What is an ePDG in telecom?
In the 4G architecture, the ePDG is the entry point for untrusted non-3GPP access, with public or home Wi-Fi as the typical case. The operator does not control such a network, so traffic from it cannot be treated like traffic from its own base station. The ePDG sits at the border: the phone builds an encrypted tunnel to it, the operator checks who the subscriber is, and only then is the session passed into the core.
The practical result is Wi-Fi Calling (VoWiFi): voice and SMS on the subscriber’s own number over any Wi-Fi network, with no separate app. According to VAS Experts’ glossary, VoWiFi over untrusted Wi-Fi cannot be properly implemented in an LTE architecture without an ePDG. For the short definition, see the ePDG glossary entry.
Operators deploy an ePDG for several reasons: voice service where cellular coverage is weak or absent (remote households, new neighborhoods, high-rise buildings, large offices and malls), lower traffic costs for MVNOs, and roaming over Wi-Fi.
How the ePDG service works
An ePDG service runs as a sequence of four steps:
- The phone connects to an available Wi-Fi network.
- It establishes a secure tunnel to the ePDG. The phone does this with a mechanism built into it, and the tunnel is transparent to the local Wi-Fi access point.
- The subscriber is authenticated by SIM against the operator’s AAA server.
- Voice and user traffic enter the operator’s core and travel through the EPC much like an LTE session.
Calls can move between Wi-Fi and LTE (handover) with minimal or no interruption. VoWiFi and VoLTE run on the same core network and use the same HD codecs.
ePDG architecture
An ePDG is a gateway between three groups of nodes.
Towards the subscriber. The phone (UE) connects over any Wi-Fi access point. The ePDG terminates the IPsec tunnel, using IKEv2 for key negotiation. A separate tunnel is created for each packet data network (PDN) session.
Towards authentication. The ePDG relies on the operator’s 3GPP AAA server, which checks the SIM. Authentication uses EAP-AKA, so identification is tied to the SIM in the same way as in the mobile network. The AAA data can also feed QoS decisions.
Towards the core. After authentication the ePDG sets up the session with the packet gateway (PGW), and the traffic continues through the EPC. Policy and charging rules are typically applied through the PGW and the PCRF, not by the ePDG alone. For voice, the session reaches the IMS subsystem the same way a VoLTE session does.
IPsec is resource-intensive: the node encrypts and decrypts every tunnel, so throughput and latency under encryption load are worth testing early rather than assuming.
A common point of confusion is the difference between ePDG and PGW. The PGW connects the mobile core to external IP networks and the internet. The ePDG provides secure subscriber access into that core over Wi-Fi and other non-3GPP networks. The PGW handles the outbound connection to data networks, and the ePDG handles secure inbound access through alternative access. VAS Experts also builds a PGW, and the two nodes work together in a VoWiFi chain.
ePDG interfaces
The table lists the main reference points of an ePDG. The names come from the 3GPP specifications.
| Interface | Connects | Purpose |
| SWu | UE and ePDG | IPsec/IKEv2 tunnel from the phone; carries the EAP-AKA exchange |
| SWm | ePDG and 3GPP AAA server | Subscriber authentication and authorization, plus subscription data |
| S2b | ePDG and PGW | Carries the subscriber’s session from the ePDG into the packet core (3GPP defines GTP- and PMIPv6-based variants; check which one a vendor supports) |
| S6b | PGW and 3GPP AAA server | Mobility-related authentication and authorization for non-3GPP access. The PGW informs the AAA server about the session and can retrieve a static QoS profile when dynamic policy control is not used. The ePDG does not use S6b directly, but it is part of the VoWiFi chain. The PGW also registers its address with the AAA server and HSS over S6b, so after a move from Wi-Fi to LTE the network selects the same PGW and the phone keeps its IP address. |
| SWn | Untrusted non-3GPP IP access and ePDG | Path between the untrusted Wi-Fi access network and the ePDG. Traffic of a tunnel initiated by the phone has to be forced towards the ePDG, which terminates it |
Two notes on the table. The AAA server in turn queries the subscriber database (HSS) over the SWx interface, so the SIM check ends in the operator’s own data. And in the standard 3GPP architecture IMS signalling does not terminate on the ePDG itself. It flows through the tunnel and the PGW to the IMS core, which is why IMS integration is a question about the whole chain, not about the ePDG alone.
ePDG and IMS core integration
VoWiFi, like VoLTE, is an IMS service. The ePDG provides secure access; the IMS core provides registration, call control and the voice service itself. For an operator, integration with the IMS core means checking several things at once:
- Core and IMS integration. The ePDG is normally integrated with the EPC, the IMS subsystem and roaming nodes.
- Voice parity with VoLTE. The same core network and the same HD codecs, so the subscriber does not notice which access is in use.
