Enabling stateful inspection for either GTPv1-C and/or GTPv20C, automatically enables GTPU-U stateful inspection.

You can specify the following validity checks for GTP-U payloads.

In addition you can also configure an allow, block or alert action for:

By default all Radio Access Technologies (RAT) are allowed. GTP-C Create-PDP-Request and Create-Session-Request messages are filtered or allowed based on the RAT filter. You can specify whether to allow, block or alert on the following Remote Access Technologies (RAT) that the user equipment uses to access the mobile core network:

IMSI (International Mobile Subscriber Identity) is a unique identification associated with a subscriber in GSM, UMTS and LTE networks that is provisioned in the Subscriber Identity Module (SIM) card.

An IMSI is usually presented as a 15 digit long number (8 bytes), but can be shorter. IMSI is composed of three parts:

The

IMSI Prefix

combines the MCC and MNC and allows you to allow, block, or alert GTP traffic from a specific PLMN. By default all IMSI are allowed.

You can either manually enter or import a csv file with IMSI or IMSI prefixes into the firewall. The IMSI can include wildcards, for example, 310* or 240011*.

The firewall supports a maximum of 5000 IMSI or IMSI prefixes.

The Access Point Name (APN) is a reference to a GGSN/ PGW that a user equipment requires to connect to the internet. The APN is composed of two parts:

By default all APNs are allowed. The APN filter allows you to allow, block, or alert GTP traffic based on the APN value. GTP-C Create-PDP-Request and Create-Session-Request messages are filtered or allowed based on the rules defined for APN filtering.

You can manually add or import an APN filtering list into the firewall. The value for the APN must include the network ID or the domain name of the network (for example, example.com) and, optionally, the operator ID.

For APN filtering, the wildcard '*' allows you to match for all APN. A combination of '*' and other characters is not supported for wildcards. For example, "internet.mnc* " is treated as a regular APN and will not filter all entries that start with internet.mnc..

The firewall supports a maximum of 1000 APN filters.

Allows you to limit the maximum number of GTP-U tunnels to a destination IP address, for example to the GGSN.

Range: 0 to 100000000 tunnels.

Specify the threshold at which the firewall triggers an alert when the number of maximum GTP-U tunnels to a destination have been established. A GTP log message of high severity is generated when the configured tunnel limit is reached.

The number of events that the firewall counts before it generates a log when the configured GTP tunnel limits are exceeded. This setting allows you to reduce the volume to messages logged.

Default: 100; range: 1 to 100000000

Select the virtual system that serves as the Gi/ SGi firewall on your firewall. The Gi/ SGi firewall inspects the mobile subscriber IP traffic traversing over the Gi/ SGi interface from the PGW/ GGSN to the external PDN (packet data network) such as the internet and secures internet access for mobile subscribers.

Overbilling can occur when a GGSN assigns a previously used IP address from the End User IP address pool to a mobile subscriber. When a malicious server on the internet continues to send packets to this IP address as it did not close the session initiated for the previous subscriber and the session is still open on the Gi Firewall. To disallow data from being delivered, whenever a GTP tunnel is deleted (detected by delete-PDP or delete-session message) or timed-out, the firewall enabled for overbilling protection notifies the Gi/ SGi firewall to delete all the sessions that belong to the subscriber from the session table. GTP Security and SGi/ Gi firewall should be configured on the same physical firewall, but can be in different virtual systems. In order to delete sessions based on GTP-C events, the firewall needs to have all the relevant session information and this is possible only when you manage traffic from the SGi + S11 or S5 interfaces for GTPv2 and Gi + Gn interfaces for GTPv1 in the mobile core network.

Allows you to selectivity enable logging of the allowed GTPv1-C messages, if you have enabled stateful inspection for GTPv1?C. These messages generate logs to help you troubleshoot issues as needed.

By default, the firewall does not log allowed messages. The logging options for allowed GTPv1-C messages are:

Allows you to include the user location information, as area code and Cell ID, in GTP logs.

Allows you to selectively enable logging of the allowed GTPv2-C messages, if you have enabled stateful inspection for GTPv2-C. These messages generate logs to help you troubleshoot issues as needed.

By default, the firewall does not log allowed messages. The logging options for allowed GTPv2-C messages are:

Allows you to selectively enable logging of the allowed GTP-U messages, if you have enabled stateful inspection for GTPv2?C and/or GTPv1-C. These messages generate logs to help you troubleshoot issues as needed.

The logging options for allowed GTP-U messages are: