ePDG Monitoring

The VAS Experts ePDG Monitoring system provides full operational control of the fast-epdg component, the VoWiFi (Voice over WiFi) gateway operating according to 3GPP TS 29.273 and TS 24.302. The gateway provides secure transmission of voice and packet traffic through untrusted Wi-Fi channels with IPSec / IKEv2 tunneling and integration with the EPC core through SWu, SWm, SWx, S2b, S6b interfaces.

The solution provides a single monitoring platform for the mobile operator’s operational services — from the IPSec SA (L3 security) level to the KPI of VoWiFi subscriber experience.

• Real-time monitoring — update metrics every 10-15 seconds, directly display the status of IKE SA / Child SA and GTP tunnels in NOC dashboards without delayed aggregation (hereinafter NOC — Network Operation Center, network management center).
• Proactive detection of anomalies — 20+ alarms with automatic escalation in importance. PGW/AAA inaccessibility, increased IKEv2 delays, and an increase in EAP-AKA errors are detected before subscribers notice problems with calls.
• Open integration interfaces — Prometheus, SNMP v2c, Alertmanager webhooks, Grafana support. Integration into the existing NMS/OSS infrastructure without vendor binding.
• Minimum external dependencies at the plugin level — built-in /metrics endpoint in fast-epdg, without Java, without JMX, without external agents.
• Coverage of the entire SWu → S2b stack — IKEv2 (SWu), Diameter SWm/SWx/S6b, GTPv2-C (S2b) and GTP-U data plane — all in one place. The 33 metrics cover control plane and data plane.

<mermaid> flowchart TB

  subgraph DataPlane["Data Plane"]
      IPSEC["IPSec ESP<br/>IKEv2 SA / Child SA<br/>Kernel xfrm"]
      GTPU["GTP-U Tunneller<br/>S2b Data<br/>ePDG ↔ PGW"]
  end

  subgraph ControlPlane["Control Plane"]
      IKE["IKEv2 SWu<br/>EAP-AKA' auth"]
      DIAM["Diameter Client<br/>SWx/SWm/S6b"]
      GTPC["GTPv2-C S2b<br/>to PGW/SMF"]
      CTRL["ePDG Controller<br/>Attach/Detach FSM"]
  end

  subgraph Collection["Metrics Collection"]
      PROMEXP["fast-epdg<br/>/metrics endpoint<br/>:9817"]
  end

  subgraph Storage["Storage"]
      PROM["Prometheus<br/>TSDB<br/>15-day retention"]
  end

  subgraph Visualization["Visualization"]
      GRAF["Grafana<br/>4 дашборда, 35+ панелей"]
  end

  subgraph Alerting["Alerting"]
      AM["Alertmanager<br/>Routing / Inhibition"]
      EMAIL["Email SMTP"]
      SNMPGW["SNMP Trap Sender<br/>Webhook → Trap gateway"]
      NMS["Внешняя NMS<br/>SNMP v2c UDP/162"]
      WH["Webhooks<br/>Telegram / PagerDuty"]
  end

  IKE --> PROMEXP
  IPSEC --> PROMEXP
  GTPC --> PROMEXP
  GTPU --> PROMEXP
  DIAM --> PROMEXP
  CTRL --> PROMEXP

  PROMEXP --> PROM
  PROM --> GRAF
  PROM --> AM

  AM --> EMAIL
  AM --> SNMPGW
  SNMPGW --> NMS
  AM --> WH

</mermaid>

<mermaid> flowchart LR

  EXP["fast-epdg<br/>/metrics :9817"]

  EXP --> CFG["Config<br/>2 metrics"]
  EXP --> NET["Network<br/>1 metric"]
  EXP --> PROTO["Protocols L5-L7<br/>15 metrics"]
  EXP --> SVC["Service KPI<br/>4 metrics"]
  EXP --> SESS["Session State<br/>4 metrics"]
  EXP --> APP["Application<br/>3 metrics"]
  EXP --> SYS["System<br/>4 metrics"]

