Section: 9.1.2 Implementation requirements
Content: IPsec ESP implementation shall be done according to RFC 4303 [4] as profiled by TS 33.210[ Network Domain Security (NDS); IP network layer security ]  [3]. For IPsec implementation, tunnel mode is mandatory to support while transport mode is optional. IKEv2 certificate-based authentication implementation shall be done according to TS 33.310[ Network Domain Security (NDS); Authentication Framework (AF) ]  [5]. The certificates shall be supported according to the profile described by TS 33.310[ Network Domain Security (NDS); Authentication Framework (AF) ]  [5]. IKEv2 shall be supported conforming to the IKEv2 profile described in TS 33.310[ Network Domain Security (NDS); Authentication Framework (AF) ]  [5].