 the company to its mobile workers. The IPSec technology provides a secure tunnel extended from the remote clients via the GPRS backbone, across the Internet, and to the gateway via basic TCP/IP proto- cols. If authentication is successful, the user enters the corporate intranet to access host computers and servers. Voluntary IPSec tunnels include encryption of all data. This places an added overhead of often more than 25 percent on the route information field (RIF) interface. Voluntary tunnel- ing is end-to-end and terminates at the user's PC or personal digital assis- tant (PDA), as seen in Figure 10-7. It can be delivered independently of the infrastructure provider. More bandwidth is used over the air interface rather than with compulsory tunneling (see the following list). Other vol- untary tunneling examples that are used with the GPRS architecture include Point-to-Point Tunneling Protocol (PPTP) From the mobile station to a gateway within the corporate network. L2TP From the mobile station to a corporate L2TP Network Server (LNS) within the corporation. The mobile station itself takes on the L2TP Access Concentrator (LAC) function. Note that L2TP does not itself include data encryption. Running L2TP on top of an IPSec layer provides the needed confidentiality. These other two voluntary tunneling solutions use PPP. If a compression option for PPP can be negotiated between the endpoints, this provides some compensation for the additional headers required by tunneling. Service Provider Independent (SPI) voluntary tunneling is a solution technically independent of a service provider's infrastructure, involving Figure 10-7 SPI voluntary Basestation tunneling. Firewall & Public Key Infrastructure IPsec (PKI) Authentication Gateway Server IPsec VPN Clients Trusted Data Request Packet Connection Connection and Data Network Request service request Authentication Request Validated Auth. Response IPsec Tunnel Downloaded from Digital Engineering Library @ McGraw-Hill (www.digitalengineeringlibrary.com) Copyright © 200