  PROTO --> IKEV2["IKEv2<br/>SWu — 3"]
  PROTO --> GTPC["GTPv2-C<br/>S2b — 4"]
  PROTO --> GTPU["GTP-U<br/>S2b data — 3"]
  PROTO --> DIA["Diameter<br/>SWm/SWx/S6b — 5"]

</mermaid>

All metrics have the prefix epdg_ and are organized in a hierarchy:

epdg_
├── config_*           # Configuration
├── network_*          # Network layer
├── ikev2_*            # SWu (IKEv2/IPSec)
├── gtp_*              # S2b control-plane GTPv2-C
├── gtpu_*             # S2b data-plane GTP-U
├── diameter_*         # SWm/SWx/S6b
├── service_*          # Service KPIs (attach, availability, uptime)
├── session_*          # Session Status (IKE SA, Child SA, GTP, subscribers)
├── app_*              # App Metrics (memory, threads, logs)
└── system_*           # System metrics (CPU, disk, network)

All metrics are exported through a single /metrics endpoint in Prometheus text format. The name follows the rules of Prometheus: epdg_<group>_<name>[_unit], the Counter type has the suffix _total, Histogram is the suffix _seconds/_bytes.

<mermaid> flowchart LR

  CORE["VAS Experts<br/>ePDG Monitoring"]

  CORE --> P["Prometheus<br/>CNCF / OpenMetrics"]
  CORE --> S["SNMP v2c<br/>EPDG-MIB"]
  CORE --> G["Grafana<br/>JSON Provisioning"]
  CORE --> W["Webhooks<br/>ChatOps"]
  CORE --> AM["Alertmanager<br/>Routing"]

  P --> P1["Cloud-native NMS<br/>Thanos / Cortex / Mimir"]
  S --> S1["Legacy NMS<br/>HP OpenView, NetAct<br/>IBM Tivoli"]
  G --> G1["NOC Wall Displays<br/>Drill-down Analytics"]
  W --> W1["Telegram / Slack<br/>PagerDuty / OpsGenie"]
  AM --> AM1["Smart routing<br/>Severity-based"]

</mermaid>

The native /metrics endpoint on port 9817 is built into fast-epdg. The format is standard text format Prometheus v0.0.4 (compatible with OpenMetrics). Aggregation is supported with the central Prometheus operator; remote_write team support for long-term storage in Thanos, Cortex, Grafana Mimir.

47 OID covers the Prometheus metric + 14 trap notifications (with raise/clear pairs according to RFC 3877 ALARM-MIB). Compatible with HP OpenView, IBM Tivoli NetCool, Nokia NetAct, Huawei U2000.

<mermaid> flowchart TB

  IANA["IANA PEN<br/>enterprises<br/>.1.3.6.1.4.1"]
  VAS["VAS Experts<br/>.1.3.6.1.4.1.43823<br/>(vas.expert)"]
  EPDG["EPDG-MIB<br/>.43823.1"]
  EPC["EPC Monitoring<br/>.43823.100"]

  IANA --> VAS
  VAS --> EPDG
  VAS --> EPC

  EPDG --> OBJ["epdgObjects<br/>.43823.1.1"]
  EPDG --> NOTIF["epdgNotifications<br/>.43823.1.2<br/>14 trap types"]
  EPDG --> CONF["epdgConformance<br/>.43823.1.3"]

  OBJ --> SERVICE["service .1.1.1<br/>4 OID"]
  OBJ --> IKE["ikev2 .1.1.2<br/>6 OID"]
  OBJ --> GTP["gtp .1.1.3<br/>8 OID"]
  OBJ --> DIAM["diameter .1.1.4<br/>7 OID"]
  OBJ --> SESS["sessions .1.1.5<br/>8 OID"]
  OBJ --> SYS["system .1.1.6<br/>8 OID"]
  OBJ --> NET["network .1.1.7<br/>6 OID"]

  NOTIF --> TRAPAGR["7 raise / 7 clear<br/>pairs"]

</mermaid>

Examples of SNMP requests:

# The entire ePDG tree
snmpwalk -v2c -c public <host>.1.3.6.1.4.1.43823.1
 
# Service availability (Gauge 0..1)
snmpget -v2c -c public <host> .1.3.6.1.4.1.43823.1.1.0

4 JSON dashboard support (35+ panels total):

• ePDG Overview — availability, KPI connections, sessions, state of interfaces
• IKEv2 Details — Messages, Performance, Errors, IKE SA Lifecycle
• GTP Details — GTPv2-C + GTP-U data on PGW nodes
• Diameter Details — Application messages, delays, watchdog

Automatic installation through an API that supports Grafana. Adaptive design for Network Control Center (NOC) status monitors with auto-update every 15 seconds.

