|
2.
|
The UE sends the IKE_SA_INIT message.
|
|
3.
|
The ePDG responds with the IKE_SA_INIT_RSP message.
|
|
4.
|
The UE sends the user identity (in the IDI payload) and the APN information (in the IDr payload) in the first message of the
IKE_AUTH phase, and begins negotiation of child security associations. The UE omits the AUTH parameter to indicate to the
ePDG that it wants to use EAP over IKEv2. The user identity is compliant with the Network Access Identifier (NAI) format as
specified in 3GPP TS 23.003. The UE sends the configuration payload (CFG_REQUEST) within the IKE_AUTH request message to obtain
an IPv4 home IP Address and/or a Home Agent Address. When the MAC ULI feature is enabled, the root NAI used is of the form
"0<IMSI>AP_MAC_
ADDR:nai.epc.mnc<MNC>
.mcc<MCC>.3gppnetwork.org".
5GC NAS capable UE indicates its support of 5GC NAS in IKEv2. The UE allocates a PDU Session ID and also includes N1_MODE_CAPABILITY
Notify payload.
|
|
5
|
The ePDG sends the Authentication and Authorization Request message to the 3GPP AAA Server, containing the user identity and
APN.
|
|
6.
|
The 3GPP AAA Server fetches the user profile and authentication vectors from HSS/HLR (if these parameters are not available
in the 3GPP AAA Server). The 3GPP AAA Server shall look up the IMSI of the authenticated user based on the received user identity
(root NAI) and include the EAP-AKA as requested authentication method in the request sent to the HSS. The HSS shall then generate
authentication vectors with AMF separation bit = 0 and send them back to the 3GPP AAA server. The 3GPP AAA Server checks in
user's subscription if he/she is authorized for non-3GPP access. The counter of IKE SAs for that APN is stepped up. If the
maximum number of IKE SAs for that APN is exceeded, the 3GPP AAA Server shall send an indication to the ePDG that established
the oldest active IKE SA (it could be the same ePDG or a different one) to delete the oldest established IKE SA. The 3GPP
AAA Server shall update accordingly the information of IKE SAs active for the APN.
The 3GPP AAA Server initiates the authentication challenge. The user identity is not requested again.
The AAA server sends the following two parameters if configured:
If the AAA server does not send these parameters, ePDG takes default values.
The ePDG uses these parameters and the 5G NAS capability from the UE to determine if SMF+PGW-c or P-GW must be selected.
|
|
7.
|
The ePDG responds with its identity, a certificate, and sends the AUTH parameter to protect the previous message sent to the
UE (in the IKE_SA_INIT Exchange). It completes the negotiation of the child security associations if any. The EAP message
received from the 3GPP AAA server (EAP-Request/AKA-Challenge) is included to start the EAP procedure over IKEv2.
|
|
8.
|
The UE checks the authentication parameters and responds to the authentication challenge. The only payload (apart from the
header) in the IKEv2 message is the EAP message.
|
|
9.
|
The ePDG forwards the EAP-Response/AKA-Challenge message to the 3GPP AAA server.
|
|
10.
|
The AAA Server responds with DEA (Diameter EAP Answer). DEA contains 3GPP-User-Location-Information (ULI) for 5G if configured
and available.
|
|
11.
|
The EAP Success or Failure message is forwarded to the UE over IKEv2.
|
|
12.
|
The UE takes its own copy of the PSK as input to generate the AUTH parameter to authenticate the first IKE_SA_INIT message.
The AUTH parameter is sent to the ePDG.
|
|
13.
|
ePDG constructs 5G ULI and sends it in ULI IE of Create Session Request to the selected SMF+PGW-c upon the following conditions:
-
The 3GPP-User-Location-Information (ULI) for 5G is received.
-
The SMF+PGW-c is selected to latch on.
-
The epdg-s2b-gtpv2 send 5g-uli CLI for sending 5G ULI is enabled.
|
|
14 a through 16.
|
The P-GW allocates the requested IP address to the session and responds back to the ePDG with a Create Session Response (Cause,
P-GW S2b Address C-plane, PAA, APN-AMBR, [Recovery], Bearer Contexts Created, [Additional Protocol Configuration Options (APCO)],
Private IE (P-CSCF)) message.
If SMF+P-GW-C receives PDU Session ID, it adds S-NSSAI in the APCO field of Create Session Response.
|
|
17.
|
The ePDG sends the assigned Remote IP address in the configuration payload (CFG_REPLY). The AUTH parameter is sent to the
UE together with the configuration payload, security associations and the rest of the IKEv2 parameters and the IKEv2 negotiation
stops.
The S-NSSAI and the PLMN-ID) is sent to UE, in N1_MODE_INFORMATION Notify and N1_MODE_S_NSSAI_PLMN_ID Notify payload respectively.
The N1_MODE_INFORMATION Notify payload indicates the S-NSSAI for the PDU session associated with the IKEv2 security association
established by the IKEv2 message.
The PLMN ID corresponding to SNSSAI is sent in N1_MODE_S_NSSAI_PLMN_ID.
|
Note
|
If the UE does not support 5GC NAS but has a 5GS subscription, SMF+PGW-c is selected, and if interaction with UDM, Policy
Control Function (PCF), and UPF is required, then SMF+PGW-c assigns PDU Session ID. The SMF+PGW-c does not provide any 5GS
related parameters to the ePDG.
|
|
|
18.
|
Router Advertisement is sent for IPv6 address assignments that is based on configuration.
|
Note
|
If the ePDG detects that an old IKE SA for that APN exists, it deletes the IKE SA and sends the UE an INFORMATIONAL Exchange
with a Delete payload in order to delete the old IKE SA in UE.
|
If there is any IKEv2 Authentication Response message, the ePDG sends S-NSSAI to the UE.
|
Feedback