B.3 Protection of GTP-C transport protocols and interfaces

33.2103GPPIP network layer securityNetwork Domain Security (NDS)Release 17TS

IPsec ESP shall be used with both encryption and integrity protection for all GTP-C messages traversing inter-security domain boundaries.

Gn and Gp control plane traffic shall be routed via a SEG when it takes place between different security domains. In order to do so, operators shall operate NDS/IP Za-interface between SEGs. If a network node has implemented SEG functionality within the same physical entity, transport mode IPsec is optional for implementation and use on the Gn and Gp interfaces.

It will be for the operator to decide whether and where to deploy Zb-interfaces in order to protect the GTP-C messages over the Gn and Gp interfaces within the same security domain.

Annex C (normative):
Security protection of IMS protocols