General Settings section of the New GTP Profile

GTP–in–GTP

Select Allow to enable GTP packets to be allowed to contain GTP pack- ets, or a GTP tunnel inside another GTP tunnel.

To block all GTP-in-GTP packets, select Deny.

Minimum Message Length      Enter the shortest possible message length in bytes. Normally this is con- trolled by the protocol, and will vary for different message types. If a packet is smaller than this limit, it is discarded as it is likely malformed and a poten- tial security risk.

The default minimum message length is 0 bytes.

Enter the maximum allowed length of a GTP packet in bytes.

 

Maximum Message Length

A GTP packet contains three headers and corresponding parts GTP, UDP, and IP. If a packet is larger than the maximum transmission unit (MTU) size, it is fragmented to be delivered in multiple packets. This is inefficient, resource intensive, and may cause problems with some applications.

By default the maximum message length is 1452 bytes.

Tunnel Limit                              Enter the maximum number of tunnels allowed open at one time. For addi- tional GTP tunnels to be opened, existing tunnels must first be closed.

This feature can help prevent a form of denial of service attack on your net- work. This attack involves opening more tunnels than the network can handle and consuming all the network resources doing so. By limiting the number of tunnels at any one time, this form of attack will be avoided.

The tunnel limiting applies to the Handover Group, and Authorized SGSNs and GGSNs.

Tunnel Timeout

Enter the maximum number of seconds that a GTP tunnel is allowed to remain active. After the timeout the unit deletes GTP tunnels that have stopped processing data. A GTP tunnel may hang for various reasons. For example, during the GTP tunnel tear-down stage, the “delete pdap context response” message may get lost. By setting a timeout value, you can con- figure the FortiOS Carrier firewall to remove the hanging tunnels.

The default is 86400 seconds, or 24 hours.

 

General Settings section of the New GTP Profile

Control plane message rate limit

Enter the number of packets per second to limit the traffic rate to protect the GSNs from possible Denial of Service (DoS) attacks. The default limit of 0 does not limit the message rate.

GTP DoS attacks can include:

• Border gateway bandwidth saturation: A malicious operator can con- nect to your GRX and generate high traffic towards your Border Gateway to consume all the bandwidth.

• GTP flood: A GSN can be flooded by illegitimate traffic

Select the allowed list of IP addresses allowed to take over a GTP session when the mobile device moves locations.

 

Handover Group

Handover is a fundamental feature of GPRS/UMTS, which enables sub- scribers to seamlessly move from one area of coverage to another with no interruption of active sessions. Session hijacking can come from the SGSN or the GGSN, where a fraudulent GSN can intercept another GSN and redir- ect traffic to it. This can be exploited to hijack GTP tunnels or cause a denial of service.

When the handover group is defined it acts like a whitelist with an implicit default deny at the end — the GTP address must be in the group or the GTP message will be blocked. This stops handover requests from untrus- ted GSNs.

Authorized SGSNs                    Use Authorized SGSNs to only allow authorized SGSNs to send packets through the unit and to block unauthorized SGSNs. Go to Firewall

Objects > Address > Addresses and add the IP addresses of the author- ized SGSNs to a firewall address or address group. Then set Authorized SGSNs to this firewall address or address group.

You can use Authorized SGSNs to allow packets from SGSNs that have a roaming agreement with your organization.

 

Authorized GGSNs

Use Authorized GGSNs to only allow authorized GGSNs to send packets through the unit and to block unauthorized GGSNs. Go to Firewall

Objects > Address > Addresses and add the IP addresses of the author- ized GGSNs to a firewall address or address group. Then set Authorized GGSNs to this firewall address or address group.

You can use Authorized GGSNs to allow packets from SGSNs that have a roaming agreement with your organization.

 

Message type filtering options

On the New GTP Profile page, you can select to allow or deny the different types of GTP messages, which is referred to as message type filtering. You must expand the Message Type Filtering section to access the settings.

The messages types include Path Management, Tunnel Management, Location Management, Mobility Management, MBMS, and GTP-U and Charging Management messages.

For enhanced security, Fortinet best practices dictate that you set Unknown Message Action to deny. This will block all unknown GTP message types, some of which may be malicious.

To configure message type filter options, expand Message Type Filtering in the GTP profile.