etwork after his or her wireless device first attaches to the GPRS network, using a data type PPP and specifying the APN. Once the PDP context is active, control is passed to the LAC SO it can relay the information used by PPP. This triggers the establishment of an L2TP control connection to the corporate LNS. If an L2TP tunnel is already established for the corporate VPN connection, the newly attached user can share it. If not, a new tunnel is created. The GGSN then uses the L2TP control connection to establish an L2TP call (L2TP tunnel to carry PPP) between the LAC and the LNS. The authentication of the mobile is performed via the corporate LNS. The corporate LNS often utilizes the ser- vices of the corporate AAA system (for example, RADIUS). After the authentication phase, an IP address is assigned to the mobile, as is normally the case. The mobile does not have a carrier-network IP address associated with it; instead, the mobile has established a PPP session directly with the corporate network. IPSec Gateways and Compulsory Tunneling W-VPN This example is similar to the previous example in the L2TP section, except the corporation's VPN gateway server establishes an IPSec rather than an L2TP tunnel. In the previous section, the SA between the LAC and LNS Downloaded from Digital Engineering Library @ McGraw-Hill (www.digitalengineeringlibrary.com) Copyright © 2004 The McGraw-Hill Companies. All rights reserved. Any use is subject to the Terms of Use as given at the website. SGSN-to-GGSN (Gn) and GGSN-to-PDN (Gi) Interface Chapter 10 was pre-provisioned. In the IPSec case, shown in Figure 10-10, the SA could be dynamically established, but it is more likely to be pre-provisioned because administration is more complex. The tunnel goes between the two gateways and is not an end-to-end solution. It is important to note that this solution requires that the GGSN directly associates the mobile's IP address with the IPSec tunnel SO that packets to/from the mobile traverse only that tunnel. The corporation may internall