- 01Access and Mobility Management FunctionAMF
- 02Unified Data ManagementUDM
- 03Policy Control FunctionPCF
- 04Network Repository FunctionNRF
- 05Non-3GPP Interworking FunctionN3IWF
- 06Security Edge Protection ProxySEPP
- 07Network Slice Selection FunctionNSSF
- 08Service Communication ProxySCP
- 09Application FunctionAF
- 10Location Management FunctionLMF
- 11Cell Broadcast CentreCBCF
- 12Gateway Mobile Location CentreGMLC
- 13Session Management FunctionSMF
- 14User Plane FunctionUPF
- 15SMS FunctionSMSF
- 16Equipment Identity RegisterEIR
Your subscribers spend most of their day on Wi-Fi: at home, in the office, in buildings where radio coverage stops. The N3IWF brings that Wi-Fi into your 5G core, with the same authentication, the same sessions and the same voice service as on the 5G radio.
5G frequencies go through walls even less well than 4G. Inside offices, basements, factories and homes, the radio signal fades, and so does the voice service. Building indoor radio coverage everywhere is expensive; the Wi-Fi is already there.
In a 4G network, the ePDG solves this for VoWiFi. In a 5G Standalone core, the same role belongs to the N3IWF, which speaks to the AMF and the UPF rather than to the EPC. Operators moving to 5G SA without an N3IWF either keep a 4G core alive just for Wi-Fi calling, or lose the service for their 5G subscribers.
Secure tunnel over untrusted Wi-Fi
The N3IWF is the gateway between an untrusted Wi-Fi network and the 5G core. The device connects to it over the internet with IKEv2 and IPsec (NWu), whatever the Wi-Fi access point or the internet provider in between.
5G registration inside the tunnel
The 5G NAS messages of the device are carried in EAP-5G up to the N3IWF, which forwards them to the AMF over NGAP (N2). The AMF authenticates the subscriber with 5G AKA through the AUSF and the UDM, exactly as on the radio, and derives the key that secures the IPsec tunnel. The subscriber appears in the core as registered on non-3GPP access.
One child SA per PDU session
Each PDU session requested by the device gets its own IPsec child SA. The N3IWF carries its traffic in GTP-U toward the UPF (N3), with the QoS flows set by the SMF and the PCF. When a voice call adds a QoS flow for the media, the N3IWF updates the session on the fly. The N3IWF is the 5G mode of the Ouroboros ePDG: one product, deployed as an ePDG for the 4G core or as an N3IWF for the 5G core, with the same IPsec data plane.
Trusted operator Wi-Fi: the TNGF mode
When the Wi-Fi belongs to the operator or to a trusted partner, the same product runs as a Trusted Non-3GPP Gateway Function (TNGF). The device authenticates with EAP-5G directly in the Wi-Fi association (802.1X), the access point relays it to the TNGF over Ta, and the Wi-Fi link is secured with keys derived from the 5G security context. The tunnel between the device and the TNGF (NWt) then needs integrity only, without a second layer of encryption, while the core side stays the same: NGAP toward the AMF, GTP-U toward the UPF.
N3IWF — untrusted Wi-Fi access to the 5G core
VoWiFi on 5G, indoor coverage, private networks, 4G-to-5G migration, data offload — one Wi-Fi gateway.
VoWiFi on the 5G SA core
5G subscribers make and receive calls over Wi-Fi through the IMS, with the same registration and the same voice service as on 5G radio.
Indoor coverage without indoor radio
Offices, basements, shopping centres and homes use the existing Wi-Fi instead of new small cells.
Private 5G networks with Wi-Fi zones
A campus or industrial site extends its private 5G core over its Wi-Fi network, with one subscriber identity and one policy.
4G to 5G migration of Wi-Fi calling
Operators running VoWiFi on the Ouroboros ePDG switch the same product to N3IWF mode when their subscribers move to the 5G core.
Operator and partner Wi-Fi networks
Hotspots run by the operator or a trusted partner give 5G subscribers seamless access with the TNGF mode: authentication at Wi-Fi association, no double encryption.
