Create a GTP inspection policy map: policy-map type inspect gtp policy_map_name

(Optional) Add a description to the policy map: description string

To apply actions to matching traffic, perform the following steps.

1. Specify the traffic on which you want to perform actions using one of the following match commands. If you use a match not command, then any traffic that does not match the criterion in the match not command has the action applied.

   • match [not] apn regex {regex_name | class class_name}—Matches the access point name (APN) against the specified regular expression or regular expression class.

   • match [not] message {v1 | v2} id {message_id | range message_id_1 message_id_2} —Matches the message ID, which can be 1 to 255. You can specify a single ID or a range of IDs. You must specify whether the message is for GTPv0/1 (v1 ) or GTPv2 (v2 ).

   • match [not] message length min bytes max bytes—Matches messages where the length of the UDP payload (GTP header plus the rest of the message) is between the minimum and maximum values, from 1 to 65536.

   • match [not] msisdn regex {regex_name | class class_name} —Matches the Mobile Station International Subscriber Directory Number (MSISDN) information element in the Create PDP Context request, Create session request, and Modify Bearer Response messages against the specified regular expression or regular expression class. The regular expression can identify a specific MSISDN, or a range of MSISDNs based on the first x number of digits. MSISDN filtering is supported for GTPv1 and GTPv2 only.

   • match [not] selection-mode mode_value —Matches the Selection Mode information element in the Create PDP Context request. The selection mode specifies the origin of the Access Point Name (APN) in the message, and can be one of the following. Selection Mode filtering is supported for GTPv1 and GTPv2 only.

     • 0—Verified. The APN was provided by the mobile station or network, and the subscription is verified.

     • 1—Mobile Station. The APN was provided by the mobile station, and the subscription is not verified.

     • 2—Network. The APN was provided by the network, and the subscription is not verified.

     • 3—Reserved, not used.

   • match [not] version {version_id | range version_id_1 version_id_2}—Matches the GTP version, which can be 0 to 255. You can specify a single version or a range of versions.

2. Specify the action you want to perform on the matching traffic by entering one of the following commands:

   • drop [log] —Drop all packets that match. Add the log keyword to also send a system log message.

   • rate-limit message_rate —Limit the rate of messages. This option is available with message id only.

   You can specify multiple match commands in the policy map. For information about the order of match commands, see How Multiple Traffic Classes are Handled.

To configure parameters that affect the inspection engine, perform the following steps:

1. Enter parameters configuration mode:

   
   hostname(config-pmap)# parameters
   hostname(config-pmap-p)#
   
   

2. Set one or more parameters. You can set the following options; use the no form of the command to disable the option:

   • anti-replay [window_size] —Enable anti-replay by specifying a sliding window for GTP-U messages. The size of the sliding window is in number of messages and can be 128, 256, 512, or 1024. If you do not specify a size, you get the default, 512. As valid messages appear, the window moves to the new sequence numbers. Sequence numbers are in the range 0-65535, wrapping when they reach the maximum, and they are unique per PDP context. Messages are considered valid if their sequence numbers are within the window. Anti-replay helps prevent session hijacking or DoS attacks, which can occur when a hacker captures GTP data packets and replays them.

   • permit errors—Allows invalid GTP packets or packets that otherwise would fail parsing and be dropped.

   • request-queue max_requests—Sets the maximum number of GTP requests that will be queued waiting for a response. The default is 200. When the limit has been reached and a new request arrives, the request that has been in the queue for the longest time is removed. The Error Indication, the Version Not Supported and the SGSN Context Acknowledge messages are not considered as requests and do not enter the request queue to wait for a response.

   • tunnel-limit max_tunnels—Sets the maximum number of active GTP tunnels allowed. This is equivalent to the number of PDP contexts or endpoints. The default is 500. New requests will be dropped once the number of tunnels specified by this command is reached.

   • timeout {endpoint | pdp-context | request | signaling | t3-response | tunnel} time —Sets the idle timeout for the specified service (in hh:mm:ss format). To have no timeout, specify 0 for the number. Enter the command separately for each timeout.

     • endpoint —The maximum period of inactivity before a GTP endpoint is removed.

     • pdp-context —The maximum period of inactivity before removing the PDP Context for a GTP session. In GTPv2, this is the bearer context.

     • request —The maximum period of inactivity after which a request is removed from the request queue. Any subsequent responses to a dropped request will also be dropped.

     • signaling —The maximum period of inactivity before GTP signaling is removed.

