om the GGSN to the ISP or intranet switch. Nontransparent Mode As the interconnection between the GPRS network and the destination network may be insecure, a security protocol may be defined by mutual Figure 10-17 Nontransparent Intranet/ Tunnel Internet access. GTP Tunnel (PDP Context) DNS/DHCP Server IPSec tunnel Radius Permanent IPSec tunnel Many-to-One GTP to IPsec tunnel mapping GGSN performs user authentication - Remote Radius server, LDAP (internal/external) GGSN provides private IP @ - Radius user configuration - DHCP, internal address pools Downloaded from Digital Engineering Library @ McGraw-Hill (www.digitalengineeringlibrary.com) Copyright © 2004 The McGraw-Hill Companies. All rights reserved. Any use is subject to the Terms of Use as given at the website. SGSN-to-GGSN (Gn) and GGSN-to-PDN (Gi) Interface SGSN-to-GGSN (G) and GGSN-to-PDN (G) Interface Figure 10-18 Nontransparent Intranet/ISP mode. PCUSN Radius PDP Context Activation MS Authentication VPN Tunnel Creation PDP Context Activation Accept Private IP @ for MS Private IP @ for MS agreement between the two parts. Figure 10-18 shows the basis of non- transparent mode. Receiving the PDP Context Request message from the SGSN, the GGSN deduces the following from the APN: The server to be used for address allocation and authentication The protocol to be used with those servers, such as RADIUS, DHCP, and SO on The communication and security feature needed to dialogue with those servers, such as tunnel type or IPSec SA When the GGSN sends the Create PDP Context Response message to the SGSN, the tunnel toward the remote switch is created. Virtual Dial-Up (Enhanced Nontransparent) In the virtual dial-up (enhanced nontransparent) access mode (shown in Figure 10-19), the different functions (tunneling, user authentication, secu- rity encryption) are provided by different protocols: The L2TP session performs tunneling functions. Dynamically allocated L2TP sessions take place. Downloaded from Digital Engineering Library @ McGraw-Hill (www.digitalengineering