General settings options
The following are mostly house keeping options that appear in the General Settings area of the GTP configuration page.
| General Settings section of the New GTP Profile |
| Sequence Number Enable to check that packets are not duplicated or out of order. GTP Validation packets contain a Sequence Number field.
This number tells the receiving GGSN the order of the packets it is receiving. Normally the GGSN compares this sequence number in the packets with its own sequence counter — if the two do not match, the packet is dropped. This sequence number validation can be off-loaded to the FortiOS Carrier freeing up resources on the GGSN. |
| Select Allow to enable GTP packets to be allowed to contain GTP packets, or a GTP tunnel inside another GTP tunnel.
GTP-in-GTP To block all GTP-in-GTP packets, select Deny. |
| Minimum Message Length Enter the shortest possible message length in bytes. Normally this is controlled by the protocol, and will vary for different message types. If a packet is smaller than this limit, it is discarded as it is likely malformed and a potential security risk.
The default minimum message length is 0 bytes. |
| General Settings section of the New GTP Profile |
| Enter the maximum allowed length of a GTP packet in bytes.
A GTP packet contains three headers and corresponding parts GTP, UDP, and IP. If a packet is larger than the maximum transmission unit (MTU) Maximum Message Length size, it is fragmented to be delivered in multiple packets. This is inefficient, resource intensive, and may cause problems with some applications. By default the maximum message length is 1452 bytes. |
| Tunnel Limit Enter the maximum number of tunnels allowed open at one time. For
additional GTP tunnels to be opened, existing tunnels must first be closed. This feature can help prevent a form of denial of service attack on your network. This attack involves opening more tunnels than the network can handle and consuming all the network resources doing so. By limiting the number of tunnels at any one time, this form of attack will be avoided. The tunnel limiting applies to the Handover Group, and Authorized SGSNs and GGSNs. |
| Enter the maximum number of seconds that a GTP tunnel is allowed to remain active. After the timeout the unit deletes GTP tunnels that have stopped processing data. A GTP tunnel may hang for various reasons. For example, during the GTP tunnel tear-down stage, the “delete pdap context
Tunnel Timeout response” message may get lost. By setting a timeout value, you can configure the FortiOS Carrier firewall to remove the hanging tunnels. The default is 86400 seconds, or 24 hours. |
| Control plane message rate Enter the number of packets per second to limit the traffic rate to protect
limit the GSNs from possible Denial of Service (DoS) attacks. The default limit of 0 does not limit the message rate. GTP DoS attacks can include: • Border gateway bandwidth saturation: A malicious operator can connect to your GRX and generate high traffic towards your Border Gateway to consume all the bandwidth. • GTP flood: A GSN can be flooded by illegitimate traffic |
| General Settings section of the New GTP Profile |
| Select the allowed list of IP addresses allowed to take over a GTP session when the mobile device moves locations.
Handover is a fundamental feature of GPRS/UMTS, which enables subscribers to seamlessly move from one area of coverage to another with no interruption of active sessions. Session hijacking can come from the SGSN or the GGSN, where a fraudulent GSN can intercept another GSN Handover Group and redirect traffic to it. This can be exploited to hijack GTP tunnels or cause a denial of service. When the handover group is defined it acts like a whitelist with an implicit default deny at the end — the GTP address must be in the group or the GTP message will be blocked. This stops handover requests from untrusted GSNs. |
| Authorized SGSNs Use Authorized SGSNs to only allow authorized SGSNs to send packets through the unit and to block unauthorized SGSNs. Go to Firewall Objects > Address > Addresses and add the IP addresses of the authorized SGSNs to a firewall address or address group. Then set Authorized SGSNs to this firewall address or address group.
You can use Authorized SGSNs to allow packets from SGSNs that have a roaming agreement with your organization. |
| Use Authorized GGSNs to only allow authorized GGSNs to send packets through the unit and to block unauthorized GGSNs. Go to Firewall Objects > Address > Addresses and add the IP addresses of the authorized GGSNs to a firewall address or address group. Then set
Authorized GGSNs Authorized GGSNs to this firewall address or address group. You can use Authorized GGSNs to allow packets from SGSNs that have a roaming agreement with your organization. |
Message type filtering options
On the New GTP Profile page, you can select to allow or deny the different types of GTP messages, which is referred to as message type filtering. You must expand the Message Type Filtering section to access the settings.
The messages types include Path Management, Tunnel Management, Location Management, Mobility Management, MBMS, and GTP-U and Charging Management messages.
For enhanced security, Fortinet best practices dictate that you set Unknown Message Action to deny. This will block all unknown GTP message types, some of which may be malicious.
To configure message type filter options, expand Message Type Filtering in the GTP profile.
APN filtering options
An Access Point Name (APN) is an Information Element (IE) included in the header of a GTP packet. It provides information on how to reach a network.
An APN has the following format:
<network_id>[.mnc<mnc_int>.mcc<mcc_int>.gprs] Where:
- <network_id> is a network identifier or name that identifies the name of a network, for example, com
or internet.
- [.mnc<mnc_int>.mcc<mcc_int>.gprs] is the optional operator identifier that uniquely identifies the operator’s PLMN, for example mcc456.gprs.
Combining these two examples results in a complete APN of internet.mnc123.mcc456.gprs.
By default, the unit permits all APNs. However, you can configure APN filtering to restrict roaming subscribers’ access to external networks.
APN filtering applies only to the GTP create pdp request messages. The unit inspects GTP packets for both APN and selected modes. If both parameters match and APN filter entry, the unit applies the filter to the traffic.
Additionally, the unit can filter GTP packets based on the combination of an IMSI prefix and an APN.
| APN Filtering | ||
| Enable APN Filter | Select to enable APN filtering. | |
| Default APN Action | Select the default action for APN filtering. If you select Allow, all sessions are allowed except those blocked by individual APN filters. If you select Deny, all sessions are blocked except those allowed by individual APN filters. | |
| Value | The APN to be filtered. | |
| Mode | The type of mode chosen that indicates where the APN originated and whether the Home Location Register (HLR) has verified the user subscription: | |
| Action | The type of action that will be taken. | |
| Edit | Modifies the settings within the filter. When you select Edit, the Edit window appears, which allows you to modify the settings of the APN. | |
| Delete | Removes the APN from the list within the table, in the APN Filtering section. | |
| Add APN | Adds a new APN filter to the list. When you select Add APN, the New window appears, which allows you to configure the APN settings. | |
| New APN page | ||
| Value | Enter an APN to be filtered. You can include wild cards to match multiple APNs. For example, the value internet* would match all APNs that being with internet. | |
| Mode | Select one or more of the available modes to indicate where the APN originated and whether the Home Location Register (HLR) has verified the user subscription. | |
| Mobile Station provided | MS-provided APN, subscription not verified, indicates that the mobile station (MS) provided the APN and that the HLR did not verify the user’s subscription to the network. | |
| Network provided | Network-provided APN, subscription not verified, indicates that the network provided a default APN because the MS did not specify one, and that the HLR did not verify the user’s subscription to the network. | |
| Subscription Verified | MS or Network-provided APN, subscription verified, indicates that the MS or the network provided the APN and that the HLR verified the user’s subscription to the network | |
| Action | Select Allow or Deny. | |