Webhook interface for integration with any notification system: Telegram Bot, Slack, PagerDuty Events API v2, OpsGenie, Microsoft Teams. A separate SNMP Trap Sender service converts Alertmanager webhooks to SNMP v2c traps with Enterprise OID.

<mermaid> flowchart LR

  AL["ePDG Alert Rules<br/>20+"]

  AL --> CR["Critical<br/>5 rules"]
  AL --> WR["Warning<br/>8 rules"]
  AL --> INFO["Recording<br/>34 rules"]

  CR --> C1["Service_Down<br/>availability == 0"]
  CR --> C2["Attach_Failure_Rate<br/>> 10%"]
  CR --> C3["PGW_Unreachable<br/>connection_status{s2b} == 0"]
  CR --> C4["AAA_Unreachable<br/>connection_status{swm} == 0"]
  CR --> C5["Diameter_Watchdog_Timeout<br/>watchdog_status == 0"]

  WR --> W1["High_IKEv2_Latency<br/>p95 > 1.0 s"]
  WR --> W2["High_GTP_Latency<br/>p95 > 0.5 s"]
  WR --> W3["High_IKEv2_Error_Rate<br/>> 5%"]
  WR --> W4["High_GTP_Error_Rate<br/>> 5%"]
  WR --> W5["High_Memory_Usage<br/>> 80%"]
  WR --> W6["High_CPU_Usage<br/>> 80%"]
  WR --> W7["Low_Disk_Space<br/>< 10%"]
  WR --> W8["High_Error_Log_Rate<br/>> 10/s"]

  INFO --> I1["attach_success_rate<br/>preaggregated"]
  INFO --> I2["p95_p99_latency<br/>preaggregated"]
  INFO --> I3["throughput<br/>preaggregated"]

</mermaid>

<mermaid> sequenceDiagram

  participant M as Метрика (Prometheus)
  participant R as Alert Rule (PromQL)
  participant AM as Alertmanager
  participant E as Email (SMTP)
  participant SG as SNMP Trap Gateway
  participant NMS as Внешняя NMS
  participant W as Webhook (ChatOps)

  M->>R: The value exceeds the threshold
  R->>R: Waiting (for: 1-10 мин)
  R->>AM: Alert FIRING
  AM->>AM: Group by [alertname, component]
  AM->>AM: Inhibition check (critical overrides warning)

  alt severity = critical
      AM->>E: Email [CRITICAL]
      AM->>SG: Webhook → SNMP Trap
      SG->>NMS: SNMP v2c Trap (OID .1.3.6.1.4.1.43823.1.2.X)
      AM->>W: Webhook (Telegram / PagerDuty)
  else severity = warning
      AM->>E: Email [WARNING]
  end

  Note over M,R: The metric is returning to normal
  R->>AM: Alert RESOLVED
  R->>SG: clear-trap (paired notification)
  AM->>E: Email [RESOLVED]

</mermaid>

• Inhibition: Critical alarms automatically suppress Warning for the same component
• Grouping: Alarms are grouped into alertname + component with a 30-second window
• Dead time / Hysteresis: 1 to 10 minutes for prevents false positives
• Trap pairing: raise/clear simultaneous events for compliance with RFC 3877 ALARM-MIB

<mermaid> flowchart TB

  NOC["NOC Dashboard Layer"]

  NOC --> OVER["ePDG Overview<br/>KPI Summary"]
  NOC --> IKE["IKEv2 Details<br/>Drill-down"]
  NOC --> GTP["GTP Details<br/>Drill-down"]
  NOC --> DIA["Diameter Details<br/>Drill-down"]

  OVER -->|Click attach KPI| IKE
  OVER -->|Click session count| GTP
  OVER -->|Click peer status| DIA

