Inside the Telco Backbone: IPSec secures RAN, Core, and Edge in Cloud‑Native Networks

Rows of illuminated server racks lining a modern data center aisle

Telecom backbone networks have quietly evolved from tightly controlled MPLS cores into sprawling, cloud‑interconnected infrastructures where encryption is no longer optional. While the optical and Layer‑2 domains still carry the bulk of high‑capacity traffic, modern telco architectures increasingly rely on IPsec to secure the segments where trust boundaries blur — mobile backhaul, inter‑DC links, roaming interfaces, and control‑plane signaling. As 4G/5G deployments expand and workloads shift toward distributed edge and cloud environments, IPsec has become a foundational security mechanism inside carrier networks, not just at the enterprise perimeter.

At the same time, the rise of virtualized RAN, containerized core functions, and multi‑cloud orchestration has pushed operators to rethink how they protect traffic moving across heterogeneous infrastructure. Traditional assumptions about “trusted transport” no longer hold, core functions run in Kubernetes clusters, and roaming interfaces traverse shared IPX fabrics. IPsec’s ability to provide uniform encryption, authentication, and integrity across these diverse environments makes it uniquely suited for the modern telco backbone. Telco backbones are heavily relying on multi‑gigabit IPsec throughput.

do telcos use IPsec for call data?

A voice call that leaves one operator’s network does not ride a single encrypted pipe from handset to handset. The UE is ciphered on the radio. The inner core is usually an MPLS VPN the operator already trusts. The hop that needs IPsec is the domain border: two Security Gateways (SEGs) facing each other over an interconnect, talking IKEv2 and forwarding ESP.

So, yes they do especially on IMS Za. 3GPP TS 33.210 (NDS/IP) is still the IPsec profile 5G points at. SEGs shall keep an ESP tunnel-mode SA on Za. Integrity and anti-replay are mandatory; encryption is recommended. IKEv2 negotiates that tunnel. Operators normally leave it up all the time, not per call. Mind you the packets inside are still SIP and RTP; IPsec is the wrapping, not a new call protocol.

IMS interconnect names for reference

NameWhat it isSpec
IciSIP/SDP between two IMS networksTS 29.165
IziRTP/RTCP between two IMS networksTS 29.165
ZaSEG–SEG IPsec ESP tunnel between two security domainsTS 33.210 5.6.2
Zboptional NE–SEG (or NE–NE) IPsec inside one domainTS 33.210


3 places IPsec actually sits

1. Security Gateway to Security Gateway (Za). As shared above this is two SEGs, IKEv2, one or more ESP tunnels, traffic selectors that match SIP but not the user-plane ports the operator wants to leave alone.

2. Untrusted RAN backhaul. Small cells, microwave last miles, shared fibre

3. IPX and bilateral trunks. Direct leased line, L2 Ethernet, or L3 VPN.

IPsec is how telcos protect untrusted backhaul and non-SBA interconnect.

IMS Core today + Inter operator roaming-agreement

So back to the inter operator image from earlier, 2SEGs keep one ESP tunnel on Za. 

Ici SIP (and GTP-C) go through the SEG. On the wire between SEGs that is ESP.

 Izi RTP (the actual voice/video) often goes around it (TrGW to TrGW). Typical VoLTE/VoNR interconnect does not put that in the same IPsec CHILD_SA, and does not use SRTP on the NNI either (TrGW may transcode, LI, play announcements). So those RTP packets are often plaintext IP to anyone who can see that hop ! That hop is still almost never the public Internet. It rides GSMA IPX / private peering / MPLS…

That is a selector choice, not a 3GPP ban. The SEG can include RTP ports in the CHILD_SA but Operators skip media in ESP for latency, MTU, and CPU.

IPX and bilateral trunks

Bilateral trunk is a direct circuit between those two operators: fibre, a leased wavelength, Ethernet, or (last resort) the public Internet.  

If the trunk is a private L1/L2 that nobody else can tap, IR.34 does not demand IPsec on the underlay. Operators still often keep Za ESP for SIP on top. If the “trunk” is actually the public Internet, IR.77 is blunt: IPsec is mandatory (encrypt + integrity + authenticate; only IKE and ESP reachable on the endpoints). That ESP wraps everything on the trunk ( SIP and RTP ) because it is a transport VPN

As for IPX,  each operator buys one access into an IPX provider. That port reaches many partners. IPX providers peer with each other on the IPI. SIP, RTP, GTP, Diameter and N32 all ride the same fabric.

As one access into a private fabric reaches many partners, private L1/L2 into IPX, and a private IPI between providers, stay clear: isolation is the security.  IPsec is required on a shared peering VLAN (IR.34) and on any hop that uses the public Internet (IR.77). 


Stay tuned for a follow-up on post-quantum crypto and telcos: what a cryptographically relevant quantum crypto does to these same hops and why interconnects feel “harvest-now-decrypt-later” issues first.

References

Leave a comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.