IoT Security Administrator’s Guide
    : Discover Mobile Device Attributes
    Focus
    Download PDF
    Focus
    1. Home
    2. IoT
    3. IoT Security Administrator’s Guide
    4. Discover IoT Devices and Take Inventory
    5. Discover Mobile Device Attributes
    Download PDF

    IoT Security Administrator’s Guide

    Discover Mobile Device Attributes

    Table of Contents

    Discover Mobile Device Attributes

    IoT Security
     discovers the attributes of mobile devices in G3, G4, and G5 cellular networks.
    IoT Security
     can learn mobile (cellular) device attributes, add the devices to its inventory, and track them by the IMEI numbers. You can then see various mobile device attributes for them on the
    Assets
    Devices
     and
    Device Details
     pages. You can also use the mobile device attributes when creating custom alerts. However, because they are classified as Traditional IT,
    IoT Security
     doesn’t make policy rule recommendations or send firewalls IP address-to-device mappings for mobile devices.

    Set up
    PAN-OS
     to Send
    IoT Security
     Mobile Device Attributes

    This assumes that
    IoT Security
     is already onboarded on your firewall, it has the required licenses and certificates, and logging is enabled.
    1. Enable GTP Security on the firewall.
      1. Log in to
        PAN-OS
        , select
        Device
        Setup
        Management
        , and then click
        Edit
         (the gear icon) for General Settings.
      2. Select
        GTP Security
         and then click
        OK
        .
      3. Commit
         your changes and then select
        Device
        Operations
        Reboot Device
        .
    2. Create a Log Forwarding profile that includes GTP logging.
      1. Log back in and select
        Objects
        Log Forwarding
        Add
        .
      2. Enter a name for the log forwarding profile like
        Mobile Device Logging
        , select
        Enable enhanced application logging to
        Cortex Data Lake
        , and then click
        OK
        .
    3. Create a Mobile Network Protection profile for the types of mobile devices on the network.
      The following are the recommended settings that enable the correlation of user IDs and equipment IDs to user equipment IP addresses (UEIP) for different mobile devices. For details about each setting, see the Mobile Network Protection Profile help in
      PAN-OS
      .
      • 5G mobile devices with RADIUS
        1. Select
          Objects
          Security Profiles
          Mobile Device Protection
           and then click
          Add
          .
        2. Enter a name for the profile such as
          RADIUS Correlation
          , click
          Correlation
          , and then enter the following:
          UEIP Correlation
          : (select)
          Mode
          :
          Loose
          User Plane with GTP-U encapsulation
          : (clear)
          Source
          :
          RADIUS
          Log At Ueip Start
          : (select)
          Log At Ueip End
          : (select)
        3. Click
          GTP Inspection
          GTP-U
          , and then enter the following to perform validity checks of the Information Element (IE) in GTP headers and generate alerts if any irregularities are found:
          Alert
          : (select)
          Reserved IE
          : (select)
          Order of IE
          : (select)
          Length of IE
          : (select)
          Spare Flag in Header
          : (select)
          Unsupported message type
          : (select)
          GTP-in-GTP
          :
          alert
      • 5G mobile devices with Packet Forwarding Control Protocol (PFCP)
        1. Select
          Objects
          Security Profiles
          Mobile Device Protection
           and then click
          Add
          .
        2. Enter a name for the profile such as
          PFCP-5G Correlation
          , click
          Correlation
          , and then enter the following:
          UEIP Correlation
          : (select)
          Mode
          :
          Loose
          User Plane with GTP-U encapsulation
          : (clear)
          Source
          :
          PFCP
          Log At Ueip Start
          : (select)
          Log At Ueip End
          : (select)
        3. Click
          GTP Inspection
          GTP-U
          , and then enter the following to perform validity checks of the IE in GTP headers and generate alerts if any irregularities are found:
          Alert
          : (select)
          Reserved IE
          : (select)
          Order of IE
          : (select)
          Length of IE
          : (select)
          Spare Flag in Header
          : (select)
          Unsupported message type
          : (select)
          GTP-in-GTP
          :
          alert
      • 3G and 4G mobile devices with GTP-C
        1. Select
          Objects
          Security Profiles
          Mobile Device Protection
           and then click
          Add
          .
        2. Enter a name for the profile such as
          GTP-C-3G4G Correlation
          , and then enter the following in the
          GTP-C
           tab to use stateful inspection, perform validity checks of the IE in GTP headers, and generate alerts if irregularities are found:
          GTPv1-C
          Stateful Inspection
          : (select)
          Alert
          : (select)
          Reserved IE
          : (select)
          Order of IE
          : (select)
          Length of IE
          : (select)
          Spare Flag in Header
          : (select)
          Unsupported message type
          : (select)
          GTPv2-C
          :
          Stateful Inspection
          : (select)
          Alert
          : (select)
          Reserved IE
          : (select)
          Length of IE
          : (select)
          Spare Flag in Header
          : (select)
          Unsupported message type
          : (select)
        3. Click
