|
|
|
|
|
|
|
|
•
|
Select Stateful Inspection to inspect GTPv1-C traffic, GTPv2-C traffic, or both. When you enable stateful inspection, the firewall uses the source IP address, source port, destination IP address, destination port, protocol, and the Tunnel Endpoint IDs (TEIDs) to keep track of a GTP session. It also checks and validates the order of the different types of GTP messages that help establish a GTP tunnel. The TEID uniquely identifies the GSN tunnel endpoints. The tunnels for an uplink and a downlink are separate and use a different TEID.
|
|
•
|
Select the Action— Block or Alert—that the firewall takes upon a validity check failure. The alert action allows the traffic but generates a log; the block action denies the traffic and generates a log.
|
|
◦
|
Reserved IE—Checks for the GTPv1-C or GTPv2-C messages that use reserved IE values.
|
|
◦
|
Order of IE ( GTPv1-C only)—Checks that the order of IEs in GTPv1-C or GTPv2-C messages is accurate.
|
|
◦
|
Length of IE—Checks for the GTPv1-C or GTPv2-C messages with an invalid IE length.
|
|
◦
|
Spare Flag in Header—Checks for malformed packets that use invalid values or reserved values in a header.
|
|
|
|
|
•
|
Reserved IE—Checks for the GTP-U messages that use reserved IE values in the payload.
|
|
•
|
Order of IE—Checks that the order of the IEs in GTP-U messages is correct.
|
|
•
|
Spare flag in header—Checks for malformed packets that use invalid values or reserved values in a header.
|
|
•
|
End User IP Address Spoofing—Configure the firewall to block or alert when the source IP address in a GTP-U packet from the subscriber user equipment isn't the same as the IP address in the corresponding GTP-C message exchanged during tunnel setup.
|
|
•
|
GTP-in-GTP—You can configure the firewall to block or alert when it detects a GTP-in-GTP message. Upon detection, the firewall generates a GTP log with critical severity.
|
|
•
|
Log at GTP-U session start—Log the associated IP address and tunnel endpoint ID in the GTP logs at the beginning of a GTP-U session.
|
|
•
|
Log at GTP-U session end—Log the associated IP address and tunnel endpoint ID in the GTP logs at the conclusion of a GTP-U session.
|
|
•
|
For 5G, 4G, and 3G, enable GTP-U Content Inspection to inspect and apply policy to the user data payload within a GTP-U packet. Inspecting GTP-U content allows you to correlate IMSI and IMEI information learned from GTP-C messages with the IP traffic encapsulated in GTP-U packets.
|
|
|
|
For 5G, enable 5G-HTTP2 to enable inspection of 5G HTTP/2 control packets, which can contain subscriber IDs, equipment IDs, and network slice information. This allows you to correlate subscriber ID (IMSI), equipment ID (IMEI), and network slice ID information learned from HTTP/2 messages with the IP traffic encapsulated in GTP-U packets.
Enabling 5G-HTTP2 disables GTP-C for the profile.
|
|
|
For PFCP, enable Stateful Inspection to inspect PFCP traffic. When you enable stateful inspection for PFCP traffic, the firewall inspects the traffic between the MEC and the remote or central site to help prevent attacks such as Denial of Service (DoS) or spoofing.
|
•
|
Check Sequence Number—Confirms that the sequence number in the PFCP matches the sequence number in the PFCP request message.
|
|
|
|
|
|
|
|
|
|
•
|
Loose—(Default) When the firewall detects GTP-U inner traffic, it queries the source or destination address to find the correlated IMEI or IMSI information. If there are no results, the firewall forwards the traffic.
|
|
•
|
Strict—Drops the traffic if the GTP-U query returns no results.
|
|
|
|
|
•
|
Enable if the firewall will be deployed on the N3/S1U interface.
|
|
•
|
Disable If the firewall will be deployed on the SGi/N6 interface.
|
|
|
|
|
•
|
PFCP—Inspect Packet Forwarding Control Protocol (PFCP) traffic.
|
|
•
|
RADIUS—Inspect Remote Authentication Dial-In Service (RADIUS) traffic.
|
|
•
|
GTP—Inspect GTP traffic, including GTPv2-C and GTPv1-C.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
The IMSI Prefix combines the MCC and MNC and allows you to allow, block, or alert GTP traffic from a specific PLMN. By default all IMSI are allowed.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
•
|
Tunnel Management—These GTPv1-C messages are used to manage the GTP-U tunnels, which carry encapsulated IP packets and signaling messages between a given pair of network nodes like SGSN and GGSN. It includes messages such as Create PDP Context Request, Create PDP Context Response, Update PDP Context Request, Update PDP Context Response, Delete PDP Context Request, Delete PDP Context Response.
|
|
•
|
Path Management—These GTPv1-C messages are typically sent by the GSN or Radio Network Controller (RNC) to the other GSN or RNC to find out if the peer is alive. It includes messages such as Echo Request and Echo Response.
|
|
•
|
Others—These messages include location management, mobility management, RAN information management, and Multimedia Broadcast Multicast Service (MBMS) messages.
|
|
|
|
|
|
|
|
|
|
|
•
|
Tunnel Management—These GTPv2-C messages are used to manage the GTP-U tunnels, which carry encapsulated IP packets and signaling messages between a given pair of network nodes such as the SGW and PGW. It includes the following types of messages: Create Session Request, Create Session Response, Create Bearer Request, Create Bearer Response, Modify Bearer Request, Modify Bearer Response, Delete Session Request, and Delete Session Response.
|
|
•
|
Path Management—These GTPv2-C messages are typically sent by network nodes, such as from the SGW or PGW to the other PGW or SGW to find out if the peer is responsive. It includes messages such as Echo Request and Echo Response.
|
|
•
|
Others—These messages include mobility management and Non-3GPP access-related messages.
|
|
|
|
|
•
|
Path Management—These GTP-U messages are sent by a network node (such as eNodeB) to another network node (such as SGW) to find out if the peer is responsive. It includes messages such as Echo Request/Response.
|
|
•
|
G-PDU—G-PDU (GTP-U PDU) is used for carrying user data packets within the network nodes in the mobile core network; it consists of a GTP header plus a T-PDU.
|
|
|
|
|
|
|
Select N11 to selectively enable logging of allowed N11 messages. N11 messages help you with troubleshooting and provide deeper visibility into the HTTP/2 messages exchanged over an N11 interface for different procedures. This field is available only if you enabled 5G-HTTP2 on the 5G-C tab in the Mobile Network Protection profile.
|
|
|
|
•
|
Session Modification—These PFCP messages are sent if the session ID or PDR ID changes (for example, as a result of moving from a 4G to a 5G network. It includes messages such as PFCP Session Modification Request and PFCP Session Modification Response.
|
|
•
|
Session Deletion—These PFCP messages terminate the PFCP session, including releasing associated resources.
|
|