Stingray TWAG: SIM-based Wi-Fi access to the operator core

About the solution

Stingray TWAG (Trusted WLAN Access Gateway) is a software gateway for mobile network operators (MNOs) and mobile virtual network operators (MVNOs) that lets them build a TWAN (Trusted WLAN Access Network), a trusted Wi-Fi access network based on the 3GPP standard. Together with the operator’s access points and a 3GPP AAA server, TWAG turns Wi-Fi into one more access network on par with LTE. Subscribers connect to an access point with SIM-based authentication, with no passwords or captive portals, get an IP address from the operator’s pool and use their own plan and services.

TWAG sits between the Wi-Fi access points and the operator’s core. It talks to the access points over RADIUS, to the HSS over SWx, and to the PGW / SMF over S2a and GTP-U. Stingray TWAG also performs the TWAP (Trusted WLAN AAA Proxy) functions: it receives RADIUS from the access points and queries the AAA over STa.

Why operators need TWAG

Offload the mobile network

Shift part of the traffic from congested macro cells to Wi-Fi in high-density areas.

Extend coverage

Provide access in buildings, venues and facilities where the cellular signal is weak or unavailable.

Keep control over traffic

Bring Wi-Fi traffic back into the operator's core, where policies, charging and lawful interception are applied.

Develop converged services

Combine mobile access and Wi-Fi, including over home routers and enterprise networks.

How Stingray TWAG works

Wi-Fi connection

The subscriber connects to the operator's SSID through a Wi-Fi access point.

SIM authentication

TWAG verifies the subscriber by SIM: 802.1X / EAP-AKA′ via the operator's 3GPP AAA server (STa interface), which retrieves data from the HSS.

Core connection

TWAG establishes a session with the PGW over the S2a interface.

Traffic delivery and policy enforcement

DPI and PCEF handle traffic processing, policy enforcement and accounting. For Wi-Fi Calling, the phone connects to IMS through the ePDG.

Architecture

Integration with the operator’s core

TWAG connects to the PGW over the S2a interface. PCEF and DPI are used for policy and traffic management. Voice and SMS over Wi-Fi are supported with IMS through the ePDG.

Test Stingray TWAG on your network.

We will show the full subscriber path: a Wi-Fi connection through TWAG and an LTE connection through an eNodeB, with a shared core and shared policies. The demo can run with the customer’s own SIM cards and access point.

Request a personalized demo and solution testing

Deployment options

Bare-metal server

x86, Linux, DPDK

Virtual machine

KVM, Proxmox, VMware and other platforms

Container

Docker, Podman, Kubernetes

Cloud

AWS, Microsoft Azure, Google Cloud and private OpenStack clouds

Stingray TWAG features

Automatic authorization

802.1X / EAP-AKA′ via the operator's 3GPP AAA server, with no passwords and no separate client app.

Session in the operator's core

S2a interface to the PGW. The APN is selected by operator rules based on the device's IMSI, MSISDN and IMEISV: lists, ranges and masks, with the first matching rule applied, from specific to general. The subscriber gets an IP address from the operator's pool, just as on the cellular network.

Policies and charging

Quotas, whitelists, priorities, per-service QoS and traffic accounting: TWAG receives rules from the PCRF (Gx), while charging and traffic processing take place in the operator's core (PCEF, DPI, OCS).

Seamless Wi-Fi ↔ LTE handover

Subscribers keep their IP address and sessions when moving between Wi-Fi and the cellular network.

Enterprise access

An enterprise APN is assigned automatically based on the employee's IMSI, MSISDN or IMEISV; VRF isolation is performed in the operator's core.

Voice and SMS over Wi-Fi

Wi-Fi Calling (VoWiFi) together with Stingray ePDG: the phone sets up an IPsec tunnel to the ePDG over the TWAG internet session, and the ePDG connects it to IMS over S2b. The same ePDG serves subscribers on third-party Wi-Fi networks.

Monitoring and access control

Prometheus metrics and Grafana dashboards; subscriber tracing by IMSI, MSISDN and MAC; RADIUS Accounting; forced subscriber disconnection at the access point (RADIUS Disconnect-Message).

Use cases

RAN offload and in-building coverage: stadiums, train stations, airports, shopping malls and business centers. Wi-Fi 6 / 6E complements the macro network where it is congested or the signal is weak.

Home Wi-Fi as part of the operator network: an additional SSID on the home and building routers of a converged operator. Subscribers connect by SIM, and traffic reaches the core over the fixed broadband network.

Managed Wi-Fi at venues: a secure SSID for the operator’s subscribers in shopping malls, airports, arenas and hotels.

Enterprise APN over Wi-Fi: employees connect to the corporate network by SIM and get access through an enterprise APN; VRF isolation is performed in the operator’s core. The operator can apply policies and keep per-subscriber accounting.

Transportation: SIM-based Wi-Fi access on the metro, trains and buses with no ad-driven portals. Traffic is delivered to the operator’s core.

Wholesale access for MVNOs: giving MVNOs and roaming partners access to the operator’s Wi-Fi network over standard interfaces.

Your own Wi-Fi access where there is no cellular coverage: remote work camps, vessels, mines, construction and underground sites. Subscribers connect by SIM and use MVNO services over a satellite or terrestrial link.

Enterprise Wi-Fi with SIM-based identification: employees connect to the corporate network by SIM and get access through an APN and VRF, with no VPN clients or passwords.

“Home + mobile” bundle: a second SSID from the mobile operator on the provider’s home Wi-Fi routers lets devices with that operator’s SIM connect to the home Wi-Fi network automatically and use the home internet connection for data.

Transportation: SIM-based Wi-Fi on buses, trains and the metro with no ad-driven portals. Subscribers connect to the operator’s network, and traffic is delivered to the core.

IoT and terminals: POS terminals, cameras, sensors and wearables with eSIM: Wi-Fi indoors and LTE outdoors, with handover between networks and no change of IP address.

Public venues: a secure SSID for the operator’s subscribers in shopping malls, airports and stadiums.

Connectivity at remote sites: voice calls and SMS over Wi-Fi (together with Stingray ePDG) where there is no cellular coverage.

Wholesale access: selling SIM-based Wi-Fi access to subscribers of other operators and MVNOs over standard 3GPP interfaces (STa, S2a).

Stingray TWAG advantages

VAS Experts products in one solution

TWAG, ePDG, PGW / SMF, PCEF and DPI are developed by one team and supplied by a single vendor under one support contract.

Integration with your existing network

Standard S2a, STa, Gx and RADIUS interfaces (including Disconnect-Message) let you integrate TWAG with your existing PGW, HSS and AAA without replacing the network core.

Proven with operators

TWAG has been tested on the infrastructure of an operating MVNO. Stingray ePDG (VoWiFi) runs in operators' commercial networks.

Flexible deployment and scaling

TWAG can be deployed on a server, a virtual machine, in a container or in the cloud. The architecture scales from two servers to a nationwide network.

Request a Free Stingray TWAG Demo

We will contact you, specify the task, provide access to the documentation and answer your questions.

We discuss the current situation: traffic volume, available equipment, the functionality you need.

Our engeniers install the selected software and adapt it to your specific tasks. Сontract — only after the test is successful.

Name *

E-mail *

Phone Number *

Company Name *

Comments

I agree to the VAS Experts Privacy Policy and License Agreement

TWAG