party EPC solutions. This virtualized deployment model allows operators to scale the ePDG efficiently and respond to the growing demand for secure, high-quality Wi-Fi services.

‍

Conclusion

The ePDG is a fundamental component in modern mobile networks, bridging the gap between LTE/5G cores and non-3GPP networks like Wi-Fi. IPsec encryption, seamless session handoff, and robust authentication ensure secure, high-quality access for mobile users in various settings. From improving network security to enabling flexible service deployment, the ePDG empowers mobile operators to expand their reach and meet the growing demands for connectivity.

As mobile traffic increasingly shifts to Wi-Fi, the importance of the ePDG will only continue to grow, especially with advancements in virtualization, which allow virtualized ePDG deployments to offer scalable, flexible solutions for the future.

‍

ng-voice's ePDG offering for VoWiFi

ng-voice offers a virtualized ePDG solution running in the cloud on commercial public cloud providers' servers, delivering the following benefits:

• Scalability: The solution can easily scale to handle high volumes of encrypted traffic, meeting the demands of next-generation mobile networks. Operators can add capacity as needed and take advantage of a highly automated solution.
• Cost-efficiency: This virtualized ePDG reduces CAPEX and OPEX for mobile operators, making it a cost-efficient solution.
• Interoperability and compliance: ng-voice's ePDG is easy to integrate with third-party EPC solutions because it runs on commercial off-the-shelf (COTS) servers and fully complies with industry standards, ensuring compatibility with different components in the core network.

‍

Learn more about Voice over Wi-Fi here: What is Voice over Wi-Fi (VoWiFi)

‍

About ng-voice

ng-voice is a Germany-based telco software provider, committed to making telco simple with software and automation at scale.ng-voice’s flagship product - the Hyperscale IMS (IP Multimedia Subsystem)Solution - is infrastructure-agnostic, cost-efficient and highly automated and delivers VoLTE, VoNR and VoWiFi while significantly lowering the Total Cost of Ownership (TCO).

LinkedIn: www.linkedin.com/company/ngvoice

Web: www.ng-voice.com

Contact: sales@ng-voice.com

‍

You might also be interested in:

• ‍Understanding 3GPP
  ‍
• Session Initiation Protocol (SIP) in the IMS architecture
  ‍
• What is Voice over LTE (VoLTE)
  ‍
• What is Voice over New Radio (VoNR)
  ‍
• What is an IP Multimedia Subsystem (IMS)