In this chapter
When a tunnel becomes useful
A directly connected eNodeB and core on your isolated LAN can exchange S1 signalling and GTP-U data without an IPsec tunnel. Keep that path simple. A remote radio crossing ordinary broadband, shared transport or the public Internet needs an authenticated protected path. Native LTE authentication and radio encryption do not themselves protect all radio-to-core transport.
Do not make SCTP 36412 or UDP 2152 public as a shortcut. GTP and core control protocols are not an Internet-facing user API. A security gateway gives each approved site a tunnel identity and limits what it can reach.
Choose the endpoint design
Some Baicells models support IKEv2/IPsec directly. Others work better behind a site router that supplies the VPN. Verify the exact firmware's authentication methods, proposals, identity format, tunnel mode and inner addressing before choosing the gateway. An endpoint that only supports a vendor-specific cloud mode may not work with your intended external core.
A site router with a supported site-to-site VPN can also transport the eNodeB's private Ethernet subnet. WireGuard is an option between routers you control, while IKEv2 is often relevant to a radio's built-in IPsec client. Keep only one clear transport design for the first remote test. Adding both does not automatically add security and can make routing harder to diagnose.
Plan both directions before configuring a tunnel
| Question | Example answer to write down |
|---|---|
| Who initiates? | The remote site initiates through its broadband NAT to a reachable gateway. |
| What authenticates the site? | A unique site certificate or a high-entropy secret for that one site. |
| What is the inner radio subnet? | A new non-overlapping range, not the core LAN copied at every site. |
| Which addresses does the eNodeB advertise? | The S1 and GTP-U addresses reachable through the tunnel. |
| How does the core return traffic? | A route or IPsec policy for the radio’s inner address via SEGW. |
| Which services are permitted? | MME signalling and SGW-U traffic only, plus explicitly required management/timing. |
| What happens on revocation? | Revoke one site identity and verify that only that site loses access. |
| Who owns the spectrum licence? | The operator responsible for the remote radio and its installation. |
IPsec traffic selectors describe which inner addresses the tunnel protects. They are not a replacement for firewall policy. A valid tunnel must not grant access to every management system. In a separate-SEGW design, the core needs a return route via the gateway, and the gateway needs forwarding rules in both directions. NAT inside the mobile transport can break the addresses carried in signalling, so use an explicitly designed routed path.
Implement using the chosen vendor pair
- Keep a backup of the working LAN-only core. Provision a new remote site identity with a clear owner.
- Read the matching strongSwan configuration guide and swanctl reference if SEGW uses strongSwan. Use your radio's actual interoperability guide for the opposite endpoint.
- Configure unique authentication and modern mutually supported cryptography. Do not copy a public example PSK or weaken proposals until a negotiation passes without understanding why.
- Open only the gateway's required VPN transport. IKEv2 commonly uses UDP 500 and NAT traversal UDP 4500. Direct ESP support depends on the transport design. The mobile core remains private.
- Assign and route the approved inner addresses, then add narrowly scoped core and gateway firewall rules for that site.
- Establish the tunnel with RF disabled where the device supports it. Test inner reachability, then S1 setup, then the phone's full data path.
- Verify the site cannot reach another site's radio management or your administration network.
There is no universal Baicells IPsec configuration that safely applies to every model, certificate scheme and NAT arrangement. Use the actual endpoint pair's supported settings. Lodestar's production gateway provides a real example of this role, while the initial beginner LAN deliberately avoids these extra dependencies.
Test the faults that appear after the first connection
Check rekeying, a broadband interruption, router reboot, changing public address and a phone left idle. Measure packet sizes because GTP and IPsec add overhead. A tunnel that passes small pings can still lose larger packets. Preserve ICMP error delivery needed for path MTU discovery and adjust the subscriber MTU deliberately. Avoid blindly changing MTU at every layer.
Keep a tunnel inventory with site name, owner, certificate expiry, inner range, firmware and last successful test. Protect keys, revoke retired hardware and monitor repeated authentication failures. A tunnel being up is one checkpoint. The subscriber must still complete authentication, obtain an address, resolve names and pass the same isolation tests as the original LAN build.