     • t3-response —The maximum wait time for a response before removing the connection.

     • tunnel —The maximum period of inactivity for the GTP tunnel before it is torn down.

While still in parameter configuration mode, configure GTP-U checking for IP packets and anti-spoofing.

While still in parameter configuration mode, configure IMSI prefix filtering, if desired:

While still in parameter configuration mode, configure GSN or PGW pooling, if desired.

hostname(config)# object-group network gsnpool32
hostname(config-network)# network-object 192.168.100.0 255.255.255.0
hostname(config)# object-group network sgsn32
hostname(config-network)# network-object host 192.168.50.100

hostname(config)# policy-map type inspect gtp gtp-policy
hostname(config-pmap)# parameters
hostname(config-pmap-p)# permit-response to-object-group sgsn32 
from-object-group gsnpool32

Create an SCTP inspection policy map: policy-map type inspect sctp policy_map_name

(Optional) Add a description to the policy map: description string

Drop, rate limit, or log traffic based on the PPID in SCTP data chunks.

1. Identify the traffic based on the PPID.

   match [not] ppid ppid_1 [ppid_2]

   Where ppid_1 is the PPID number (0-4294967295) or name (see the CLI help for the available names). You can include a second (higher) PPID, ppid_2 , to specify a range of PPIDs. Use match not ppid to identify traffic that does not match the PPID or range.

   You can find the current list of SCTP PPIDs at http://www.iana.org/assignments/sctp-parameters/sctp-parameters.xhtml#sctp-parameters-25.

2. Specify the action to perform on matching packets.

   • drop —Drop and log all packets that match.

   • log —Send a system log message.

   • rate-limit rate —Limit the rate of messages. The rate is in kilobits per second (kbps).

3. Repeat the process until you identify all PPIDs you want to selectively handle.

(Optional) Create a Diameter inspection class map by performing the following steps.

1. Create the class map: class-map type inspect diameter [match-all | match-any] class_map_name

   Where class_map_name is the name of the class map. The match-all keyword is the default, and specifies that traffic must match all criteria to match the class map. The match-any keyword specifies that the traffic matches the class map if it matches at least one match statement. The CLI enters class-map configuration mode, where you can enter one or more match commands.

2. (Optional) Add a description to the class map: description string

   Where string is the description of the class map (up to 200 characters).

3. Specify the traffic on which you want to perform actions using one of the following match commands. If you use a match not command, then any traffic that does not match the criterion in the match not command has the action applied.

   • match [not] application-id app_id [app_id_2] —Matches the application identifier, where app_id is the Diameter application name or number (0-4294967295). If there is a range of consecutively-numbered applications that you want to match, you can include a second ID. You can define the range by application name or number, and it applies to all the numbers between the first and second IDs.

     These applications are registered with the IANA. Following are the core supported applications, but you can filter on other applications. Use the CLI help for a list of application names.

     • 3gpp-rx-ts29214 (16777236)

     • 3gpp-s6a (16777251)

     • 3gpp-s9 (16777267)

     • common-message (0). This is the base Diameter protocol.

   • match [not] command-code code [code_2] —Matches the command code, where code is the Diameter command code name or number (0-4294967295). If there is a range of consecutively-numbered command codes that you want to match, you can include a second code. You can define the range by command code name or number, and it applies to all the numbers between the first and second codes.

     For example, the following command matches the Capability Exchange Request/Answer command code:

     
     match command-code cer-cea 
     
     

   • Match the attribute-value pair (AVP).

     To match AVP by attribute only:

     match [not] avp code [code_2] [vendor-id id_number]

     To match an AVP based on the value of the attribute:

     match [not] avp code [vendor-id id_number] value

     Where:

     • code —The name or number (1-4294967295) of an attribute-value pair. For the first code, you can specify the name of a custom AVP or one that is registered in RFCs or 3GPP technical specifications and is directly supported in the software. If you want to match a range of AVP, specify the second code by number only. If you want to match an AVP by its value, you cannot specify a second code. See the CLI help for a list of AVP names.

     • vendor-id id_number —(Optional.) The ID number of the vendor to also match, from 0-4294967295. For example, the 3GPP vendor ID is 10415, the IETF is 0.

     • value —The value portion of the AVP. You can configure this only if the data type of the AVP is supported. For example, you can specify an IP address for AVP that have the address data type. Following are the specific syntax of the value option for the supported data types:

       • Diameter Identity, Diameter URI, Octet String—Use regular expression or regular expression class objects to match these data types.

