r. An IP router is located at the access hub site acting also as a CE (customer edge) router, providing an attachment circuit to the PE device and to the IP MPLS VPN service. With IP services, dual-homing/multi-homing is supported, and a resilient service can be provided. For the customer (gNB), the IP MPLS VPN appears as a router providing First Dual- homing P Routers access (Provider infra) Core site 2 Provider IGP IP MPLS VPN Router IP access Router (CE Router) Router Core site 1 PE-CE Multi-protocol BGP for routing carrying customer prefixes Figure 9.9 NG interface example (classical gNB). 9.4 Fronthaul and Backhaul Interfaces IP connectivity service to customer networks (UPFs and other gNBs) on different sites in that specific VPN. The customer's routes are not shared with other customers, and service provider's routes are as well separate. 9.4.2.2 Security The NG interface lacks cryptographic protection both on the user plane and on the control plane, except for NAS (Non-Access Stratum) signaling from the UE to the core network. Cryptographic protection with IPsec is required. 9.4.3 Xn/X2 Interfaces The Xn/X2 interface is defined for connectivity between the 5G RAN and 5G RAN or LTE nodes, for mobility between 5G RAN nodes (like X2 in LTE), and for dual connec- tivity, either for the 5G-5G case or for the 5G-LTE case. The interface includes both the user plane and the control plane. The user plane protocol stack consists of GTP-U/UDP/IP and IPsec. The control plane protocol stack consists of (DTLS)/SCTP/IP and IPsec. The IP protocol may be IPv6 or IPv4. The Xn interface and protocol stack are shown in Figure 5.10 of Chapter 5. 9.4.3.1 Connectivity Xn introduces parallel connectivity between 5G nodes, basically a full mesh between neighbor nodes. The link is seldom physically a direct link, but instead the logical con- nectivity is arranged with links connecting to a central hub point, which provides the IP connectivity service. In the case of a high layer split architecture, it is the gNB-CU that interfaces