The ePDG lets a subscriber on untrusted Wi-Fi into the operator’s core over an IPsec tunnel. The PGW connects the session to the internet and other IP networks and assigns the subscriber’s IP address. The S2b interface links the two; a Wi-Fi session and an LTE session can be anchored on the same PGW.
What does a PGW do in an LTE core?
The PGW, or PDN Gateway (packet data network gateway), is a node of the LTE/4G core network, the EPC (Evolved Packet Core). It connects subscribers to external networks. It assigns the subscriber’s IP address, routes packets and performs NAT (network address translation). The same node handles traffic management, QoS (quality of service) and billing.
Our PGW sits in the operator’s EPC at the border with external networks. It acts as the exit point for all user traffic to the external IP network, the internet. For addressing, our PGW can act as a DHCP server itself or use an external one.
In the 3GPP architecture, the PDN GW is the gateway which terminates the SGi interface towards the packet data network. Its functions include UE (user equipment) IP address allocation, per-user packet filtering, charging and DHCP functions.
What does an ePDG do, and why does Wi-Fi traffic need one?
The ePDG connects the operator’s core (EPC) with untrusted non-3GPP networks that need secure access, such as Wi-Fi access networks. The subscriber’s phone builds a secure connection to the ePDG, transparent to the local Wi-Fi access point. The subscriber is authenticated by SIM against the operator’s AAA (authorization, authentication and accounting) server.
Not every Wi-Fi network goes through the ePDG. Access from untrusted non-3GPP networks uses the ePDG, while trusted Wi-Fi, a TWAN (trusted WLAN access network), connects to the PGW over S2a.
Our ePDG creates an IPsec (Internet Protocol Security) tunnel from the user equipment for each PDN session, using IPsec/IKEv2 (Internet Key Exchange version 2). Authentication uses the operator’s SIM and EAP-AKA (Extensible Authentication Protocol, Authentication and Key Agreement). Our ePDG also integrates with the operator’s existing IMS (IP Multimedia Subsystem) core.
The device connects to an available Wi-Fi network, establishes a secure tunnel to the ePDG and authenticates on the operator’s network. Voice and user traffic then travel through the EPC core, just as they would over an LTE connection. We cover tunnels and IMS integration in more depth in ePDG Explained.
Where each node sits on the path from the phone to the internet
On LTE, user traffic typically follows this path: UE → eNodeB (the LTE base station) → SGW → PGW → external IP network. The SGW (Serving Gateway) does not connect the subscriber to the internet directly; the PGW does. In the 3GPP architecture, a phone on untrusted Wi-Fi reaches the PGW through an IPsec tunnel to the ePDG and then S2b.
LTE: UE → eNodeB → SGW –S5/S8–> PGW –SGi–> internet, IP networks
Untrusted Wi-Fi: UE –IPsec tunnel–> ePDG –S2b–> PGW
In the 3GPP architecture, a phone on untrusted Wi-Fi gets two types of IP address. One is used inside the Wi-Fi access network to reach the ePDG, the end point of the IPsec tunnel. One or more others are used towards external networks: the PGW allocates them, and the ePDG delivers them to the phone.
| Node | Where it sits | What it does |
|---|---|---|
| SGW | LTE path, between the eNodeB and the PGW | Does not connect the subscriber to the internet directly |
| ePDG | Between the EPC and untrusted Wi-Fi or other non-3GPP networks | Secure subscriber access to the core |
| PGW | EPC border with external networks | Connection to the internet and IP networks; traffic management, QoS, billing |
Our glossary covers the other functions of the SGW (Serving Gateway).
How the ePDG and PGW connect: S2b and the other PGW interfaces
S2b is the interface between the ePDG and the PGW. Our PGW works with a native S2b interface, which enables handover for VoWiFi (voice over Wi-Fi). On the PGW side, S2b sits next to the interfaces for LTE, trusted Wi-Fi, policy control, authentication and external networks.
Our PGW connects to the operator’s EPC over these interfaces:
| Interface | What it connects |
|---|---|
| S2b | ePDG and PGW |
| S5/S8 | S8 links the visited network’s SGW and the home PGW; without roaming, S5 links the SGW and PGW of one network |
| SGi | PGW and external data networks |
| Gx | PCRF (policy and charging rules function) and PGW, over Diameter |
| S2a | PGW and a TWAN, trusted Wi-Fi networks |
| S6b | PGW and authentication systems for subscribers of non-3GPP networks, on S2a and S2b |
Our PGW follows 3GPP standards and GTPv2 specifications. It processes all Information Elements (IEs) in Create Session Request messages and generates valid Create Session Response replies.
