[113261] in North American Network Operators' Group
Re: Do we still need Gi Firewall for 3G/UMTS/HSPA network ?
daemon@ATHENA.MIT.EDU (Mikael Abrahamsson)
Thu Apr 9 12:28:01 2009
Date: Thu, 9 Apr 2009 18:17:09 +0200 (CEST)
From: Mikael Abrahamsson <swmike@swm.pp.se>
To: "Lee, Steven (NSG Malaysia)" <kin-wei.lee@hp.com>
In-Reply-To: <084962C061414240A0CDB4BE328A9B2D119F91724A@GVW1100EXC.americas.hpqcorp.net>
Cc: "nanog@nanog.org" <nanog@nanog.org>
Errors-To: nanog-bounces+nanog.discuss=bloom-picayune.mit.edu@nanog.org
On Thu, 9 Apr 2009, Lee, Steven (NSG Malaysia) wrote:
> Hi all, in most of the existing 2G/2.5G mobile PS-core (Packet Switch)
> networks have Gi segment (interface between GGSN & IP Router/firewall).
> Due to the IP address constraint, operator usually do NAT on the Gi
> firewall to NAT the private IP to public IP in the past. Looking at the
> traffic pattern and user access behaviour, does it make sense to have
> firewall between the GGSN & Public Internet if the public IP addresses
> are sufficient to cater for mobile subscribers? Especially with
> 3G/UMTS/HSPA or even LTE in the future.
The only reason I see to have a FW on Gi would be to have a stateful
device to stop scanning from the Internet towards the mobile devices (I
don't know how much SYNs you see on a /16 nowadays, it used to be quite a
lot). I know mobile operators who have been operating with public IPs to
all customers without FW for a lot of years. Todays GGSN and other devices
should handle it, even though they didn't do it well 5+ years back.
--
Mikael Abrahamsson email: swmike@swm.pp.se
