ket can be encapsulated by an IPv6 header; - an IPv6 packet can be encapsulated by an IPv4 header. When the mobile is connected to an IPv4 private network, the tunnel must insert a UDP header between the IPv6 and IPv4 headers, for traversal of the NAT (Network Address Translation) device; - an IPv4 packet can be encapsulated by an IPv6 header; - an IPv4 packet can be encapsulated by an IPv4 header. When the mobile is connected to an IPv4 private network, the tunnel must insert a UDP header between the two IPv4 headers for traversal of the NAT device. Wi-Fi Integration to the 4G Mobile Network The direct transfer between the mobile node and the correspondent node is not allowed, the mobile traffic in any case to be controlled by the PGW entity. 9.3. Application to the 4G mobile network 9.3.1. Trusted Wi-Fi access The establishment of the S2c tunnel constitutes one of the different phases of the mobile attachment described in Figure 9.8. Wi-Fi access server Mutual authentication of the mobile and the AAA server Mobile address profile allocation recovery IPsec security association between mobile and PGW entity Binding Update Mobile profile Binding Acknowledgement recovery Figure 9.8. S2c tunnel establishment Trusted Wi-Fi access Phase (A) corresponds to the mutual authentication procedure described in Chapter 6. At the end of phase (A), trusted Wi-Fi access has recovered the service profile of the mobile stored in the HSS entity. Phase (B) corresponds to the configuration of the mobile via trusted Wi-Fi. At the end of phase (B), the mobile recovers its CoA. Trusted Wi-Fi S2c Tunnel Establishment access can also initiate a session with the PCRF to retrieve the profile of the mobile stored in the SPR database. Phase (C) is the establishment of an IPSec association between the mobile and the PGW entity to protect the DSMIPv6 control messages. The principles for establishing a security association are described in Chapter 7. At the end of phase (C), the PGW entity assigned the mobile its HoA and retrieved the service pr