Skip to main content

ePDG — Evolved Packet Data Gateway

The ePDG is the secure gateway for untrusted Wi‑Fi access — the node behind Wi‑Fi Calling (VoWiFi) and untrusted‑WLAN data. A handset builds an IPsec/IKEv2 tunnel to the ePDG over any internet connection; the ePDG authenticates the subscriber against the AAA/HSS over Diameter (SWm/SWx), anchors the session to the packet core (S2b to the PGW), and enforces per‑subscriber rate limits and geo‑IP policy. OmniWeb surfaces the ePDG's live tunnels, its Diameter peers, rate‑limiting and geo‑IP configuration, and runtime settings; longer‑run trends are on the Grafana dashboards reached from the same page.

← Operations Guide

The ePDG is a per‑instance element page reached from the sidebar when one runs in the site's inventory. All traffic goes through the OmniWeb backend proxy, so it stays behind the single authenticated gateway. The documentation link in the page header (the in‑context help button) opens this page. It is organised into tabs.

Overview​

The ePDG overview — health, active tunnel/session counts and a summary of the gateway's state

A single‑screen health read: the ePDG's status, the number of active sessions (IPsec tunnels), and a summary of the gateway's operational state — the quickest confirmation that the ePDG is up and carrying Wi‑Fi‑calling tunnels.

Sessions​

The ePDG sessions tab listing active IPsec/IKEv2 tunnels by subscriber

Every active session — the IPsec/IKEv2 tunnels currently established — keyed by subscriber, with the tunnel and bearer state. A session can be inspected to see its detail; this is where you confirm a specific subscriber's Wi‑Fi‑calling tunnel is up.

Diameter​

The ePDG Diameter tab showing the SWm/SWx peer connections to the AAA/HSS

The Diameter peer connections to the AAA/HSS that carry authentication (SWm/SWx), with each peer's connection state — the first place to look when Wi‑Fi‑calling authentications are failing.

Rate Limiter​

The ePDG Rate Limiter tab showing the per-IP and per-IMSI thresholds, the count of currently blocked IPs and IMSIs, and a lookup box for inspecting and clearing a specific block

The ePDG terminates untrusted‑Wi‑Fi IPsec/IKEv2 tunnels (SWu) and bridges them to the EPC over S2b, which makes it exposed to any handset — or any source — on the open internet. The Rate Limiter is the defence against a client hammering tunnel setup: it throttles IKE flooding so a single misbehaving handset or attacking source cannot exhaust the gateway. The tab shows the enforced thresholds — the per‑IP and per‑IMSI request limits, each expressed as a number of auth attempts within a rolling window, and the block duration applied once a limit is breached — alongside a live count of how many IPs and IMSIs are currently blocked.

Below the thresholds you can look up any IP address or IMSI to see whether it is blocked and how many failures it has accumulated, and clear that block so future auth attempts from it are allowed again; a single Clear All action drops every block and resets all failure counters at once. This is where an operator confirms why a subscriber's Wi‑Fi‑calling tunnel is being refused, and releases a block once the offending source has settled.

GeoIP​

The ePDG GeoIP tab showing whether country-based filtering is enabled and ready, the whitelist/blacklist mode, the allowed or blocked country list, the GeoIP database in use and whether unknown-country IPs are allowed

GeoIP is the ePDG's country‑based admission control — how an operator restricts VoWiFi tunnel establishment to permitted countries by matching each incoming tunnel's source IP against a GeoIP database. The tab shows whether filtering is enabled and whether the database is ready (loaded and usable), the mode — whitelist (only the listed countries may connect) or blacklist (the listed countries are refused) — and the country list the mode applies to. It also shows the GeoIP database in use and whether unknown‑country IPs — source addresses the database cannot resolve to a country — are allowed or blocked.

Once the GeoIP database file has been updated on disk, the tab can reload it so the new mapping takes effect without disturbing established tunnels. This is the control that keeps VoWiFi tunnel setup confined to the regions an operator serves.

Configuration​

The ePDG configuration tab showing runtime settings, rate limits and geo-IP policy

The ePDG's runtime configuration, rate‑limiting rules (per‑subscriber / per‑source limits that protect the gateway), and geo‑IP policy (which source regions are permitted to establish tunnels). These are the controls that shape who may connect and how aggressively.

Logs​

The Logs tab tails the ePDG's live log output for troubleshooting a single gateway without leaving OmniWeb.

Monitoring dashboards​

Tunnel rates, throughput and other time‑series for the ePDG are presented as Grafana dashboards, reached from the element page — OmniWeb does not duplicate those charts natively.

  • The PGW anchors the ePDG's user plane over S2b.
  • The AAA/HSS holds the subscriber authentication data the ePDG's Diameter requests resolve against.
  • TWAG — the trusted‑Wi‑Fi counterpart.
Last updated on