          GTP-U
          , and then enter the following:
          Alert
          : (select)
          Reserved IE
          : (select)
          Order of IE
          : (select)
          Length of IE
          : (select)
          Spare Flag in Header
          : (select)
          Unsupported message type
          : (select)
          GTP-in-GTP
          :
          alert
          Log at GTP-U session start
          : (select)
          Log at GTP-U session end
          : (select)
          GTP-U Content Inspection
          : (select)
    4. Create Security policy rules to log mobile device traffic and forward the logs to the logging service.
      Create Security policy rules to log mobile device traffic and forward logs to the logging service for
      IoT Security
       to analyze. The rules you create depend on the generation of mobile devices on the network and whether the network uses RADIUS or PFCP.
      • 5G mobile devices with RADIUS
        1. Select
          Policies
          Security
          and then click
          Add
          .
        2. Create a universal Security policy rule with the following settings:
          Allow
          radius
          as the application from any source to any destination.
          In the Actions tab, choose
          Profiles
           as the Profile Type, choose the Mobile Network Protection profile you created previously for the RADIUS correlation, select
          Log at Session Start
           and
          Log at Session End
          , and choose the Log Forwarding profile you previously created.
          Click
          OK
          .
        3. Click
          Add
           and then create a universal Security policy rule with the following settings:
          In the Actions tab, choose
          None
           as the Profile Type, select
          Log at Session Start
           and
          Log at Session End
          , and choose the Log Forwarding profile you previously created.
          Allow any application from any source to any destination.
          Click
          OK
          .
        4. If necessary, reposition the first rule above the second in the ruleset.
      • 5G mobile devices with PFCP
        1. Select
          Policies
          Security
           and then click
          Add
          .
        2. Create a universal Security policy rule with the following settings:
          Allow
          pfcp
           as the application from any source to any destination.
          In the Actions tab, choose
          Profiles
           as the Profile Type, choose the Mobile Network Protection profile you created previously for the PFCP 5G correlation, select
          Log at Session Start
           and
          Log at Session End
          , and choose the Log Forwarding profile you previously created.
          Click
          OK
          .
        3. Click
          Add
           and then create a universal Security policy rule with the following settings:
          Allow
          gtp-u
           as the application from any source to any destination.
          In the Actions tab, choose
          Profiles
           as the Profile Type, choose the Mobile Network Protection profile you created previously for the PFCP 5G correlation, select
          Log at Session Start
           and
          Log at Session End
          , and choose the Log Forwarding profile you previously created.
          Click
          OK
          .
        4. Click
          Add
           and then create a universal Security policy rule with the following settings:
          Allow any application from any source to any destination.
          In the Actions tab, choose
          None
           as the Profile Type, select
          Log at Session Start
           and
          Log at Session End
          , and choose the Log Forwarding profile you previously created.
          Click
          OK
          .
        5. If necessary, reposition rules so that the first and second rules are above the third in the ruleset.
      • 3G and 4G mobile devices with GTP-C
        1. Select
          Policies
          Security
           and then click
          Add
          .
        2. Create a universal Security policy rule with the following settings:
          Allow
          gtpv1-c
           and
          gtpv2-c
           as the application from any source to any destination.
          In the Actions tab, choose
          Profiles
           as the Profile Type, choose the Mobile Network Protection profile you created previously for the GTP-C 3G and 4G correlation, select
          Log at Session Start
           and
          Log at Session End
          , and choose the Log Forwarding profile you previously created.
          Click
          OK
          .
        3. Click
          Add
           and then create a universal Security policy rule with the following settings:
          Allow
          gtp-u
           as the application from any source to any destination.
          In the Actions tab, choose
          Profiles
           as the Profile Type, choose the Mobile Network Protection profile you created previously for the GTP-C 3G and 4G correlation, select
          Log at Session Start
           and
          Log at Session End
          , and choose the Log Forwarding profile you previously created.
          Click
          OK
          .
        4. Click
          Add
           and then create a universal Security policy rule with the following settings:
          Allow any application from any source to any destination.
          In the Actions tab, choose
          None
           as the Profile Type, select
          Log at Session Start
           and
          Log at Session End
          , and choose the Log Forwarding profile you previously created.
          Click
          OK
          .
        5. If necessary, reposition rules so that the first and second rules are above the third in the ruleset.
    5. Commit
       the configuration

