GTP Profile
You can configure multiple GTP profiles within the GTP menu. GTP profiles concern GTP activity flowing through the unit. These GTP profiles are then applied to a security policy.
GTP profile configuration settings
The following are GTP profile configuration settings in Security Profiles > GTP Profiles.
| GTP Profile
Lists each GTP profile that you have created. On this page, you can edit, delete or create a new GTP profile. |
| Creates a new GTP profile. When you select Create New, you are
Create New automatically redirected to the New page. |
| Edit Modifies settings within a GTP profile in the list. When you select Edit, you are automatically redirected to Edit page. |
| Removes a GTP profile from the list.
To remove multiple GTP profiles from within the list, on the GTP Profile page, in each of the rows of the profiles you want removed, select the Delete check box and then select Delete. To remove all GTP profiles from within the list, on the GTP Profile page, select the check box in the check box column and then select Delete. |
|
| Name The name of the GTP profile. | |
| Displays the number of times the object is referenced to other objects. For example, av_1 profile is applied to a security policy; on the Profile page (Security Profiles > Antivirus > Profiles), 1 appears in Ref. .
To view the location of the referenced object, select the number in Ref., and the Object Usage window appears displaying the various locations of the referenced object. To view more information about how the object is being used, use one of the following icons that is available within the Object Usage window: • View the list page for these objects – automatically redirects you to Ref. the list page where the object is referenced at. • Edit this object – modifies settings within that particular setting that the object is referenced with. For example, av_1 profile is referenced with a security policy and so, when this icon is selected, the user is redirected to the Edit Policy page. • View the details for this object – table, similar to the log viewer table, contains information about what settings are configured within that particular setting that the object is referenced with. For example, av_1 profile is referenced with a security policy, and that security policy’s settings appear within the table. |
|
| New GTP Profile
Provides settings for configuring a GTP profile. |
|
| Name Enter a name for the GTP profile. | |
| General Settings Configure general options for the GTP profile. | |
| Message Type Filtering Configure filtering for messages. | |
| APN Filtering Configure filtering options for APN. | |
| Basic Filtering Configure filtering options for IMSI. | |
| Advanced Filtering | Configure advanced filtering options. |
| IE removal policy | Configure IE removal policy options. |
| Encapsulated IP Traffic
Filtering |
Configure filtering options for encapsulated IP traffic. |
| Encapsulated Non-IP End User Address Filtering | Configure filtering options for encapsulated non-IP end user addresses. |
| Protocol Anomaly | Configure protocol anomaly options. |
| Anti-Overbilling | Configure anti-overbilling options. |
| Log | Configure log options. |
General settings options
The following are mostly house keeping options that appear in the General Settings area of the GTP configuration page.
| General Settings section of the New GTP Profile |
| GTP-in-GTP Select Allow to enable GTP packets to be allowed to contain GTP
packets, or a GTP tunnel inside another GTP tunnel. To block all GTP-in-GTP packets, select Deny. |
| Enter the shortest possible message length in bytes. Normally this is controlled by the protocol, and will vary for different message types. If a packet is smaller than this limit, it is discarded as it is likely malformed and
Minimum Message Length a potential security risk. The default minimum message length is 0 bytes. |
| Maximum Message Length Enter the maximum allowed length of a GTP packet in bytes.
A GTP packet contains three headers and corresponding parts GTP, UDP, and IP. If a packet is larger than the maximum transmission unit (MTU) size, it is fragmented to be delivered in multiple packets. This is inefficient, resource intensive, and may cause problems with some applications. By default the maximum message length is 1452 bytes. |
| General Settings section of the New GTP Profile |
| Enter the maximum number of tunnels allowed open at one time. For additional GTP tunnels to be opened, existing tunnels must first be closed.
This feature can help prevent a form of denial of service attack on your network. This attack involves opening more tunnels than the network can Tunnel Limit handle and consuming all the network resources doing so. By limiting the number of tunnels at any one time, this form of attack will be avoided. The tunnel limiting applies to the Handover Group, and Authorized SGSNs and GGSNs. |
| Tunnel Timeout Enter the maximum number of seconds that a GTP tunnel is allowed to remain active. After the timeout the unit deletes GTP tunnels that have stopped processing data. A GTP tunnel may hang for various reasons. For example, during the GTP tunnel tear-down stage, the “delete pdap context response” message may get lost. By setting a timeout value, you can configure the FortiOS Carrier firewall to remove the hanging tunnels.
