GTP Event Codes
GTP logs include event codes to help you troubleshoot issues. A single GTP event type can have more than one event code, and you can find this granular detail is each log. When a GTP session ends, for example, while the GTP event type is recorded as GTP session end, the event code can be 841 or 844. The event code description below will help you decipher whether the session end was triggered with a Delete message or if the session terminated unexpectedly.
The event codes are a hexidecimal format, where xx is the message type, yy is the Information Element (IE) type, and z is the GTP version.
Normal GTP messages
GTP session ended with a GTPv1 Delete message
GTP session ended with a GTPv2 Delete message
GTP session ended unexpectedly (timeout)
GTPv1 session start
GTPv2 session start
End User IP address spoofed
Overbilling protection in effect
Tunnel block limit reached
Tunnel alert limit reached
Incorrect UDP port in GTPv1 header
Incorrect UDP port in GTPv2 header
Unexpected sequence number in GTPv1 header
Unexpected sequence number in GTPv2 header
Out-of-state GTPv1 message
Out-of-state GTPv2 message
Invalid GTP version
Incorrect reserved field in GTPv1 header
Incorrect reserved field in GTPv2 header
Unknown GTP-U message
Unknown GTPv1-C message
Unknown GTPv2-C message
GTPv1 message matched by RAT filter
GTPv2 message matched by RAT filter
GTPv1 message matched by APN filter
GTPv2 message matched by APN filter
GTPv1 message matched by IMSI-Prefix filter
GTPv2 message matched by IMSI-Prefix filter
Out of order IEs in GTPv1 message
Unknown IE in GTPv1 message (unsupported IE type)
Unknown IE in GTPv2 message (unsupported IE type)
Invalid IE in GTPv1 message, such as invalid IMSI
Invalid IE in GTPv2 message, such as invalid IMSI
Abnormal GTPv1 message length
Abnormal GTPv2 message length
Missing mandatory IE in GTPv1 message
Missing mandatory IE in GTPv2 message
Run out of resource for GTPv1 message
Run out of resource for GTPv2 message
Conflict with another session for GTPv1 message
Conflict with another session for GTPv2 message
Invalid TEID in GTPv1 header (non-existent tunnel)
Invalid TEID in GTPv2 header (non-existent tunnel)
GTP Event Types and Severity
GTP Event Types and Severity The firewall generates GTP logs when the following events occur, and these events are displayed both in the logs and ...
GTP Protection Profile
GTP Protection Profile The GTP Protection profile ( Objects Security Profiles GTP Protection ) enables the firewall to inspect GTP traffic. The options in the ...
Objects > Security Profiles > GTP Protection
Objects > Security Profiles > GTP Protection The GTP Protection profile enables the firewall to inspect GTP traffic. To view this profile, you must enable ...
GTP Cause Values in Logs
GTP Cause Values in Logs When you enable logging, GTP-C request and response messages include Information Element (IE) values that indicates whether a message has ...
Generate Mobile Network Reports
Generate Mobile Network Reports You can view daily reports or configure and schedule custom reports on mobile network activity. The predefined Mobile Network Reports allow ...
Configure GTP Stateful Inspection
Configure GTP Stateful Inspection Mobile Network Operators use the GPRS Tunneling Protocol (GTP) on various interfaces in Roaming, Radio Access Network, and within the packet ...
GPRS Tunneling Protocol (GTP) Security
GPRS Tunneling Protocol (GTP) Security Mobile Network Operators use the GPRS Tunneling Protocol (GTP) on various interfaces in Roaming, Radio Access Network, and within the ...
Monitor GTP Traffic
Monitor GTP Traffic When you enable logging in a security policy rule, the firewall generates a traffic log for when traffic matches the criteria defined ...
GTP Information on the ACC
GTP Information on the ACC The Mobile Network Activity tab on the Application Command Center ( ACC ) includes widgets that visual represent GTP log ...