Protecting the wires between the boxes — the layer everyone forgets
“Perfect air-interface crypto means nothing if the backhaul carrying it runs in clear over a leased line. Subscriber security and infrastructure security are different jobs.”
— THE NDS/IP REMINDER
NAS and AS security protect subscriber traffic. But the links between network nodes — gNB to core, NF to NF, SMF to UPF — carry signaling and user packets that need their own protection. That is Network Domain Security for IP (NDS/IP, TS 33.210): IPsec and TLS securing the infrastructure itself. This chapter covers the NDS/IP model, IPsec/IKEv2, security gateways, backhaul protection, and certificate enrollment.
🎯 Learning objectives
Explain the NDS/IP model and security domains.
Describe IPsec ESP and IKEv2 for telecom links.
Explain security gateways (SEG) and the Za/Zb reference points.
Cover backhaul, midhaul, fronthaul protection.
Explain certificate enrollment (CMPv2, TS 33.310) at scale.
📘 Standards reference box — Chapter 14
Specification
Title
Release / version verified
TS 33.210
Network Domain Security — IP layer (NDS/IP)
Rel-18 edition
TS 33.310
NDS — authentication framework / PKI (CMPv2)
Rel-18 edition
TS 33.501
5G security — transport protection of interfaces
Rel-18, v18.11.0 (2026-04)
Checked June 2026 — verify against the latest 3GPP version.
14.1 The NDS/IP Model
NDS/IP organizes the network into security domains (typically per operator or per administrative region). Traffic within a domain may be trusted; traffic between domains — or across any untrusted transport — must be protected, classically by IPsec between security gateways (SEGs) at each domain’s edge.
FIGURE 14.1NDS/IP Model — Domains and Security Gateways
Purpose: the classic NDS/IP picture. SEGs sit at domain boundaries; inter-domain traffic (Za) gets mandatory IPsec, intra-domain (Zb) is protected as policy requires.
FIGURE 14.2Za and Zb Reference Points
Purpose: the two NDS reference points. Za is non-negotiable; Zb is a risk decision — and in cloud/shared environments, “intra-domain is trusted” is an assumption worth re-examining (Chapter 29).
14.2 IPsec ESP and IKEv2
FIGURE 14.3IPsec ESP Tunnel Mode — Packet Anatomy
Purpose: what IPsec actually does to a packet. ESP in tunnel mode encrypts and authenticates the entire original packet, hiding even the internal addressing from the transport.
FIGURE 14.4IKEv2 — Establishing the Secure Tunnel
Purpose: how the tunnel is born. IKEv2 negotiates keys and — crucially — authenticates the peers by certificate, so only legitimate gNBs/SEGs can establish protected links to the core.
FIGURE 14.5Security Gateway Deployment Patterns
Purpose: the deployment choices for backhaul protection. Large operators typically front the core with SEG farms terminating thousands of gNB tunnels; small ones integrate IPsec directly.
14.3 Protecting the RAN Transport
FIGURE 14.6Backhaul Protection — gNB ↔ Core
Purpose: the most common NDS gap. A gNB on a rooftop reaches the core over transport you may not own — IPsec is what stops that path from being a tap into your signaling and user traffic.
FIGURE 14.7TLS vs IPsec for Intra-Domain Links
Purpose: both protect, at different layers. SBI uses TLS (Chapter 10); IP transport links (N2/N3/N4 over untrusted networks) typically use IPsec — and many deployments use both in depth.
FIGURE 14.8Certificate Enrollment with CMPv2 (TS 33.310)
Purpose: how trust scales to a national RAN. CMPv2 lets each gNB obtain its operator certificate automatically — the only practical way to manage IPsec/TLS identity across tens of thousands of sites.
Purpose: disaggregated RAN means more wires to protect. Each split (RU–DU fronthaul, DU–CU midhaul, CU–core backhaul) is a transport link with its own protection requirement — Chapter 15 goes deeper.
FIGURE 14.10Transport Attacks on Unprotected Links
Purpose: why NDS/IP exists. The transport between nodes faces the same triad of threats as the air interface — and needs the same triad of protections, one layer down.
14.4 The Practical Operator View
IPsec every gNB backhaul that crosses transport you don’t fully control — assume leased lines and microwave are tappable.
Certificate Management Protocol for automated enrollment (TS 33.310)
Real network example. A regional operator leased backhaul from a third-party transport provider to reach rural gNBs. A security audit discovered the N2/N3 traffic on those links ran without IPsec — the rollout team had assumed the leased line was “private.” In practice, the transport provider (and anyone with access to its equipment) could observe NGAP signaling and GTP-U user packets, and potentially inject forged handover commands. Fix: deploy a SEG farm in front of the core, enable IPsec ESP tunnels from every affected gNB, and auto-enroll gNB certificates via CMPv2 so the rollout could scale. “Leased” is not “secure” — anyone on the path is on the path.
Confirm IPsec on every gNB backhaul over non-owned transport.
Verify N4 (PFCP) is protected.
Confirm certificate enrollment is automated (CMPv2) with rotation/revocation.
Check fronthaul/midhaul protection in disaggregated RAN.
Validate IPsec anti-replay and strong algorithms.
Re-assess Zb (intra-domain) protection in cloud/shared deployments.
★ Chapter Summary
NDS/IP protects traffic between network nodes — distinct from NAS/AS, which protect subscriber traffic.
Inter-domain links (Za) get mandatory IPsec; SEGs terminate tunnels at domain edges; IKEv2 authenticates peers by certificate.
Backhaul (gNB↔core, N2/N3) over untrusted transport must be IPsec-protected; N4 is the classic omission.
Disaggregated RAN adds fronthaul/midhaul links to protect (Chapter 15).
CMPv2 automates certificate enrollment — the only practical way to manage IPsec/TLS identity across a large RAN.
? Review Questions
Distinguish NDS/IP from NAS/AS security: what does each protect, and why are both needed?
What protection is mandatory on Za and optional on Zb, and why might the Zb assumption be risky in the cloud?
Describe what IPsec ESP tunnel mode does to a packet and which security properties it provides.
What does IKEv2 authenticate, and why does that stop rogue-node attacks?
Why is gNB backhaul over a leased line not automatically secure?
When would you use IPsec vs TLS for a given core link?
Why is CMPv2 essential for a large RAN, and what does it automate?
Name the three RAN transport segments in a disaggregated deployment and a protection option for each.
🧪 Mini lab — protect a backhaul link
In a lab (or on paper with a real IPsec stack like strongSwan): (1) Establish an IKEv2/IPsec ESP tunnel between two endpoints standing in for gNB and core SEG, authenticated by certificates. (2) Capture traffic before and after — confirm that without the tunnel the inner packets are readable, and with it only ESP is visible. (3) Verify anti-replay by attempting to replay a captured ESP packet. (4) Reflect on scale: with 20,000 gNBs, how would CMPv2 auto-enrollment replace manual certificate installation, and what breaks if a SEG's certificate expires un-rotated? You've now built the infrastructure-layer twin of the air-interface protection from Chapter 9.