A method for dynamically and securely establishing tunnels for a mobile device, characterized by: extending PANA protocol such as to dynamically assign one or more tunnel endpoint addresses to a PANA client which is not on the same IP-link as a PANA authentication agent depending on a prior PANA authentication result; using, in order to allow the PANA protocol to run between a PANA client and a PANA authentication agent that are not on the same IP-link: the IP address of the PANA client and a source port number of PANA messages sent from the PANA client to the PANA authentication agent as a PANA device identifier of the PANA client so as to distinguish multiple PANA clients, such that the PANA client device identifier is redefined to enable identification of multiple PANA clients; and the IP address of the PANA authentication agent and a source port number of PANA messages sent from the PANA authentication agent to the PANA client as a PANA device identifier of the PANA authentication agent such that the PANA authentication agent device identifier is redefined to enable identification of multiple authentication agents; and establishing multiple IPsec tunnels from said PANA client to different endpoints, including dynamically assigning a tunnel endpoint to a new endpoint depending on an authentication result for another endpoint. extending PANA protocol such as to dynamically assign one or more tunnel endpoint addresses to a PANA client which is not on the same IP-link as a PANA authentication agent depending on a prior PANA authentication result; using, in order to allow the PANA protocol to run between a PANA client and a PANA authentication agent that are not on the same IP-link: the IP address of the PANA client and a source port number of PANA messages sent from the PANA client to the PANA authentication agent as a PANA device identifier of the PANA client so as to distinguish multiple PANA clients, such that the PANA client device identifier is redefined to enable identification of multiple PANA clients; and the IP address of the PANA authentication agent and a source port number of PANA messages sent from the PANA authentication agent to the PANA client as a PANA device identifier of the PANA authentication agent such that the PANA authentication agent device identifier is redefined to enable identification of multiple authentication agents; and the IP address of the PANA client and a source port number of PANA messages sent from the PANA client to the PANA authentication agent as a PANA device identifier of the PANA client so as to distinguish multiple PANA clients, such that the PANA client device identifier is redefined to enable identification of multiple PANA clients; and the IP address of the PANA authentication agent and a source port number of PANA messages sent from the PANA authentication agent to the PANA client as a PANA device identifier of the PANA authentication agent such that the PANA authentication agent device identifier is redefined to enable identification of multiple authentication agents; and establishing multiple IPsec tunnels from said PANA client to different endpoints, including dynamically assigning a tunnel endpoint to a new endpoint depending on an authentication result for another endpoint.