The default is 86400 seconds, or 24 hours. |
| Enter the number of packets per second to limit the traffic rate to protect the GSNs from possible Denial of Service (DoS) attacks. The default limit of 0 does not limit the message rate.
GTP DoS attacks can include: Control plane message rate limit • Border gateway bandwidth saturation: A malicious operator can connect to your GRX and generate high traffic towards your Border Gateway to consume all the bandwidth. • GTP flood: A GSN can be flooded by illegitimate traffic |
| Handover Group Select the allowed list of IP addresses allowed to take over a GTP session when the mobile device moves locations.
Handover is a fundamental feature of GPRS/UMTS, which enables subscribers to seamlessly move from one area of coverage to another with no interruption of active sessions. Session hijacking can come from the SGSN or the GGSN, where a fraudulent GSN can intercept another GSN and redirect traffic to it. This can be exploited to hijack GTP tunnels or cause a denial of service. When the handover group is defined it acts like a white list with an implicit default deny at the end — the GTP address must be in the group or the GTP message will be blocked. This stops handover requests from untrusted GSNs. |
| General Settings section of the New GTP Profile |
| Use Authorized SGSNs to only allow authorized SGSNs to send packets through the unit and to block unauthorized SGSNs. Go to Firewall Objects > Address > Addresses and add the IP addresses of the authorized SGSNs to a firewall address or address group. Then set
Authorized SGSNs Authorized SGSNs to this firewall address or address group. You can use Authorized SGSNs to allow packets from SGSNs that have a roaming agreement with your organization. |
| Authorized GGSNs Use Authorized GGSNs to only allow authorized GGSNs to send packets through the unit and to block unauthorized GGSNs. Go to Firewall Objects > Address > Addresses and add the IP addresses of the authorized GGSNs to a firewall address or address group. Then set Authorized GGSNs to this firewall address or address group.
You can use Authorized GGSNs to allow packets from SGSNs that have a roaming agreement with your organization. |
Message type filtering options
On the New GTP Profile page, you can select to allow or deny the different types of GTP messages, which is referred to as message type filtering. You must expand the Message Type Filtering section to access the settings.
The messages types include Path Management, Tunnel Management, Location Management, Mobility Management, MBMS, and GTP-U and Charging Management messages.
For enhanced security, Fortinet best practices dictate that you set Unknown Message Action to deny. This will block all unknown GTP message types, some of which may be malicious.
To configure message type filter options, expand Message Type Filtering in the GTP profile.
APN filtering options
An Access Point Name (APN) is an Information Element (IE) included in the header of a GTP packet. It provides information on how to reach a network.
An APN has the following format:
<network_id>[.mnc<mnc_int>.mcc<mcc_int>.gprs] Where:
- <network_id> is a network identifier or name that identifies the name of a network, for example, com
or internet.
- [.mnc<mnc_int>.mcc<mcc_int>.gprs] is the optional operator identifier that uniquely identifies the operator’s PLMN, for example mcc456.gprs.
Combining these two examples results in a complete APN of internet.mnc123.mcc456.gprs.
By default, the unit permits all APNs. However, you can configure APN filtering to restrict roaming subscribers’ access to external networks.
APN filtering applies only to the GTP create pdp request messages. The unit inspects GTP packets for both APN and selected modes. If both parameters match and APN filter entry, the unit applies the filter to the traffic.
Additionally, the unit can filter GTP packets based on the combination of an IMSI prefix and an APN.