</mermaid>

• Auto Update: 15-second update period
• Adaptive color scheme: green → yellow → red by threshold values
• Drill-down: from Overview to Detail to Component
• Time-range selector: 5 minutes to 30 days of history
• JSON provisioning: dashboards are automatically deployed

ePDG monitoring is fully integrated into overall packet core monitoring:

<mermaid> flowchart TB

  subgraph Common["Unified Monitoring Stack"]
      PROM["Prometheus"]
      GRAF["Grafana"]
      AM["Alertmanager"]
  end

  subgraph Sources["Sources of EPC metrics"]
      DPI["FastDPI<br/>:9110"]
      SMF["SMF /metrics<br/>:9090"]
      PCEF["fast-pcef /metrics<br/>:9090"]
      PCRF["FastPCRF"]
      EPDG["fast-epdg<br/>:9817"]
  end

  DPI --> PROM
  SMF --> PROM
  PCEF --> PROM
  PCRF --> PROM
  EPDG --> PROM

  PROM --> GRAF
  PROM --> AM

</mermaid>

The NOC operator sees all EPC components (DPI, SMF, PCEF, FastPCRF, ePDG) in a single Grafana interface, with a single alarm system and notification routing through one Alertmanager.

<mermaid> graph LR

  L1["L1 Physical<br/>NIC counters via system"]
  L2["L2 Data Link<br/>MAC, VLAN"]
  L3["L3 Network<br/>IP, IPSec ESP, GTP-U"]
  L4["L4 Transport<br/>TCP/UDP/SCTP"]
  L5["L5 Session<br/>GTPv2-C, IKEv2"]
  L6["L6 Presentation<br/>IKEv2/IPSec encryption, EAP-AKA'"]
  L7["L7 Application<br/>Diameter, service bearer ops"]
  Operations["Operations<br/>KPI, SLA, Capacity"]
  CX["CX Level<br/>Subscriber Experience"]

  L1 --> L2 --> L3 --> L4 --> L5 --> L6 --> L7 --> Operations --> CX

  style L1 fill:#e74c3c,color:#fff
  style L2 fill:#e67e22,color:#fff
  style L3 fill:#f39c12,color:#fff
  style L4 fill:#2ecc71,color:#fff
  style L5 fill:#1abc9c,color:#fff
  style L6 fill:#3498db,color:#fff
  style L7 fill:#9b59b6,color:#fff
  style Operations fill:#34495e,color:#fff
  style CX fill:#2c3e50,color:#fff

</mermaid>

OSI model:

Operator level:

<mermaid> flowchart TB

  subgraph Host1["ePDG Server"]
      EPDG["fast-epdg<br/>(VoWiFi gateway)"]
      PLUGIN["/metrics endpoint<br/>:9817"]
      EPDG -.-> PLUGIN
  end

  subgraph Host2["Monitoring server"]
      PROM["Prometheus"]
      GRAF["Grafana"]
      AM["Alertmanager"]
      SNMPTRAP["SNMP Trap Sender<br/>(webhook gateway)"]
      PROM --> GRAF
      PROM --> AM
      AM --> SNMPTRAP
  end

  subgraph Host3["External systems"]
      NMS["Операторская NMS<br/>(HP OpenView /<br/>NetAct / Tivoli)"]
      CHAT["ChatOps<br/>(Telegram / PagerDuty)"]
  end

  PLUGIN -->|HTTP :9817/metrics| PROM
  SNMPTRAP -->|UDP 162| NMS
  AM -->|Webhook| CHAT

</mermaid>

• On-premise — the plugin runs in the fast-epdg address space, zero resource consumption
• Co-located Prometheus — Prometheus collects metrics from an application running on the same host
• Centralized — a single Prometheus collects from all ePDG nodes

The monitoring section in fast-epdg.conf:

monitoring {
    enabled = yes
    listen_port = 9817
    listen_address = 0.0.0.0
    update_interval = 10
    metrics {
        ikev2 = yes
        gtp = yes
        diameter = yes
        service = yes
        session = yes
        app = yes
        system = yes
    }
}

Each group of metrics can be independently turned on/off without recompilation.