s space and interconnect private IP address space to the public Internet. In mobility networks, they sit between the user bearer IP traffic and the Internet. They are used in broadband services to extend the IPv4 address space. Also, they are used between private enterprise VPNs and public appli- cation service providers. Network bonding service: This is implemented in a router that provides IP routing, route filters, and NAT between enterprise VPNs and public application service provider net- works such as cloud and vertical application service providers (e.g., Amazon Web Services, PeopleSoft, or Microsoft Azure cloud and Office 365). Session border controllers for multimedia services: These provide a firewall security func- tion and a proxy function for external video and video over IP services to reach IP multi- media cores within the service provider network. Network-based firewalls: Enterprise firewall and intrusion detection functions that reside in the service provider network between the Internet and enterprise private networks such as MPLS VPNs. Internet security scrubbers: These are specialized devices used for filtering DOS traffic. Targeted traffic from Internet services is diverted to these devices for filtering before being returned to its original path. Various mobility gateway functions: For example, serving gateway (SGW) and packet delivery network gateway (PGW) provide mobility edge networking functions discussed in the mobility chapter. Prior to SDN, all the various edge service function examples given above have been implemented in dedicated hardware. SDN provides an architecture where these become VNFs that can be imple- mented across a uniform, shared hardware infrastructure. 12.4 NETWORK CLOUD EDGE PLATFORMS The previously described issues with vertical or blackbox packet edge platforms necessitated a fun- damental rethinking of packet edge architectures. 12.4.1 DISAGGREGATED EDGE PLATFORMS The new packet edge architecture is shown in Figures 12.3 and 12.4 using the elements of AIC as descr