Data offload with core control
Data sessions over Wi-Fi stay under the policy, charging and Lawful Interception of the 5G core.
We've selected Ouroboros because it was the best company capable of fulfilling our need for a scalable and virtualised full MVNO platform. Moreover, the Ouroboros team is pragmatic, flexible and responsive.
Pascal Prot
CEO-CTO · Legos
Same authentication as on the radio
Registration over Wi-Fi uses 5G AKA through the AMF, the AUSF and the UDM. No separate AAA or Wi-Fi credentials to manage for 5G subscribers.
One IPsec child SA per PDU session
Each session of the device has its own tunnel, mapped to its GTP-U tunnel toward the UPF. Internet and IMS traffic keep their own QoS over Wi-Fi.
Voice-ready session updates
QoS flows are added and removed while the session runs. VoWiFi calls get their dedicated media flow on the 5G core.
ePDG and N3IWF in one product
The same software runs as an ePDG for the 4G core or as an N3IWF for the 5G core. Wi-Fi calling follows the subscribers from 4G to 5G without a new product.
Standard interfaces toward the core
NGAP toward the AMF and GTP-U toward the UPF. Works with the Ouroboros 5G core and with other standard AMFs and UPFs.
Trusted and untrusted Wi-Fi
N3IWF mode for any Wi-Fi network, TNGF mode for the operator's own or partner Wi-Fi, on the same product and toward the same AMF and UPF.
IPv4 and IPv6
Dual-stack inside and outside the IPsec tunnels. Devices connect from any Wi-Fi network, whatever its addressing.
The Ouroboros N3IWF is the natural continuation of the Ouroboros ePDG: the same IPsec data plane, extended to the 5G core. Operators who already offer VoWiFi in 4G keep the same product, the same operations and the same support contract when they move to 5G SA.
With the Ouroboros AMF, UDM, SMF, UPF and IMS, the complete Wi-Fi calling chain of the 5G core comes from one vendor and one platform.
OPEX rental is available, so Wi-Fi access can be added to a 5G launch without a separate capital project.
Tell us your 5G core, your VoWiFi service today and the number of Wi-Fi users you expect. We'll size the N3IWF, on OPEX or CAPEX.
Product datasheet5G Standalone · 5G Standalone
Non-3GPP Interworking Function (N3IWF)
Your subscribers spend most of their day on Wi-Fi: at home, in the office, in buildings where radio coverage stops. The N3IWF brings that Wi-Fi into your 5G core, with the same authentication, the same sessions and the same voice service as on the 5G radio.
In production since 2004 · 148M+ subscribers · 99.999% availability
Indoor coverage is the gap 5G does not close by itself
5G frequencies go through walls even less well than 4G. Inside offices, basements, factories and homes, the radio signal fades, and so does the voice service. Building indoor radio coverage everywhere is expensive; the Wi-Fi is already there.
In a 4G network, the ePDG solves this for VoWiFi. In a 5G Standalone core, the same role belongs to the N3IWF, which speaks to the AMF and the UPF rather than to the EPC. Operators moving to 5G SA without an N3IWF either keep a 4G core alive just for Wi-Fi calling, or lose the service for their 5G subscribers.
From any Wi-Fi to the 5G core.
Secure tunnel over untrusted Wi-Fi
The N3IWF is the gateway between an untrusted Wi-Fi network and the 5G core. The device connects to it over the internet with IKEv2 and IPsec (NWu), whatever the Wi-Fi access point or the internet provider in between.
5G registration inside the tunnel
The 5G NAS messages of the device are carried in EAP-5G up to the N3IWF, which forwards them to the AMF over NGAP (N2). The AMF authenticates the subscriber with 5G AKA through the AUSF and the UDM, exactly as on the radio, and derives the key that secures the IPsec tunnel. The subscriber appears in the core as registered on non-3GPP access.
One child SA per PDU session
Each PDU session requested by the device gets its own IPsec child SA. The N3IWF carries its traffic in GTP-U toward the UPF (N3), with the QoS flows set by the SMF and the PCF. When a voice call adds a QoS flow for the media, the N3IWF updates the session on the fly. The N3IWF is the 5G mode of the Ouroboros ePDG: one product, deployed as an ePDG for the 4G core or as an N3IWF for the 5G core, with the same IPsec data plane.
