Roaming & OperationsL3

3GPP-Wi-Fi Interworking

Roaming Reference

3GPP - Wi-Fi Interworking Reference - 3GPP TS 23.402, TS 24.302, TS 23.501 | IETF RFC 6733, RFC 40727 rows#

Topic	Standard	Description	Key Interfaces / Protocols	Engineering Notes
VoWiFi Architecture (Wi-Fi Calling)	3GPP TS 24.302 TS 23.402	Voice over Wi-Fi (VoWiFi) allows IMS voice calls over Wi-Fi using the same infrastructure as LTE/5G IMS. Architecture: UE (phone) → ePDG → PGW → IMS core. Call quality is equivalent to VoLTE if the Wi-Fi link has sufficient quality (< 150ms RTT, < 1% loss, jitter < 30ms).	SWu interface: IKEv2 (RFC 7296) + IPsec ESP tunnel between UE and ePDG SWm interface: Diameter-based AAA between ePDG and 3GPP AAA Server S2b interface: GTPv2-C between ePDG and PGW IMS registration over IPsec tunnel: SIP over UDP/TCP	Emergency calls (E911): VoWiFi must route to PSAP. ePDG fetches location (cell-ID + GPS) and passes to E-CSCF. Requires IMS Emergency Registration.
ePDG (Evolved Packet Data Gateway)	3GPP TS 23.402 §4.3	ePDG is the security gateway for non-3GPP (Wi-Fi) access to the 3GPP EPC/5GC. It terminates IKEv2/IPsec from the UE, performs EAP-AKA authentication via 3GPP AAA server, and establishes GTPv2 bearer to PGW.	UE→ePDG: IKEv2 with EAP-AKA (RFC 4187) inside IKE AUTH exchange. USIM-based authentication. ePDG→PGW: GTPv2-C on S2b interface. PDN connections established per APN. ePDG→3GPP AAA: Diameter SWm interface. AAA validates EAP-AKA RAND/SRES.	ePDG discovery: DNS lookup for epdg.epc.mnc<MNC>.mcc<MCC>.pub.3gppnetwork.org. UE must perform DNS SRV lookup before IKEv2. IMSI-based realm routing.
IKEv2 / IPsec for Wi-Fi Access	RFC 7296 (IKEv2) 3GPP TS 24.302	IKEv2 authenticates UE to ePDG and establishes IPsec ESP tunnel for all traffic. UE authenticates using EAP-AKA/AKA' (USIM-based) or EAP-TLS (cert-based for MDM managed devices).	IKE SA: DH group (MODP-2048 min), PRF-HMAC-SHA256, ENCR-AES-CBC-256 Child SA (ESP): ENCR-AES-GCM-256, ESN (Extended Sequence Numbers) Configuration Payload: UE requests IP address from ePDG Notify payloads: 3GPP-specific (APN, PDN type, PCO)	IKEv2 MOBIKE (RFC 4555): allows tunnel to survive IP address change (Wi-Fi → cellular handover). Critical for seamless transition.
N3IWF - 5GC Non-3GPP Interworking	3GPP TS 23.501 §5.13 TS 24.502	N3IWF (Non-3GPP Interworking Function) is the 5G Core equivalent of ePDG. Allows UE to connect to 5GC via untrusted non-3GPP access (Wi-Fi). UE establishes NWu (IKEv2/IPsec) tunnel to N3IWF, then NAS signaling flows through the tunnel to AMF.	NWu interface: IKEv2/IPsec (same as SWu but for 5GC) N2 interface: N3IWF↔AMF (NGAP over SCTP) N3 interface: N3IWF↔UPF (GTP-U) NAS over NWu: UE encapsulates NAS in IKE INFORMATIONAL or child SA EAP-5G: inner EAP method in IKEv2 AUTH for 5GC registration	N3IWF vs ePDG: N3IWF supports full 5G NAS (PDU Sessions, network slicing, URSP). ePDG only supports EPC PDN connections. N3IWF enables 5G QoS, network slicing over Wi-Fi.
Trusted WLAN AGF (TWAG)	3GPP TS 23.501 TS 23.402	Trusted Wi-Fi: operator-managed Wi-Fi APs that authenticate UEs using 3GPP credentials (EAP-AKA/SIM) without IPsec. The TWAG/TNGF (Trusted Non-3GPP Gateway Function) provides secure access without tunnel overhead.	TNGF: 5GC trusted access (TS 23.501) TWAP (Trusted WLAN Access Point): operator AP with 802.1X/EAP-AKA W-5GLAN: Wi-Fi LAN service in 5GC (TS 23.501 §5.29) Interface N5CW: UE→TNGF for NAS signaling without IKEv2 tunnel	Trusted Wi-Fi eliminates IKEv2 overhead and latency (~50ms saved). Requires AP to be under operator control. Used in carrier Wi-Fi offload at airports, hotels (Passpoint).
ANDSF - Access Network Discovery & Selection	3GPP TS 24.312 TS 23.402	ANDSF (Access Network Discovery and Selection Function) is an OMA DM-based policy server that pushes Wi-Fi offload rules to UEs. Policies: ISRP (Inter-System Routing Policy) specifies which apps route via Wi-Fi vs cellular. ISMP (Inter-System Mobility Policy) controls handover triggers.	OMA DM: binary XML pushed to device Management Object (MO) ISRP: per-app routing rules. E.g. 'video streaming → Wi-Fi only' ISMP: RSRP/RSSI thresholds for handover Discovery: TS_24312 MO at /3GPP_ANDSF node Interworking with 802.11u ANQP: ANDSF supplements ANQP network selection	ANDSF being superseded by URSP (User Route Selection Policy) in 5G NR which uses NAS SM signaling directly. ANDSF still relevant for LTE/Wi-Fi offload.
Diameter for Wi-Fi AAA	RFC 6733 (base) RFC 4072 (EAP app) 3GPP TS 29.273	Diameter replaces RADIUS in carrier-grade Wi-Fi deployments and all 3GPP interfaces. Diameter provides: application-layer reliability, SCTP transport, peer discovery, capability exchange, failover, and better scalability than RADIUS UDP.	Key interfaces: SWd: WLC/NAS↔3GPP AAA (Diameter EAP app, RFC 4072) SWm: ePDG↔3GPP AAA (Diameter, TS 29.273) S6b: ePDG/PGW authorization (Diameter, TS 29.273) Sta: Trusted AP↔3GPP AAA Diameter base: SCTP/TCP transport, AVPs, realm-based routing, redirect agents	RADIUS vs Diameter for Wi-Fi: RADIUS - simple, UDP, no built-in failover. Diameter - SCTP, explicit failover, application-layer ACK, CER/CEA capability exchange. Use Diameter for carrier Wi-Fi, RADIUS for enterprise.

