Cisco PIX 500 Series Configuration Manual page 498

GTP Inspection
This command must be used to enable IMSI Prefix filtering. You can configure multiple instances
to specify permitted MCC and MNC combinations. By default, the security appliance does not check
the validity of MNC and MCC combinations, so you must verify the validity of the combinations
configured. To find more information about MCC and MNC codes, see the ITU E.212
recommendation, Identification Plan for Land Mobile Stations.
To allow invalid GTP packets or packets that otherwise would fail parsing and be dropped, enter the
b.
following command:
hostname(config-pmap-p)# permit errors
By default, all invalid packets or packets that failed, during parsing, are dropped.
c. To enable support for GSN pooling, use the permit response command.
If the security appliance performs GTP inspection, by default the security appliance drops GTP
responses from GSNs that were not specified in the GTP request. This situation occurs when you
use load-balancing among a pool of GSNs to provide efficiency and scalability of GPRS.
You can enable support for GSN pooling by using the permit response command. This command
configures the security appliance to allow responses from any of a designated set of GSNs,
regardless of the GSN to which a GTP request was sent. You identify the pool of load-balancing
GSNs as a network object. Likewise, you identify the SGSN as a network object. If the GSN
responding belongs to the same object group as the GSN that the GTP request was sent to and if the
SGSN is in a object group that the responding GSN is permitted to send a GTP response to, the
security appliance permits the response.
To create an object to represent the pool of load-balancing GSNs, perform the following steps:
d.
Use the object-group command to define a new network object group representing the pool of
load-balancing GSNs.
hostname(config)# object-group network GSN-pool-name
hostname(config-network)#
For example, the following command creates an object group named gsnpool32:
hostname(config)# object-group network gsnpool32
hostname(config-network)#
Use the network-object command to specify the load-balancing GSNs. You can do so with one
e.
network-object command per GSN, using the host keyword. You can also using network-object
command to identify whole networks containing GSNs that perform load balancing.
hostname(config-network)# network-object host IP-address
For example, the following commands create three network objects representing individual hosts:
hostname(config-network)# network-object host 192.168.100.1
hostname(config-network)# network-object host 192.168.100.2
hostname(config-network)# network-object host 192.168.100.3
hostname(config-network)#
To create an object to represent the SGSN that the load-balancing GSNs are permitted to respond to,
f.
perform the following steps:
Cisco Security Appliance Command Line Configuration Guide
25-34
Use the object-group command to define a new network object group that will represent the
a.
SGSN that sends GTP requests to the GSN pool.
hostname(config)# object-group network SGSN-name
hostname(config-network)#
For example, the following command creates an object group named sgsn32:
Chapter 25 Configuring Application Layer Protocol Inspection
OL-12172-03