| APN Filtering | ||
| Enable APN Filter | Select to enable APN filtering. | |
| Default APN Action | Select the default action for APN filtering. If you select Allow, all sessions are allowed except those blocked by individual APN filters. If you select Deny, all sessions are blocked except those allowed by individual APN filters. | |
| Value | The APN to be filtered. | |
| Mode | The type of mode chosen that indicates where the APN originated and whether the Home Location Register (HLR) has verified the user subscription: | |
| Action | The type of action that will be taken. | |
| Edit | Modifies the settings within the filter. When you select Edit, the Edit window appears, which allows you to modify the settings of the APN. | |
| Delete | Removes the APN from the list within the table, in the APN Filtering section. | |
| Add APN | Adds a new APN filter to the list. When you select Add APN, the New window appears, which allows you to configure the APN settings. | |
| New APN page | ||
| Value | Enter an APN to be filtered. You can include wild cards to match multiple APNs. For example, the value internet* would match all APNs that being with internet. | |
| Mode | Select one or more of the available modes to indicate where the APN originated and whether the Home Location Register (HLR) has verified the user subscription. | |
| Mobile Station provided | MS-provided APN, subscription not verified, indicates that the mobile station (MS) provided the APN and that the HLR did not verify the user’s subscription to the network. | |
| Network provided | Network-provided APN, subscription not verified, indicates that the network provided a default APN because the MS did not specify one, and that the HLR did not verify the user’s subscription to the network. | |
| Subscription Verified | MS or Network-provided APN, subscription verified, indicates that the MS or the network provided the APN and that the HLR verified the user’s subscription to the network | |
| Action | Select Allow or Deny. | |
Basic filtering options
The International Mobile Station Identity (IMSI) is used by a GPRS Support Node (GSN) to identify a mobile station. Three elements make up every IMSI:
l the mobile country code (MCC) l the mobile network code (MNC) l the mobile subscriber identification number (MSIN).
The subscriber’s home network—the public land mobile network (PLMN)—is identified by the IMSI prefix, formed by combining the MCC and MNC.
By default, the unit allows all IMSIs. You can add IMSI prefixes to deny GTP traffic coming from non-roaming partners. Any GTP packets with IMSI prefixes not matching the prefixes you set will be dropped. GTP Create pdp request messages are filtered and only IMSI prefixes matching the ones you set are permitted. Each GTP profile can have up to 1000 IMSI prefixes set.
An IMSI prefix and an APN can be used together to filter GTP packets if you set an IMSI filter entry with a nonempty APN.
| IMSI Filtering section of the New GTP Profile | |
| Enable IMSI Filter Select to enable IMSI filtering. | |
| Default IMSI Action Select the default action for IMSI filtering. If you select Allow, all sessions are allowed except those blocked by individual IMSI filters. If you select Deny, all sessions are blocked except those allowed by individual IMSI filters. | |
| APN The APN that is part of the IMSI that will be filtered. | |
| MCC-MNC | The MCC-MNC part of the IMSI that will be filtered. |
| Mode | The type of mode that indicates where the APN originated and whether the Home Location Register (HLR) has verified the user subscription. |
| Action | The type of action that will be taken. |
| Edit | Modifies settings to an IMSI filter. When you select Edit, the Edit window appears, which allows you to modify the IMSI filter’s settings. |
| Delete | Removes an IMSI filter from within the table, in the IMSI Filtering section. |
| Add IMSI | Adds a new IMSI filter to the list. When you select Add IMSI, the New window appears, which allows you to configure IMSI filter settings. |
| New IMSI page | |
| APN | Enter the APN part of the IMSI to be filtered. |
| MCC-MNC | Enter the MCC-MCC part of the IMSI to be filtered. |
| Mode | Select one or more of the available modes to indicate where the APN originated and whether the Home Location Register (HLR) has verified the user subscription. |
| Mobile Station provided | MS-provided APN, subscription not verified, indicates that the mobile station (MS) provided the APN and that the HLR did not verify the user’s subscription to the network. |
| Network provided | Network-provided APN, subscription not verified, indicates that the network provided a default APN because the MS did not specify one, and that the HLR did not verify the user’s subscription to the network. |
| Subscription Verified | MS or Network-provided APN, subscription verified, indicates that the MS or the network provided the APN and that the HLR verified the user’s subscription to the network |
| Action | Select Allow or Deny. |
Advanced filtering options
The FortiOS Carrier firewall supports advanced filtering against the attributes RAT, RAI, ULI, APN restriction, and IMEI-SV in GTP to block specific harmful GPRS traffic and GPRS roaming traffic. The following table shows some of the GTP context requests and responses that the firewall supports.
