UE
TTG GGSN
AAA
1. IKE_SA_INIT Request
2. IKE_SA_INIT Response
3. IKE_AUTH Request
6. IKE_AUTH Response
4. RADIUS AR/DER
5. RADIUS AC/DEA (EAP Req/Challenge)
7. IKE_AUTH Request (EAP)
8. RADIUS AR/DER (EAP Response)
9. RADIUS AA/DEA (EAP Success)
9a. Authorization Request/Identify
9b. AAA Response
10. IKE_AUTH Response (EAP Success)
11. IKE_AUTH Request
12. Create
PDP Context Request
GGSN allocates IP address
13. Create
PDP Context Response
(IP address)
TTG establishes IPSec SA, 
GTP tunnel, and link 
between them for user 
traffic
14. IKE_AUTH Response (CP, IP address,
DNS addresses, etc.)
15. User data
Table 70.  TTG Connection Establishment 
After receiving the IP address of the TTG from the WiFi access point, the UE initiates an IKEv2/IPSec tunnel by sending 
an IKE_SA_INIT Request to the TTG. The UE includes the SA, KE, Ni, and NAT-Detection Notify payloads in the IKEv2 
exchange.