GTP message type filtering
FortiOS Carrier supports message filtering in GTP by the type of message.
This section includes:
Common message types on carrier networks
Carrier networks include many types of messages — some concern the network itself, others are content moving across the network, and still others deal with handshaking, billing, or other administration based issues.
GTP contains two major parts GTP for the control plane (GTP-C) and GTP for user data tunnelling (GTP-U). Outside of those areas there are only unknown message types.
GTP-C messages
GTP-C contains the networking layer messages. These address routing, versioning, and other similar low level issues.
When a subscriber requests a Packet Data Protocol (PDP) context, the SGSN will send a create PDP context request GTP-C message to the GGSN giving details of the subscriber’s request. The GGSN will then respond with a create PDP context response GTP-C message which will either give details of the PDP context actually activated or will indicate a failure and give a reason for that failure. This is a UDP message on port 212.
GTP-C message types include Path Management Messages, Location Management Messages, and Mobility Management Messages.
Path Management Messages
Path management is used by one GSN to detect if another GSN is alive, or if it has restarted after a failure.
The path management procedure checks if a given GSN is alive or has been restarted after a failure. In case of SGSN restart, all MM and PDP contexts are deleted in the SGSN, since the associated data is stored in a volatile memory. In the case of GGSN restart, all PDP contexts are deleted in the GGSN.
Tunnel Management Messages
The tunnel management procedures are used to create, update, and delete GTP tunnels in order to route IP PDUs between an MS and an external PDN via the GSNs.
The PDP context contains the subscriber’s session information when the subscriber has an active session. When a mobile wants to use GPRS, it must first attach and then activate a PDP context. This allocates a PDP context data structure in the SGSN that the subscriber is currently visiting and the GGSN serving the subscriber’s access point.
Tunnel management procedures are defined to create, update, and delete tunnels within the GPRS backbone network. A GTP tunnel is used to deliver packets between an SGSN and a GGSN. A GTP tunnel is identified in each GSN node by a TEID, an IP address, and a UDP port number.
Location Management Messages
The location-management procedure is performed during the network-requested PDP context activation procedure if the GGSN does not have an SS7 MAP interface (i.e., Gc interface). It is used to transfer location messages between the GGSN and a GTP-MAP protocol-converting GSN in the GPRS backbone network.
Location management subprocedures are used between a GGSN that does not support an SS7 MAP interface (i.e., Gc interface) and a GTP-MAP protocol-conversing GSN. This GSN supports both Gn and Gc interfaces and is able to perform a protocol conversing between GTP and MAP.
Mobility Management Messages
The MM procedures are used by a new SGSN in order to retrieve the IMSI and the authentication information or MM and PDP context information in an old SGSN. They are performed during the GPRS attach and the interSGSN routing update procedures.
The MM procedures are used between SGSNs at the GPRS-attach and inter-SGSN routing update procedures. An identity procedure has been defined to retrieve the IMSI and the authentication information in an old SGSN. This procedure may be performed at the GPRS attach. A recovery procedure enables information related to MM and PDP contexts in an old SGSN to be retrieved. This procedure is started by a new SGSN during an inter-SGSN RA update procedure.
GTP-U messages
GTP-U is focused on user related issues including tunneling, and billing. GTP-U message types include MBMS messages, and GTP-U and Charging Management Messages
MBMS messages
Multimedia Broadcast and Multicast Services (MBMS) have recently begun to be offered over GSM and UMTS networks on UTRAN and GERAN radio access technologies. MBMS is mainly used for mobile TV, using up to four GSM timeslots for one MBMS connection. One MBMS packet flow is replicated by GGSN, SGSN and RNCs.
MBMS is split into the MBMS Bearer Service and the MBMS User Service. The MBMS User Service is basically the MBMS Service Layer and offers a Streaming- and a Download Delivery Method. The Streaming Delivery method can be used for continuous transmissions like Mobile TV services. The Download Method is intended for “Download and Play” services.
GTP-U and Charging Management Messages
SGSNs and GGSNs listen for GTP-U messages on UDP port 2152.
GTP‘ (GTP prime) is used for billing messages. It uses the common GTP messages (GTP Version Not Supported, Echo Request and Echo Response) and adds additional messages related to billing procedures.
Unknown Action messages
If the system doesn’t know what type of message it is, it falls into this category. This is an important category of message because malformed messages may appear and need to be handled with security in mind.
Configuring message type filtering in FortiOS Carrier
GPRS Tunnelling Protocol (GTP) is a group of IP-based communications protocols used to carry General Packet
Radio Service (GPRS) traffic within Global System for Mobile Communications (GSM) and Universal Mobile Telecommunications System (UMTS) networks. It allows carriers to transport actual cellular packets over their network via tunneling.
In the CLI, there is a keyword for each type of GTP message for both message filtering, and for message rate limiting.
To configure GTP message type filtering – web-based manager
- Go to Security Profiles > GTP Profile.
- Select Create New.
- Enter a name for this profile such as msg_type_filtering.
- Select Message Type Filtering to expand it.
- For each type of message in the list, select Allow or Deny. All messages are set to Allow by default.
- Optionally select and configure any other GTP features for this profile, such as logging.
- Select OK to save the profile.
- Apply the msg_type_filtering profile a security policy configured for GTP tunnel traffic.
To configure GTP message filtering and block Unknown Message Action messages- CLI
config firewall gtp edit msg_type_filtering config message-filter set unknown-message-action deny
next
end
end
Message Type Fields
Each of the following message types can be allowed or denied by your Carrier-enabled FortiGate unit depending on your carrier network and GTP traffic.
Unknown Message Action
Set this message type to deny.
Many attempts to hack into a carrier network will result in this unknown message type and therefore it is denied for security reasons.
