Configure GTP Stateful Inspection

Enable GTP Security.
Log in to the firewall web interface.
Select
Device
Setup
Management
General Settings
and select
GTP Security
.
Click
OK
.
Commit
the change.
Select
Device
Setup
Operations
and
Reboot Device
.
Enabling or disabling GTP Security requires a commit and a reboot; the best practice is to commit and reboot at this point. After you enable GTP Security, the options for configuring and monitoring GTP traffic become available on the firewall. If you disable GTP Security, you must also commit your change and reboot the firewall. After you disable GTP Security, the firewall does not perform GTP stateful inspection, but still checks GTP packets against Security policy rules and still applies App-ID.
Create a GTP Protection profile to inspect GTP traffic.
Select
Objects
Security Profiles
GTP Protection
and
Add
a new profile.
Give the profile group a descriptive
Name
.
If the firewall is in Multiple Virtual System Mode, enable the profile to be
Shared
by all virtual systems.
Set up GTP Protection Profile for the GTP version(s) you want to inspect and configure the available options for filtering, overbilling protection, and the logging GTP messages for your compliance and troubleshooting needs.
Allow GTP traffic on your network.
Select

Policies

Security

and click

Add

.

Enter a descriptive

Name

for the rule in the

General

tab.

In the

Source

tab,

Add

the

Source Zone

.

In the

Destination

tab,

Add

the

Destination Zone

.

As a best practice, restrict access to specific components in the EPC network; consider using address objects in the

Destination Address

field to enable access to specific IP addresses.

In the

Application

tab,

Add

the applications that correspond to the network services you want to safely enable. For example, select

gtp-v1

,

gtp-v2

, and

gtp-u

. Make sure to select the applications you enabled for inspection in the GTP Protection profile.

In the

Service/URL Category

tab, change the

Service

from

application-default

to

any

.

In the

Actions

tab, set the

Action Setting

to

Allow

.

Attach the GTP Protection profile to the Security policy rule. Select

Profiles

as the

Profile Type

and select the

GTP inspection

profile you set up earlier.

Verify that

Log at Session End

is enabled. GTP session start and GTP session end events are logged only when you enable log at session start and end in a Security policy rule. The session start and session end logs are available under

Monitor

GTP Logs

. All other GTP events are logged based on the settings you enabled in the GTP Protection profile and are also available under

Monitor

GTP Logs

.

By default, the log storage quota for GTP is 2% of the total log storage capacity for the firewall model. Because GTP logs are high volume, increase the log quota or set up log forwarding to an external server.

Click

OK

.


(
Optional
) Block GTPv0 traffic coming into your network. Add a Security policy rule to deny application
gtp-v0
. 3GPP recommends that a GTPv2 or GTPv1 entity that listens to the GTPv0 port should silently discard any GTPv0 messages it receives. The 3GPP Rel-8 GTPv1 specification removed support for GTPv1 to GTPv0 interworking; hence, a Palo Alto Networks firewall does not support stateful inspection of GTPv0 traffic.

Commit
your policies to the running configuration on the firewall.
Monitor GTP Traffic to verify that you have set up GTP inspection effectively for your visibility and logging needs.