- Handover. Calls move between Wi-Fi and LTE without interruption.
- Emergency calls. If cellular coverage is unavailable, the phone may route the emergency call over Wi-Fi, and the subscriber should still reach local emergency services.
- SIM configuration. The SIM should carry the correct settings for IMS services, including the ePDG domain.
Many operators start VoWiFi once VoLTE is already running, because the infrastructure and deployment processes are similar. ePDG deployment is also used in places with no 2G/3G/LTE coverage at all, as a way to provide voice service where cellular build-out is incomplete.
What a real launch looks like
The gateway is the part you can test in a lab. The phones, the SIM and the domain are harder. VAS Experts’ case study with the MVNO Miatel, which in early 2025 became the first operator to commercially launch Wi-Fi Calling on Stingray ePDG, shows where time went:
- The ePDG domain. Getting the ePDG service domain from the GSMA took a long time and needed persistent follow-up.
- The security certificate. It did not work correctly at first, and the operator and vendor had to resolve the details together.
- The SIM and the phone. After the SIM was configured, the phone did not recognise the new domain stored on the SIM and refused to connect. Fixing this meant looking into Android, manufacturer configurations and the phone modem.
- Per-device settings. Some phone models can be configured and others cannot. There is no universal method, so each model needs its own approach, and working directly with phone manufacturers is the workable route.
The lesson for planning: budget a VoWiFi timeline around the SIM, the domain and the device list, not only around the gateway.
How to choose an ePDG vendor
Feature lists look similar across vendors, since most support the 3GPP basics. The questions that separate them are practical. Use this checklist and ask each vendor for evidence, not claims.
Standards and security
- Does it support IPsec/IKEv2 on the SWu side and EAP-AKA authentication, with one tunnel per PDN session?
- Which 3GPP releases and interfaces (SWu, SWm, S2b) does it implement, and is there a datasheet that lists them?
Integration
- Has it been integrated with an IMS core and an EPC like yours, and with which AAA and PCRF nodes?
- What is the handover behaviour between Wi-Fi and LTE, and are the same HD codecs used as in VoLTE?
- How are emergency calls handled?
Performance and scaling
- How does it scale, and what is the encryption load per node? Ask for test results on your traffic profile, not only a headline number.
- Can it run on standard hardware, or does it need a proprietary platform?
Operational control
- Can you restrict connection to specific Wi-Fi hotspots or leave the choice to the subscriber?
- Which QoS parameters can be driven from AAA data?
Delivery and proof
- Can the vendor show a commercial deployment at an operator of your type (MNO or MVNO) and describe what went wrong along the way?
- Who handles the SIM configuration, the ePDG domain request, the certificate and the device-by-device testing, and what experience does the vendor have with phone manufacturers that respond slowly to a small operator’s requests?
- Can you test the product on your own equipment before signing a contract?
Vendor continuity
- Is the product actively developed? Check release history and dated documentation, not only the product page.
- What does support and a roadmap look like for the next three to five years?
A short test plan helps here. Ask for a trial on your own equipment, run the IMS registration and handover on the real list of target phone models, and only then compare commercial terms.
ePDG from VAS Experts
VAS Experts builds its own software ePDG, Stingray ePDG, as part of its offer for operators and MVNOs. The product page describes EAP-AKA SIM authentication, IPsec/IKEv2 tunnels per PDN session, QoS based on AAA information, handover between Wi-Fi and LTE, operator control over Wi-Fi hotspot selection. The VoLTE and VoWiFi solution adds IMS integration and SIM configuration expertise. A datasheet and product overview are available for download, and the product can be tested on the operator’s own equipment, with a contract only after a successful trial.
FAQ
What is ePDG in simple terms?
It is a secure gateway between a phone connected over Wi-Fi and the operator’s mobile network. It lets subscribers use voice and SMS services securely over any Wi-Fi network.
What protocols and authentication does an ePDG use?
IPsec secures the tunnel and IKEv2 negotiates the keys. Subscribers are authenticated with EAP-AKA, which relies on SIM data.
Does an ePDG require VoLTE to be deployed already?
The ePDG works with the EPC (and with 5GC via a combined SMF/PGW-C) and the IMS subsystem, not with base stations. Many operators still launch VoWiFi on top of an existing VoLTE deployment because the infrastructure is similar, but what VoWiFi does need is an IMS core, so confirm the target IMS design with your vendor.
What is the difference between ePDG and PGW?
The PGW connects the mobile core to external IP networks and the internet. The ePDG provides secure access to that core from Wi-Fi and other non-3GPP networks. In a VoWiFi session the traffic passes through both.
Is ePDG only for large operators?
No. A local-sized MVNO, Miatel, was the first operator to commercially launch Wi-Fi Calling on Stingray ePDG.
