ePDG development for a communications ISV

Draft. The technical narrative is accurate to the engagement type; the figures marked [ ] are placeholders awaiting real numbers. Replace or remove them before publication.

Project description

Mobile operators need subscribers to move onto Wi-Fi without leaving the operator's own network — for voice over Wi-Fi, for offload in congested cells, and for indoor coverage where licensed spectrum struggles. The component that makes this possible is the Evolved Packet Data Gateway, which terminates untrusted Wi-Fi access and carries it securely into the Evolved Packet Core.

Our client, a communications ISV, needed a production ePDG to complete their core network portfolio. The requirements were unforgiving in the way carrier software usually is: strict conformance to 3GPP interfaces, predictable behaviour under load, and a release schedule tied to their own customers' deployment windows.

Outcomes and approach

We worked as an extension of the client's core network group rather than as an arms-length vendor, which mattered because the design decisions were entangled with the rest of their portfolio.

Standards conformance first. The SWu interface to the user equipment and the S2b interface to the packet gateway were implemented against the specifications rather than against a reference implementation, so that interoperability was a design property rather than something discovered in testing.

IPsec and IKEv2 at the security boundary. The gateway's whole purpose is to make an untrusted access network safe to terminate. Tunnel establishment, rekeying, and certificate handling were built and reviewed as the security-critical path they are.

Load behaviour as a requirement, not an afterthought. Tunnel setup rate and concurrent session capacity were treated as first-class acceptance criteria from the start, with a test harness that could generate realistic subscriber attach patterns rather than uniform synthetic load.

Continuous integration against real protocol traffic. Every build ran against protocol-level tests, which is the only way to catch the class of regression that unit tests are structurally blind to.

Highlights of the solution

• Full ePDG data and control plane, with SWu and S2b interfaces
• IPsec / IKEv2 tunnel establishment, rekeying and teardown
• GTPv2 signalling toward the packet gateway
• AAA integration for subscriber authentication and authorisation
• Sustained [TUNNEL SETUP RATE] tunnel setups per second at [CONCURRENT SESSIONS] concurrent sessions
• Delivered across [N] releases, each aligned to the client's deployment windows

Technologies

C / C++ · IPsec · IKEv2 · GTPv2 · Diameter · EPC · Linux networking · protocol conformance testing