ineeringlibrary.com) Copyright © 2004 The McGraw-Hill Companies. All rights reserved. Any use is subject to the Terms of Use as given at the website. Basestation Firewall & Public Key Infrastructure IPSec (PKI) Authentication Gateway Server IPSec VPN Clients IPSec automatic Service Request Activate PDP tunnel establishment Create PDP Context Request Connection Context Request Request Create PDP Authentication Request Activate PDP Context Request Internet without external PDN (any ISP) Validated Auth. Response Context Accept address allocation) Authentication Response Update PDP Modify PDP (with PDN address Context Response Context Request allocation) (with external PDN Modify PDP address allocation) Context Accept Update PDP IPSec Tunnel Context Response Figure 10-9 VPN-SPD. SGSN-to-GGSN (Gn) and GGSN-to-PDN (Gi) Interface SGSN-to-GGSN (G) and GGSN-to-PDN (G) Interface The mobile device requests a PPP session that starts at the mobile and then exits the GPRS network at the GGSN. The GGSN either contains or is collocated with an L2TP LAC. The LAC tunnels the PPP stream (via L2TP packets carrying PPP frames) to an L2TP LNS at the corporate network's edge. Actual authentication and authorization, as well as IP address assign- ment, occurs here, under the control of the corporate network. This scenario is based on an SLA or SA established between an LAC function that is at the GGSN and corporate-based LNS. The SA provides privacy rules and L2TP tunnels for user data. This is important because L2TP does not support its own security and because PPP encryption is nei- ther widely deployed nor has multivendor interoperability. In this compul- sory scenario, the operator assigns a corporation an Access Point Name (APN) Network Identifier. The APN is used by the SGSN to select the GGSN to be addressed for a specific group of corporate mobile users. The GGSN receives the IP address of the LNS at the user's corporate network. This is passed to the LAC function for packet forwarding to the LNS. The user accesses a corporate n