RFC 5213

PMIPv6 provides network-based IP mobility — the network handles mobility signaling on behalf of the UE, which does not need to run any mobility protocol. This is in contrast to host-based Mobile IP where the UE participates in mobility signaling.

In 3GPP EPC, PMIPv6 is used as an alternative to GTP on the S5 interface (SGW-PGW, non-roaming) and S8 interface (SGW-PGW, roaming). It is also used on S2a (trusted non-3GPP access) and S2b (untrusted non-3GPP access via ePDG) interfaces.

The MAG (Mobile Access Gateway) maps to the SGW in 3GPP. The LMA (Local Mobility Anchor) maps to the PGW. PBU/PBA signaling manages binding cache entries that maintain session connectivity across mobility events.

  UE          MAG (SGW)                    LMA (PGW)
|            |                             |
|  Attach    |                             |
|----------->|                             |
|            |  Proxy Binding Update (PBU)  |
|            |  [MN-ID, HNP, Access-Type,  |
|            |   Handoff-Indicator]         |
|            |---------------------------->|
|            |                             |
|            |    (Allocate HNP/HoA,       |
|            |     setup BCE, routing)     |
|            |                             |
|            |  Proxy Binding Ack (PBA)    |
|            |  [MN-ID, HNP, Lifetime,     |
|            |   Tunnel If-Id]             |
|            |<----------------------------|
|            |                             |
|  IP Config |  ====== IP Tunnel ========  |
|  (RA/DHCP) |  (GRE or IPv6-in-IPv6)     |
|<-----------|                             |
|            |                             |
|  User Data |  ====== Tunnel =========== |
|<==========>|<===========================>|

• MAG (Mobile Access Gateway): First-hop router, performs mobility signaling on behalf of UE. Maps to SGW/ePDG in 3GPP
• LMA (Local Mobility Anchor): Topological anchor point, maintains binding for UE's home network prefix. Maps to PGW in 3GPP
• HNP (Home Network Prefix): /64 prefix assigned to UE — stays constant across handovers
• BCE (Binding Cache Entry): LMA mapping of UE's HNP to serving MAG (proxy care-of address)
• BUL (Binding Update List): MAG's list of actively served UEs and their tunnel bindings

• PBU/PBA signaling MUST be protected — IPsec is mandatory between MAG and LMA
• Unauthorized PBU could redirect user traffic — source authentication is critical
• GRE tunnels do not provide encryption — IPsec ESP should encapsulate the tunnel for confidentiality
• MAG must authenticate UE identity before sending PBU to prevent hijacking attacks