         {regex regex_name | class regex_class}

       • Address—Specify the IPv4 or IPv6 address to match. For example, 10.100.10.10 or 2001:DB8::0DB8:800:200C:417A.

       • Time—Specify the start and end dates and time. Both are required. Time is in 24-hour format.

         date year month day time hh:mm:ss date year month day time hh:mm:ss

         For example:

         
         date 2015 feb 5 time 12:00:00 date 2015 mar 9 time 12:00:00
         
         

       • Numeric—Specify a range of numbers:

         range number_1 number_2

         The valid number range depends on the data type:

         • Integer32: -2147483647 to 2147483647

         • Integer64: -9223372036854775807 to 9223372036854775807

         • Unsigned32: 0 to 4294967295

         • Unsigned64: 0 to 18446744073709551615

         • Float32: decimal point representation with 8 digit precision

         • Float64: decimal point representation with 16 digit precision

4. Enter exit to leave class map configuration mode.

Create a Diameter inspection policy map: policy-map type inspect diameter policy_map_name

(Optional) Add a description to the policy map: description string

To apply actions to matching traffic, perform the following steps.

1. Specify the traffic on which you want to perform actions using one of the following methods:

   • If you created a Diameter class map, specify it by entering the following command: class class_map_name

   • Specify traffic directly in the policy map using one of the match commands described for Diameter class maps.

2. Specify the action you want to perform on the matching traffic by entering one of the following commands:

   • drop —Drop all packets that match.

   • drop-connection —Drop the packet and close the connection.

   • log —Send a system log message.

   You can specify multiple class or match commands in the policy map. For information about the order of class and match commands, see How Multiple Traffic Classes are Handled.

   Example:

   
   hostname(config)# policy-map type inspect diameter diameter-map
   hostname(config-pmap)# class diameter-class-map
   hostname(config-pmap-c)# drop
   hostname(config-pmap-c)# match command-code cer-cea
   hostname(config-pmap-c)# log
   
   

To configure parameters that affect the inspection engine, perform the following steps:

1. Enter parameters configuration mode.

   
   hostname(config-pmap)# parameters
   hostname(config-pmap-p)#
   
   

2. Set one or more parameters. You can set the following options; use the no form of the command to disable the option.

   • unsupported {application-id | command-code | avp} action log —Enables logging for unsupported Diameter elements. These options specify application IDs, command codes, and AVP that are not directly supported by the software. The default is to allow the elements without logging them. You can enter the command three times to enable logging for all elements.

   • strict-diameter {state | session} —Enables strict Diameter protocol conformance to RFC 6733. By default, inspection ensures that Diameter frames comply with the RFC. You can add state machine validation or session -related message validation, or both by entering the command twice.

   Example:

   
   hostname(config-pmap)# parameters
   hostname(config-pmap-p)# unsupported application-id action log
   hostname(config-pmap-p)# unsupported command-code action log
   hostname(config-pmap-p)# unsupported avp action log
   hostname(config-pmap-p)# strict-diameter state
   hostname(config-pmap-p)# strict-diameter session
   
   

Create a custom Diameter AVP.

Create an M3UA inspection policy map: policy-map type inspect m3ua policy_map_name

(Optional) Add a description to the policy map: description string

To apply actions to matching traffic, perform the following steps.

1. Specify the traffic on which you want to perform actions using one of the following match commands. If you use a match not command, then any traffic that does not match the criterion in the match not command has the action applied.

   • match [not] message class class_id [id message_id] —Matches the M3UA message class and type. The following table lists the possible values. Consult M3UA RFCs and documentation for detailed information about these messages.

     M3UA Message Class	Message ID Type
     0 (Management Messages)	0-1
     1 (Transfer Messages)	1
     2 (SS7 Signaling Network Management Messages)	1-6
     3 (ASP State Maintenance Messages)	1-6
     4 (ASP Traffic Maintenance Messages)	1-4
     9 (Routing Key Management Messages)	1-4

   • match [not] opc code —Matches the originating point code in the data message, that is, the traffic source. Point code is in zone-region-sp format, where the possible values for each element depend on the SS7 variant:

     • ITU —Point codes are 14 bit in 3-8-3 format. The value ranges are [0-7]-[0-255]-[0-7].

     • ANSI —Point codes are 24 bit in 8-8-8 format. The value ranges are [0-255]-[0-255]-[0-255].