ADDITIONAL 3GPP/CARRIER WI-FI DETAILS3 rows#

Topic	Standard	Description	Key Interfaces / Protocols	Engineering Notes
Topic	Standard	Description	Key Interfaces / Protocols	Engineering Notes
Hotspot 2.0 / Passpoint R3	IEEE 802.11u-2011 802.11ai Wi-Fi Alliance Passpoint R3	Passpoint (Hotspot 2.0) allows devices to automatically discover and securely connect to carrier Wi-Fi networks without user interaction. Uses 802.11u GAS/ANQP for network capability discovery before association.	ANQP query (pre-association, via GAS): → Capability List: NAI realm list, 3GPP cellular network info, domain name list, venue name, IP address availability → Client queries AP: 'Do you support EAP-AKA for my SIM?' → AP responds from ANQP server Passpoint R3 adds: → OSU (Online Sign-Up) for self-provisioning → Enhanced MAC randomization with Network Access Identifier → Improved privacy protections Key IE: Interworking IE (tag 107) + HESSID in Beacon	Passpoint reduces Wi-Fi setup friction for cellular offload. Without Passpoint: user must manually select and configure hotspot. With Passpoint: seamless auto-connect using SIM credentials (EAP-AKA/AKA'). For enterprise: Passpoint enables managed guest Wi-Fi with carrier billing. Implementation: RADIUS must support 3GPP-IMSI-MCC-MNC (RFC 4372) for SIM routing.
Diameter vs RADIUS for Wi-Fi AAA	RFC 6733 (Diameter) RFC 2865 (RADIUS) 3GPP TS 29.273	Carrier-grade Wi-Fi deployments replace RADIUS with Diameter for improved reliability, security and scalability.	Interface differences: • Transport: RADIUS=UDP (unreliable), Diameter=TCP/SCTP (reliable, connection-oriented) • Message model: RADIUS=request/response, Diameter=peer-to-peer (both sides initiate) • Failover: RADIUS manual config, Diameter built-in redirect/proxy failover • Message size: RADIUS max 4096B, Diameter virtually unlimited • Accounting: RADIUS Accounting-Request, Diameter ACR/ACA messages For 3GPP Wi-Fi interworking: • SWm interface (ePDG↔3GPP AAA): Diameter only • S6b interface (PDN-GW↔3GPP AAA): Diameter only • Wi-Fi AP to WLC: usually RADIUS (simpler, sufficient) • WLC to 3GPP AAA: Diameter (required for SIM authentication routing)	Protocol translation (RADIUS↔Diameter) done by Diameter agent (DRL/DEA) or WLC. Some WLCs have built-in RADIUS-Diameter translation for carrier Wi-Fi. RADIUS shared secret: minimum 22 character random string (RFC 3579). Diameter uses TLS/IPsec for transport security (no shared secret weakness).