Trusted access through TWAG lets the operator bring all of that traffic back into the core. Here is how our solution works, why it runs with any access points, and what it offers MNOs and MVNOs.
Figure 1 — How TWAG works
Trusted and untrusted access
The 3GPP TS 23.402 specification describes two ways to connect Wi-Fi to an operator’s packet core. The difference is whether the operator trusts the network the subscriber is coming from.
Untrusted access is designed for any network, whether it’s the subscriber’s home router or Wi-Fi in a coffee shop. The operator has no control over it, so the mobile device protects the traffic itself. It builds an IPsec tunnel to the ePDG gateway, and the ePDG hands the session to the core over the S2b interface. This is how Wi-Fi Calling works, and today it is available on almost every smartphone.
Trusted access is used in a network the operator controls. All of the subscriber’s traffic passes through the core, not just calls, so the operator loses neither the traffic nor control over it. The phone doesn’t need an IPsec tunnel, so speeds are the same as on regular Wi-Fi. The subscriber connects with their SIM, without passwords, and keeps their number, plan and services, just as on LTE.
| Untrusted access (ePDG) | Trusted access (TWAG) | |
| Network type | Any network, not controlled by the operator | A network the operator trusts, with WPA2/WPA3-Enterprise |
| Authentication | SIM-based, when the IPsec tunnel is set up | SIM-based, via 802.1X/EAP-AKA when connecting to the access point |
| Traffic protection | IPsec tunnel from the phone to the ePDG | WPA2/WPA3 radio link encryption, no IPsec needed |
| Interface to PGW/SMF | S2b | S2a |
| Traffic in the VAS Experts solution | Voice, SMS, video calls | Internet traffic and mobile services |
For the subscriber, the difference is barely noticeable, but for the operator it is fundamental. Wi-Fi Calling brings only calls back into the core. Trusted access brings back all traffic and makes Wi-Fi a full-fledged part of the network. That leaves the question of who, in this setup, verifies the subscriber’s SIM, opens a session for them and passes the traffic to the core. That takes a dedicated trusted access gateway: TWAG which VAS Experts has now.
TWAG architecture
TWAG (Trusted Wireless Access Gateway) is a gateway that turns Wi-Fi into another operator access network on par with LTE. It lets the subscriber connect to an access point using their SIM card, with no passwords or portals, get an address from the operator’s pool and use their own plan and services.
TWAG sits between the Wi-Fi access points and the operator core. It talks to access points over RADIUS, to the HSS over SWx, and to the PGW / SMF over S2a and GTP-U. In our implementation, the gateway has four core functions.
| Function | What it does |
| SIM authentication | Receives EAP-AKA messages from the access point over RADIUS and verifies the subscriber. It gets authentication vectors from the HSS over SWx or STa; the method is chosen based on the phone’s identity |
| Core session | Opens a session for the subscriber on the PGW / SMF over S2a, in the right APN and with the subscriber’s policies |
| Address assignment | Assigns the phone an address from the operator’s pool via DHCP and becomes its default gateway |
| Traffic forwarding | Encapsulates subscriber traffic in GTP-U and forwards it to the core, via DPDK or the OS network stack |
The phone finds the operator’s network through a Passpoint profile or a known SSID. SIM authentication takes about a second. TWAG then opens a session, the phone gets an address, and traffic is already flowing through the operator’s DPI and PCEF with the same plans, quotas and lawful interception points as on LTE. When the phone reconnects, the access point runs EAP authentication again, while the core session is preserved. The subscriber keeps the same IP address and the same services.
Beyond its core functions, TWAG keeps session records through RADIUS Accounting and can disconnect a subscriber. If a SIM is blocked, the gateway sends a RADIUS Disconnect command to the access point.
TWAG in VAS Experts products
TWAG is one of the components of the VAS Experts TWAN solution, which brings together the tools for trusted and untrusted Wi-Fi access to the operator network. The complete solution includes five components (see Table 1).