Path Management Messages
| Message Type | Used by | Description |
| Echo Request/Response | GTP-C,
GTP-U, GTP’ |
Echo Request is sent on a path to another GSN to determine if the other node is alive. Echo Response is the reply. |
| Version not Supported | GTP-C,
GTP-U, GTP’ |
There are multiple versions of GTP. Both devices communicating must use the same version of GTP, or this message will be the response. |
| Support Extension Headers
Notification |
Extensions are optional parts that a device can choose to support or not. If a device includes these extensions, it must include headers for the extensions to sure ensure proper formatting. |
Tunnel Management Messages
| Message Type | Used by | Description |
| Create PDP Context Request/ Response | GTP-C | Sent from an SGSN to a GGSN node as part of a GPRS PDP
Context Activation procedure or the Network-Requested PDP Context Activation procedure. A valid request initiates the creation of a tunnel. |
| Update PDP Context Request/ Response | GTP-C | Used when PDP Context information changes, such as when a mobile device changes location. |
| Delete PDP Context Request/ Response | GTP-C | Used to terminate a PDP Context, and confirm the context has been deleted. |
| Create AA PDP Context Request/ Response | GTP-C | Sent as part of the GPRS Anonymous Access PDP Context Activation. It is used to create a tunnel between a context in the SGSN and a context in the GGSN. |
| Delete AA PDP Context Request/ Response | GTP-C | Sent as part of the GPRS PDP Anonymous Access Context
Deactivation procedure to deactivate an activated PDP Context. It contains Cause and Private Extension Information Elements |
| Message Type | Used by | Description |
| Error Indication | GTP-U | Sent to the GGSN when a tunnel PDU is received for the following conditions:
— No PDP context exists — PDP context is inactive — No MM context exists — GGSN deletes its PDP context when the message is received. |
| PDU Notification Request/
Response/ Reject Request/ Reject Response |
GTP-C | When receiving a Tunneled PDU (T-PDU), the GGSN checks if a PDP context is established for the given PDP address. If no PDP context has been established, the GGSN may initiate the Network-requested PDP Context Activation procedure by sending a PDU Notification Request to the SGSN.
Reject Request – Sent when the PDP context requested by the GGSN cannot be established. |
Location Management Messages
| Message Type | Used By | Description |
| Send Routing Information for GPRS Request/ Response | GTP-C | Sent by the GGSN to obtain location information for the MS.
This message type contains the IMSI of the MS and Private Extension. |
| Failure Report Request/ Response | GTP-C | Sent by the GGSN to the HLR when a PDU reject message is received.
The GGSN requests the HLR to set the flag and add the GGSN to the list of nodes to report to when activity from the subscriber that owns the PDP address is detected. The message contains the subscriber IMSI and Private Extension |
| Note MS GPRS Present Request/ Response | GTP-C | When the HLR receives a message from a mobile with MDFG
set, it clears the MDFG and sends the Note MS Present message to all GGSN’s in the subscriber’s list. This message type contains subscriber IMSI, GSN Address and Private Extension |
Mobility Management Messages
| Message Type | Used By | Description |
| Identification
Request/Response |
GTP-C | Sent by the new SGSN to the old SGSN to request the IMSI for a MS when a GPRS Attach is done with a P-TMSI and the MS has changed SGSNs since the GPRS Detach was done. |
| SGSN context Request/ Response/ Acknowledge | GTP-C | Sent by the new SGSN to the old SGSN to request the MM and PDP Contexts for the MS. |
| Forward Relocation Request/
Response/ Complete/ Complete Acknowledge |
GTP-C | Indicates mobile activation/deactivation within a Routing Area. This prevents paging of a mobile that is not active (visited VLR rejects calls from the HLR or applies Call Forwarding). Note that the mobile station does not maintain an attach/detach state.
SRNS contexts contain for each concerned RAB the sequence numbers of the GTP-PDUs next to be transmitted in uplink and downlink directions. |
| Relocation Cancel Request/ Response | GTP-C | Send to cancel the relocation of a connection. |
| Forward SRNS Context/ Context Acknowledge | GTP-C | This procedure may be used to trigger the transfer of SRNS contexts from RNC to CN (PS domain) in case of inter system forward handover. |
| RAN Information Relay | GTP-C | Forward the Routing Area Network (RAN) information.
A Routing Area (RA) is a subset of a GSM Location Area (LA). A RA is served by only one SGSN. Ensures that regular radio contact is maintained by the mobile |
MBMS messages
| Message Type | Used By | Description |
| MBMS Notification Request/
Response/ Reject Request/ Reject Response |
GTP-C | Notification of the radio access devices. |
| Create MBMS Context Request/ Response | GTP-C | Request to create an active MBMS context. The context will be pending until the response is received.
Once active, the MBMS context allows the MS to receive data from a specific MBMS source |
| Message Type | Used By | Description |
| Update MBMS Context Request/ Response | GTP-C | |
| Delete MBMS Context Request/ Response | GTP-C | Request to deactivate the MBMS context. When the response is received, the MBMS context will be inactive. |
GTP-U and Charging Management Messages
| Message Type | Used By | Description |
| G-PDU | GTP-C, GTP-U | GPRS Packet data unit delivery message. |
| Node Alive Request/Response | GTP-C, GTP-U | Used to inform rest of network when a node starts service. |
| Redirection
Request/Response |
GTP-C, GTP-U | Used to divert the flow of CDRs from the CDFs to another CGF when the sender is being removed, or they are used when the CGF has lost its connection to a downstream system. |
| Data Record Transfer Request/Response | GTP-C, GTP-U | Used to reliably transport CDRs from the point of generation (SGSN/GGSN) to non-volatile storage in the CGF |