Section: 8.2.4 Control Plane for untrusted non 3GPP Access
Content: Figure 8.2.4-1: Control Plane before the signalling IPsec SA is established between UE and N3IWF Figure 8.2.4-2: Control Plane after the signalling IPsec SA is established between UE and N3IWF Large NAS messages may be fragmented by the "inner IP" layer or by TCP. Figure 8.2.4-3: Control Plane for establishment of user-plane via N3IWF In the above figures 8.2.4-1, 8.2.4-2 and 8.2.4-3, the UDP protocol may be used between the UE and N3IWF to enable NAT traversal for IKEv2 and IPsec traffic. The "signalling IPsec SA" is defined in clause 4.12.2 of TS 23.502[ Procedures for the 5G System (5GS) ]  [3].