 at the website. SGSN-to-GGSN (Gn) and GGSN-to-PDN (Gi) Interface SGSN-to-GGSN (G) and GGSN-to-PDN (G) Interface imperiled. The problem stems from having a remote device that has a net- work presence on both secure and insecure networks. The addition of pro- tective firewall software on the client is one potential solution. Another solution would be for the GPRS operator to screen the mobile's traffic to/from IP addresses other than the corporate gateway. VPN-Service Provider Dependent (SPD) GPRS W-VPN can use a compulsory tunneling technique. Rather than an end-to-end solution, the VPN is made of two separate pieces. One is the GPRS operator's access network and another traverses the Internet. The network operator delivers a value-added, secure, access service. Its access concentrator is the tunnel establishment point. After connecting to it, a user's data is tunneled to a termination device at the edge of the corporate network. At this point, user packets are authenticated and access to corpo- rate data is authorized, as shown in the flow in Figure 10-9. The carrier builds and manages this network-to-network compulsory solution. Example compulsory GPRS solutions include LAC in a carrier's network between GGSN and the corporate firewall Gateway-to-gateway compulsory IPSec tunneling A dedicated GPRS-GGSN, colocated at/near the corporate firewall (using GTP tunneling) L2TP-Based Wireless VPN in a GPRS Infrastructure Standardized L2TP (RFC2661) evolved from various proprietary protocols and is intended to improve interoperability between different vendors' tun- neling equipment. L2TP is not an end-all answer. Notably, L2TP does not provide its own security (encryption), but can make use of IPSec. L2TP operates in compulsory mode in which the tunnel is supported by service provider gear. L2TP can also operate in a voluntary mode, in which the tun- nel endpoint is actually on the user's laptop. In this case, the user incurs the tunnel overhead. Downloaded from Digital Engineering Library @ McGraw-Hill (www.digitaleng