Table 1 — Wi-Fi solution components
| Component | Role in the solution |
| TWAG | Trusted access; carries subscriber data without IPsec |
| ePDG | Untrusted access; carries voice and SMS (Wi-Fi Calling) |
| PGW / SMF | Session management and address assignment from the operator’s pool |
| DPI | Traffic processing, filtering, NAT, prioritization |
| PCEF | Policy enforcement and charging over Gx and Gy via PCRF and OCS |
The key part of the solution is the pairing of two gateways, TWAG and ePDG. Traffic is split: data goes through TWAG without encryption, and for a call the phone brings up an IPsec tunnel to the ePDG inside the session that is already open, just as it would on any home Wi-Fi. Both gateways hand the subscriber over to the same core, and our ePDG already serves Wi-Fi Calling in an operator’s commercial network.
Figure 2 — The complete solution: TWAG, ePDG, PGW / SMF, PCEF and DPI
If the operator doesn’t have its own core, our IMS, HSS, MME and UPF are added to these components. If it does, the gateways connect to it over the standard S2a, S2b, SWx, STa and RADIUS interfaces, including to equipment from other vendors.
Table 2 shows which services the pairing provides and which components deliver them.
Table 2 — Services and components
| Service | How it works | Component |
| Password-free SIM connection | 802.1X / EAP-AKA, authentication vectors from the HSS, access points from any vendor | TWAG, HSS |
| Session and address just like on LTE | S2a to the PGW / SMF: APN, address from the operator’s pool, assigned via DHCP | TWAG, PGW / SMF |
| Internet | Routing, NAT, filtering, protection | UPF, DPI |
| Policies and charging | Gx / Gy: quotas, whitelists, priorities, per-service QoS; CDRs | PCEF, DPI, PCRF and OCS |
| Enterprise access | APN → address pool → VRF, per-subscriber policies | PGW / SMF, DPI |
| Voice, SMS, video calls | Wi-Fi Calling: IPsec tunnel to the ePDG over the data session, ims APN | ePDG, IMS |
| Lawful interception | All Wi-Fi traffic passes through the PGW, with the same interception points as for LTE | PGW / SMF, DPI |
| Disconnection and access control | Commands from the AAA or HSS disconnect the subscriber at the access point; RADIUS accounting | TWAG |
| Monitoring and troubleshooting | Prometheus / Grafana metrics, subscriber tracing by IMSI, MSISDN or MAC | TWAG, monitoring |
Why mobile and virtual operators need TWAG
An MNO, an operator with its own spectrum and base stations, already has coverage. For an MNO, Wi-Fi is a way to make the network cheaper and denser where cellular service falls short. TWAG helps an MNO tackle several tasks:
- Offload macro cells at stadiums, train stations and shopping malls, where they get overloaded at peak hours.
- Provide indoor coverage without DAS or small cells. A Wi-Fi 6 access point costs significantly less than a small cell, and installation takes days.
- Bring traffic that already goes over Wi-Fi back into the core, together with charging, policies and lawful interception.
- If the group includes a fixed broadband provider, build a converged “home + mobile” product.
Use case: The provider’s home routers
The group includes a provider with hundreds of thousands of home and building routers. Each one gets a second operator SSID with Passpoint support. A subscriber visiting friends or out in the yard connects to it automatically with their SIM and gets Wi-Fi speeds where LTE can’t reach. Router traffic is already aggregated in the provider’s network and arrives at TWAG over IP.
For a large operator, TWAG is primarily a way to offload cells and provide indoor coverage. But the most interesting part concerns MVNOs.
An MVNO, a virtual operator, has no radio network of its own and runs on a host operator’s network. TWAG lets such an operator have its own access network for the first time, which means part of its traffic no longer has to be paid for to the host operator.
- Pay the host less. Every gigabyte a subscriber uses on the MVNO’s own Wi-Fi doesn’t have to be bought wholesale.
- Be present where the host has no coverage, for example at remote sites.