     • Japan —Point codes are 16 bit in 5-4-7 format. The value ranges are [0-31]-[0-15]-[0-127].

     • China —Point codes are 24 bit in 8-8-8 format. The value ranges are [0-255]-[0-255]-[0-255].

   • match [not] dpc code —Matches the destination point code in the data message. Point code is in zone-region-sp format, as explained for match opc .

   • match [not] service-indicator number —Matches the service indicator number, 0-15. Following are the available service indicators. Consult M3UA RFCs and documentation for detailed information about these service indicators.

     • 0—Signaling Network Management Messages

     • 1—Signaling Network Testing and Maintenance Messages

     • 2—Signaling Network Testing and Maintenance Special Messages

     • 3—SCCP

     • 4—Telephone User Part

     • 5—ISDN User Part

     • 6—Data User Part (call and circuit-related messages)

     • 7—Data User Part (facility registration and cancellation messages)

     • 8—Reserved for MTP Testing User Part

     • 9—Broadband ISDN User Part

     • 10—Satellite ISDN User Part

     • 11—Reserved

     • 12—AAL type 2 Signaling

     • 13—Bearer Independent Call Control

     • 14—Gateway Control Protocol

     • 15—Reserved

2. Specify the action you want to perform on the matching traffic by entering one of the following commands:

   • drop [log] —Drop all packets that match. Optionally, send a system log message.

   • rate-limit message_rate —Limit the rate of messages. This option is available with match message class only.

   You can specify multiple match commands in the policy map. For information about the order of match commands, see How Multiple Traffic Classes are Handled.

To configure parameters that affect the inspection engine, perform the following steps:

1. Enter parameters configuration mode:

   
   hostname(config-pmap)# parameters
   hostname(config-pmap-p)#
   
   

2. Set one or more parameters. You can set the following options; use the no form of the command to disable the option:

   • message-tag-validation {dupu | error | notify} —Ensures that the content of certain fields are checked and validated for the specified message type. Messages that fail validation are dropped. Validation differs by message type.

     • Destination User Part Unavailable (DUPU)—The User/Cause field must be present, and it must contain only valid cause and user codes.

     • Error—All mandatory fields must be present and contain only allowed values. Each error message must contain the required fields for that error code.

     • Notify—The status type and status information fields must contain allowed values only.

   • ss7 variant {ITU | ANSI | JAPAN | CHINA} —Identifies the variant of SS7 used in your network. This option determines the valid format for point codes. After you configure the option and deploy an M3UA policy, you cannot change it unless you first remove the policy. The default variant is ITU.

   • strict-asp-state —Performs application server process (ASP) state validation. The system maintains the ASP states of M3UA sessions and allows or drops ASP messages based on the validation result. If you do not enable strict ASP state validation, all ASP messages are forwarded uninspected. Strict ASP state checking is required if you want stateful failover or if you want to operate within a cluster. However, strict ASP state checking works in Override mode only, it does not work if you are running in Loadsharing or Broadcast mode (per RFC 4666). The inspection assumes there is one and only one ASP per endpoint.

   • timeout endpoint time —Sets the idle timeout to remove statistics for an M3UA endpoint, in hh:mm:ss format. To have no timeout, specify 0. The default is 30 minutes (00:30:00).

   • timeout session time —Sets the idle timeout to remove an M3UA session if you enable strict ASP state validation, in hh:mm:ss format. To have no timeout, specify 0. The default is 30 minutes (00:30:00). Disabling this timeout can prevent the system from removing stale sessions.

If necessary, create an L3/L4 class map to identify the traffic for which you want to apply the inspection.

class-map name
   match parameter

hostname(config)# class-map mobile_class_map
hostname(config-cmap)# match access-list mobile

Add or edit a policy map that sets the actions to take with the class map traffic: policy-map name

hostname(config)# policy-map global_policy

Identify the L3/L4 class map you are using for the inspection: class name

hostname(config-pmap)# class inspection_default

Enable the inspections.

hostname(config-class)# inspect gtp
hostname(config-class)# inspect sctp
hostname(config-class)# inspect diameter
hostname(config-class)# inspect m3ua

hostname(config-class)# no inspect gtp
hostname(config-class)# inspect gtp gtp-map

If you are editing an existing service policy (such as the default global policy called global_policy), you are done. Otherwise, activate the policy map on one or more interfaces.

hostname(config)# service-policy global_policy global

Configure a RADIUS Accounting Inspection Policy Map.

Configure the RADIUS Accounting Inspection Service Policy.