Trusted operator Wi-Fi: the TNGF mode
When the Wi-Fi belongs to the operator or to a trusted partner, the same product runs as a Trusted Non-3GPP Gateway Function (TNGF). The device authenticates with EAP-5G directly in the Wi-Fi association (802.1X), the access point relays it to the TNGF over Ta, and the Wi-Fi link is secured with keys derived from the 5G security context. The tunnel between the device and the TNGF (NWt) then needs integrity only, without a second layer of encryption, while the core side stays the same: NGAP toward the AMF, GTP-U toward the UPF.
N3IWF — untrusted Wi-Fi access to the 5G core
How operators use it.
VoWiFi on 5G, indoor coverage, private networks, 4G-to-5G migration, data offload — one Wi-Fi gateway.
VoWiFi on the 5G SA core
5G subscribers make and receive calls over Wi-Fi through the IMS, with the same registration and the same voice service as on 5G radio.
Indoor coverage without indoor radio
Offices, basements, shopping centres and homes use the existing Wi-Fi instead of new small cells.
Private 5G networks with Wi-Fi zones
A campus or industrial site extends its private 5G core over its Wi-Fi network, with one subscriber identity and one policy.
4G to 5G migration of Wi-Fi calling
Operators running VoWiFi on the Ouroboros ePDG switch the same product to N3IWF mode when their subscribers move to the 5G core.
Operator and partner Wi-Fi networks
Hotspots run by the operator or a trusted partner give 5G subscribers seamless access with the TNGF mode: authentication at Wi-Fi association, no double encryption.
Data offload with core control
Data sessions over Wi-Fi stay under the policy, charging and Lawful Interception of the 5G core.
Specifications.
Inside the platform.
Same authentication as on the radio
Registration over Wi-Fi uses 5G AKA through the AMF, the AUSF and the UDM. No separate AAA or Wi-Fi credentials to manage for 5G subscribers.
One IPsec child SA per PDU session
Each session of the device has its own tunnel, mapped to its GTP-U tunnel toward the UPF. Internet and IMS traffic keep their own QoS over Wi-Fi.
Voice-ready session updates
QoS flows are added and removed while the session runs. VoWiFi calls get their dedicated media flow on the 5G core.
ePDG and N3IWF in one product
The same software runs as an ePDG for the 4G core or as an N3IWF for the 5G core. Wi-Fi calling follows the subscribers from 4G to 5G without a new product.
Standard interfaces toward the core
NGAP toward the AMF and GTP-U toward the UPF. Works with the Ouroboros 5G core and with other standard AMFs and UPFs.
Trusted and untrusted Wi-Fi
N3IWF mode for any Wi-Fi network, TNGF mode for the operator's own or partner Wi-Fi, on the same product and toward the same AMF and UPF.
IPv4 and IPv6
Dual-stack inside and outside the IPsec tunnels. Devices connect from any Wi-Fi network, whatever its addressing.
The Ouroboros N3IWF is the natural continuation of the Ouroboros ePDG: the same IPsec data plane, extended to the 5G core. Operators who already offer VoWiFi in 4G keep the same product, the same operations and the same support contract when they move to 5G SA.
With the Ouroboros AMF, UDM, SMF, UPF and IMS, the complete Wi-Fi calling chain of the 5G core comes from one vendor and one platform.
OPEX rental is available, so Wi-Fi access can be added to a 5G launch without a separate capital project.
ePDG & AAA
The 4G mode of the same product: VoWiFi on the EPC.
Access and Mobility Management Function (AMF)
Registers the subscriber on non-3GPP access and carries its NAS signalling.
User Plane Function (UPF)
Receives the Wi-Fi traffic of the PDU sessions over N3.
IMS Core
Voice and video calls over Wi-Fi.
Next step
Moving to 5G SA and keeping Wi-Fi calling?
Tell us your 5G core, your VoWiFi service today and the number of Wi-Fi users you expect. We'll size the N3IWF, on OPEX or CAPEX.