- Sell B2B customers SIM-based enterprise access on office Wi-Fi.
TWAG hands the subscriber over to the operator’s core, so the MVNO needs its own HSS and PGW, which means a full MVNO model.
Use case: A remote work camp
Remote work camps, ships, mines, construction sites: places where there is no macro network and never will be. Standard Wi-Fi 6 access points are installed on site, and their traffic reaches TWAG in the operator core over a satellite link. People connect with their SIMs and make calls from their own numbers via Wi-Fi Calling, while the employer gets managed access with policies and accounting. For an MVNO, this is its own point of presence without a host operator.
Performance and sizing
A single TWAG server handles up to 100 Gbps of traffic and up to 50,000 subscriber connections per second. One million sessions require 36 GB of memory. For full performance, traffic is processed in user space via DPDK, bypassing the OS network stack. Under light loads, the OS network stack can be used on any virtual machine.
Typical deployment profiles:
| Profile | Subscribers | Traffic | TWAG | ePDG | PGW/SMF | DPI + PCEF | Servers |
| Starter | 50,000 | 10 Gbps | 1 + 1 VM | 1 + 1 VM | 1 + 1 VM | 1 + 1 VM | 2 |
| Regional | 300,000 | 30 Gbps | 1 + 1 | 1 + 1 | 1 + 1 | 2 + 1 | 9 |
| National | 1,000,000 | 100 Gbps | 2 + 1 | 2 + 1 | 1 + 1 | 6 + 1 | 15 |
| Operator group | 3,000,000 | 300 Gbps | 6 + 1 | 3 + 1 | 3 + 1 | 17 + 1 | 33 |
The calculation is based on an x86 server with 32 cores, 128 GB of RAM and two 100GbE ports. If one node fails, the load on the remaining nodes stays below 60%. In the Starter profile, all components run as virtual machines on two servers. The ePDG is sized for the voice and SMS of Wi-Fi subscribers, while DPI and PCEF are sized for the subscribers and traffic of the entire network, not just Wi-Fi. Scaling is done by adding nodes, with no platform replacement.
On our test bed, the entire subscriber path, from the phone to the core, is built on VAS Experts products. You can see firsthand how a subscriber moves to Wi-Fi, how their traffic is charged and how a call works through the ePDG. We can demonstrate the test bed with your SIM cards and access point. A pilot at your site takes 4–6 weeks.
Figure 3 — Demo test bed
The solution is deployed across two sites with N+1 redundancy, and session state is stored in Redis. If a node restarts, the subscriber won’t notice. It can be delivered on a physical server, a virtual machine, in Kubernetes or in the cloud.
Use case: A stadium on match day
Tens of thousands of spectators gather at the arena, and the macro cell can’t cope. Hundreds of Wi-Fi 6 / 6E access points broadcasting the operator’s SSID are installed under the stands. Fans’ phones switch to Wi-Fi automatically using their SIMs, and traffic for the entire arena is handled by a single TWAG node with up to 100 Gbps of throughput. The cellular network remains for voice and for people on the move.
Summary
Trusted and untrusted access don’t compete; they complement each other. When TWAG and ePDG work together, each gateway serves its own share of the traffic:
- TWAG passes subscriber data to the core without an IPsec tunnel, with the same number, plan and policies as on LTE;
- ePDG passes voice and SMS to the IMS through an IPsec tunnel inside the data session;
- the core, policies, charging and lawful interception remain shared between LTE and Wi-Fi.
The solution has been tested in a live operator environment, on the test beds of an active MVNO; Wi-Fi Calling on the ePDG runs in an operator’s commercial network, and DPI and PCEF are in commercial operation. The solution can replace Cisco SaMOG and Ericsson Wi-Fi Mobility Gateway. For 5G, the trusted access architecture will evolve toward TNGF / TWIF and ATSSS.
See TWAG in action. We’ll run a demo on our test bed with your SIM cards and access point, from connection to call. A pilot at your site takes 4–6 weeks.
