Question: In IMS roaming scenarios, when securing the interface between a P-CSCF and I-CSCF located in different security domains using SEGs, what IPsec protocol mode is mandated for protecting SIP signaling?
Option 1: IPsec AH with encryption
Option 2: IPsec ESP with integrity protection only
Option 3: IPsec ESP with encryption only
Option 4: IPsec ESP with both encryption and integrity protection
Explanation: In scenarios where SEGs (Security Gateways) are deployed to secure the Za reference point, especially in IMS roaming contexts where SIP signaling may carry sensitive information like IMS session keys across different security domains, ensuring both confidentiality (via encryption) and authenticity/integrity (via integrity protection) of the signaling is crucial. Therefore, IPsec ESP with both encryption and integrity protection is mandated for all SIP signaling traversing inter-security domain boundaries to comprehensively secure the communication.