Question: In a 3GPP SAE scenario, when a User Equipment (UE) moves from a source access connected to an ePDG (Evolved Packet Data Gateway) to a target access with a different ePDG, what action does the UE take regarding its IPsec tunnel?
Option 1: The UE updates the new ePDG with its new IP address using MOBIKE as per RFC 4555.
Option 2: The UE establishes a new IPsec tunnel with the new ePDG as described in the EPS security architecture.
Option 3: The UE maintains the existing IPsec tunnel, adapting it for the new ePDG without re-establishment.
Option 4: The UE disconnects all active sessions before initiating a new connection to the target access.
Explanation: When moving to a target access involving a different ePDG, the UE must establish a new secure connection. This requires setting up a new IPsec tunnel with the new ePDG to ensure continued secure data transmission, as described in the EPS security architecture for such scenarios. MOBIKE (Option 1) is used when the UE moves but remains connected to the same ePDG, which isn't the case here. Maintaining the existing tunnel (Option 3) or disconnecting all sessions (Option 4) are not specified procedures for this scenario in 3GPP SAE security aspects.