Attributes supported by FortiCarrier firewalls
| GTP Create PDP Context Request | GTP Create PDP Context Response | GTP Update PDP
GTP Update PDP Con- Context text Request Response |
||
| APN | yes | yes | – | |
| APN
Restriction |
yes | – | – | yes |
| IMEI-SV | yes | – | – | – |
| IMSI | yes | – | yes | – |
| RAI | yes | – | yes | – |
| RAT | yes | – | yes | – |
| ULI | yes | – | yes | – |
When editing a GTP profile, select Advanced Filtering > Create New to create and add a rule. When the rule matches traffic it will either allow or deny that traffic as selected in the rule.
| Advanced Filtering | |
| Enable | Select to enable advanced filtering. |
| Default Action | Select the default action for advanced filtering. If you select Allow, all sessions are allowed except those blocked by individual advanced filters. If you select Deny, all sessions are blocked except those allowed by individual advanced filters. |
| Messages | The messages, for example, Create PDP Context Request. |
| APN Restriction | The APN restriction. |
| RAT Type | The RAT types associated with that filter. |
| ULI | The ULI pattern. |
| RAI | The RAI pattern. |
| IMEI | The IMEI pattern. |
| Action | The action that will be taken. |
| Edit | Modifies the filter’s settings. When you select Edit, the Edit window appears, which allows you to modify the filter’s settings. |
| Delete | Removes a filter from the list. |
| Add | Adds a filter to the list. When you select Add, the New window appears, which allows you to configure settings for messages, APN, IMSI, MSISDN, RAT type, ULI, RAI, IMEI patterns as well as the type of action. |
| New Filtering page | |
| Messages | The PDP content messages this profile will match. |
| Create PDP
Context Request |
Select to allow create PDP context requests. |
| Create PDP
Context Response |
Select to allow create PDP context responses. |
| Update PDP
Context Request |
Select to allow update PDP context requests. |
| Update PDP
Context Response |
Select to allow update PDP context responses. |
| APN | Enter the APN. |
| APN Mode | Select an APN mode as one or more of
• Mobile Station provided • Network provided • Subscription provided This field is only available when an APN has been entered. |
| Mobile Station provided | MS-provided PAN, subscription not verified, indicates that the mobile station (MS) provided the APN and that the HLR did not verify the user’s subscription to the network. |
| Network provided | Network-provided APN, subscription not verified, indicates that the network provided a default APN because the MS did not specify one, and that the HLR did no verify the user’s subscription to the network. |
| Subscription verified | MS or Network-provided APN, subscription verified, indicates that the MS or the network provided the APN and that the HLR verified the user’s subscription to the network. |
| APN Restriction | Select the type of restriction that you want. You can choose all of the types, or one of the types. You cannot choose multiple types. Types include:
• all • Public-1 • Public-2 • Private-1 • Private-2 |
| IMSI | Enter the IMSI. |
| MSISDN | Enter the MSISDN. |
| RAT Type | Optionally select the RAT type as any combination of the following:
• Any • UTRAN • GERAN • Wifi • GAN • HSPA Some RAT types are GTPv1 specific. |
| ULI pattern | Enter the ULI pattern. |
| RAI pattern | Enter the RAI pattern. |
| IMEI pattern | Enter the IMEI pattern. |
| Action | Select either Allow or Deny. |
Adding an advanced filtering rule
When adding a rule, use the following formats:
- Prefix, for example, range 31* for MCC matches MCC from 310 to 319. l Range, for example, range 310-319 for MCC matches MCC from 310 to 319.
- Mobile Country Code (MCC) consists of three digits. The MCC identifies the country of domicile of the mobile subscriber.
- Mobile Network Code (MNC) consists of two or three digits for GSM/UMTS applications. The MNC identifies the home PLMN of the mobile subscriber. The length of the MNC (two or three digits) depends on the value of the MCC. Best practices dictate not to mix two and three digit MNC codes within a single MCC area. l Location Area Code (LAC) is a fixed length code (of 2 octets) identifying a location area within a PLMN. This part of the location area identification can be coded using a full hexadecimal representation except for the following reserved hexadecimal values: 0000 and FFFE. These reserved values are used in some special cases when no valid LAI exists in the MS (see 3GPP TS 24.008, 3GPP TS 31.102 and 3GPP TS 51.011).
- Routing Area Code (RAC) of a fixed length code (of 1 octet) identifies a routing area within a location. l CI or SAC of a fixed length of 2 octets can be coded using a full hexadecimal expression.
- Type Allocation Code (TAC) has a length of 8 digits.
- Serial Number (SNR) is an individual serial number identifying each equipment within each TAC. SNR has a length of 6 digits. l Software Version Number (SVN) identifies the software version number of the mobile equipment. SVN has a length of 2 digits.