n recommendations provided by the equipment vendor. Security It is essentially difficult to provide precise recommendations for firewall rules in this environment, since they should be compliant with the security policy of each company. The basic advice is to ensure that the operational requirements of the mobile users are still properly allowed and the standard practices in IT security are also followed. For special features and other specific traffic flows, such as VPN based connectivity to corporate networks, a joint task force with the mobile packet core designers and the administrators of the servers in question is usually a practical approach. It is also important to block traffic directly from mobile users to mobile users by creating appropriate access control lists in GGSNs or a similar type of access restriction mechanism. Traffic separation is also a good design practice in the core network backbone and is a common method used to create different VLANs for separated traffic flows. Another aspect to be especially careful with is the IP addressing plan, which should cover the actual requirements of the service. Only the relevant parts of the Gn VLAN should be provided with public IP addressing. 4.15.2 Operational Security Once the mobile network is operational, one of the most important operational procedures is to verify the security from different aspects. Intrusion detection systems can be effectively deployed to detect and log intrusion attempts. Other tools can also be utilised to detect user traffic containing some known viruses. While this type of traffic might not disturb the packet core infrastructure by itself, it is capable of creating some problems, with some potential mobile users not being aware of data sessions initiated by their mobile stations and thus being billed for traffic generated without their conscious knowledge. These types of tools are normally scanning the traffic at the Gn or Gi interface and are able to detect known data sequences that match their internal list of known virus