    View Mobile Device Attributes in
    IoT Security

    After the firewall begins logging mobile device traffic, it forwards the traffic metadata in GTP logs to the logging service, which in turn streams it to
    IoT Security
    . To check the status of the GTP logs, log in to the
    IoT Security
     portal and select
    Administration
    Firewalls
    . There you can see if
    IoT Security
     is receiving GTP logs, the time of the latest log, and how many GTP log events and bytes it’s received.
    To see mobile device attributes in the device inventory on the Devices page, select
    Assets
    Devices
    . Because the Mobile Device columns are hidden by default, click the icon with three vertical bars to open the column selection panel, and select all the columns you want to see. All the columns displaying mobile device attributes are available in the Mobile section:
    • Mobile Equipment Identity
       – The 15-to-17-digit code assigned to every mobile device to uniquely identify it International Mobile Equipment Identity (IMEI)
    • Mobile Subscriber Identity
       – A unique identifier issued on a Subscriber Identity Module (SIM) card. In 2G, 3G, and 4G networks, this identifier is referred to as International Mobile Subscriber Identity (IMSI). In 5G networks, it is called Subscription Permanent Identifier (SUPI).
    • Mobile Subscriber ISDN
       – The Integrated Services Digital Network number is a mapping of a cellular telephone number to a mobile subscriber
    • Mobile APN
       (Access Point Name) – Term used to identify the external Packet Data Network (PDN) to which mobile devices connect through the 2G, 3G, or 4G cellular network. In a 5G network, it refers to the Data Network Name (DNN).
    • Radio Access Technology
       – The underlying connection method mobile devices use for wireless radio communications; for example, Bluetooth, Wi-Fi, UMTS, LTE, or 5G NR
    • Mobile Base Station Code
       – The identification number that uniquely identify a cellular base station
    • Mobile Area Code
       – The area code of the user’s location
    • Mobile Network Code
       (MNC) – A two-digit (European standard) or three-digit (North American standard) number identifying the Public Land Mobile Network (PLMN) of the mobile subscriber
    • Mobile Country Code
       (MCC) – A three-digit number identifying the country of the mobile subscriber
    • Mobile TAC
       (Type Allocation Code) – An eight-digit number that identifies the manufacturer of a mobile device
    • Network Slice
       – The logically discrete section of network operating over a common infrastructure
    • Mobile Device
       – The end user device operating on a wireless network
    In addition to showing columns with these attributes in the inventory table, you can also use them in filters and queries at the top of the Devices page. They are displayed on the Device Details page of mobile devices and are available for use when creating custom alert rules.

    Recommended For You

    © 2024 Palo Alto Networks, Inc. All rights reserved.