The invention provides media protection of media flows between a network element such as an end point, for instance a mobile user terminal, and another network element over an access network. When media protection is requested, the network element and an intermediate network element such as media proxy establish a connection providing media protection over the access network. An application layer gateway, ALG, may assist in establishing the connection providing media protection by pushing a security association, SA, to the intermediate network element, so as to enable media protection between the network element and the intermediate network element.