In the general 3GPP architecture, Gx links the PCRF with the PCEF (policy and charging enforcement function). The PCEF is part of the PGW functions, and PCRF policy is applied at the PGW.
What happens to a session when a phone moves between Wi-Fi and LTE
When a subscriber moves between base stations, and even between different SGWs, their PGW stays the same. With our PGW, the IP address stays the same during such moves. Our PGW supports session continuity when the phone switches between LTE and Wi-Fi, if the network uses an ePDG.
Under the 3GPP architecture, when a phone moves from LTE to untrusted Wi-Fi, the AAA server tells the ePDG which PGW serves the subscriber. After the handover, the session runs over an IPsec tunnel to the ePDG and on to that PGW. The PGW can reply with the same IP address it assigned earlier.
Phones switch between Wi-Fi and LTE to keep voice transmission uninterrupted. VoWiFi and VoLTE (voice over LTE) operate on the same core network and use the same HD codecs. Our page on VoLTE and VoWiFi covers the voice side.
Where each node fits in common operator scenarios
In mobile internet, the PGW carries user traffic out to the internet. In roaming, S8 connects the visited network’s SGW and the home PGW. In 5G NSA (Non-Standalone), the PGW performs the same functions for 5G traffic. For calls over untrusted Wi-Fi, the ePDG brings the subscriber into the core and S2b links it to the PGW.
| Scenario | What else the PGW side involves |
|---|---|
| Mobile internet over LTE | IP address assignment, packet routing, NAT |
| Roaming | In the home network, S5 links a local SGW and a local PGW |
| 5G NSA | The 5G radio, NR (New Radio), works on the 4G core (EPC) |
In our solution, the PCEF function runs as a separate product, Stingray Service Gateway. This is why we can also supply our PGW on its own: it then works with a PCEF made by other vendors.
How we work with operators on PGW and ePDG
We build Stingray PGW and Stingray ePDG to 3GPP standards. Our ePDG is software-based. Work with an operator starts with a request form, and the path from the first contact to the contract has five steps.
- You fill in the request form on the page of our PGW or our ePDG.
- We clarify the task and give you access to the documentation.
- Together we go through your current situation: traffic volume, available equipment and the functionality you need.
- Our engineers install the selected software on your hardware or virtual machine and adapt it to your tasks.
- After a successful test, we sign the contract.
Our PGW uses CUPS (Control and User Plane Separation) to support reliability and service continuity. Our own optimized data channel control protocol, BCP, supports performance and fault tolerance. A distributed session storage system lets processing modules work independently. We explain the reasons for the split in CUPS for PCEF and PGW.
FAQ
What does PGW stand for?
PGW stands for PDN Gateway, where PDN means packet data network. It is also written as PDN GW or P-GW. It is the LTE core node that gives subscribers access to external networks.
Which interface connects the ePDG and the PGW?
S2b connects the ePDG and the PGW, and our PGW supports S2b natively. On untrusted Wi-Fi, the session runs over an IPsec tunnel to the ePDG and S2b bearers to the PGW.
Does the subscriber’s IP address change when a call moves between LTE and Wi-Fi?
The IP address the phone uses towards external networks is allocated by the PGW; on Wi-Fi, the ePDG delivers it to the phone. Under the 3GPP architecture, when the phone moves from LTE to untrusted Wi-Fi, the PGW can reply with the same IP address.
How is QoS handled for traffic that comes through the ePDG?
QoS policy is defined in the core: the PCRF sends it to the PGW over Gx, and the PGW applies it to the session through its PCEF function, including sessions that come in over S2b. The ePDG gets the bearer QoS from the PGW over S2b and applies it to the IPsec tunnel on its part of the path. Our ePDG also uses subscriber information it gets from the AAA server.
Can a PGW work with a PCEF from another vendor?
Yes. In our solution, the PCEF runs as a separate product, so Stingray PGW can be delivered without it and work with a PCEF from other vendors. It complies with 3GPP standards and supports all necessary interfaces.
Is the PGW used in 5G networks?
Yes, in 5G Non-Standalone networks. There, the 5G radio (NR) uses the 4G network core (EPC). The PGW remains a key element and performs the same functions for 5G traffic.
