Filter
Top Products
13-6
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 13 Configuring Inspection for Management Application Protocols
GTP Inspection
a. Use the object-group command to define a new network object group that will represent the
SGSN that sends GTP requests to the GSN pool.
ciscoasa(config)# object-group network SGSN-name
ciscoasa(config-network)#
For example, the following command creates an object group named sgsn32:
ciscoasa(config)# object-group network sgsn32
ciscoasa(config-network)#
b. Use the network-object command with the host keyword to identify the SGSN.
ciscoasa(config-network)# network-object host IP-address
For example, the following command creates a network objects representing the SGSN:
ciscoasa(config-network)# network-object host 192.168.50.100
ciscoasa(config-network)#
g. To allow GTP responses from any GSN in the network object representing the GSN pool, defined in
c., d, to the network object representing the SGSN, defined in c., f., enter the following commands:
ciscoasa(config)# gtp-map map_name
ciscoasa(config-gtp-map)# permit response to-object-group SGSN-name from-object-group
GSN-pool-name
For example, the following command permits GTP responses from any host in the object group
named gsnpool32 to the host in the object group named sgsn32:
ciscoasa(config-gtp-map)# permit response to-object-group sgsn32 from-object-group
gsnpool32
The following example shows how to support GSN pooling by defining network objects for the GSN
pool and the SGSN. An entire Class C network is defined as the GSN pool but you can identify
multiple individual IP addresses, one per network-object command, instead of identifying whole
networks. The example then modifies a GTP map to permit responses from the GSN pool to the
SGSN.
ciscoasa(config)# object-group network gsnpool32
ciscoasa(config-network)# network-object 192.168.100.0 255.255.255.0
ciscoasa(config)# object-group network sgsn32
ciscoasa(config-network)# network-object host 192.168.50.100
ciscoasa(config)# gtp-map gtp-policy
ciscoasa(config-gtp-map)# permit response to-object-group sgsn32 from-object-group
gsnpool32
h. To specify the maximum number of GTP requests that will be queued waiting for a response, enter
the following command:
ciscoasa(config-gtp-map)# request-queue max_requests
where the max_requests argument sets the maximum number of GTP requests that will be queued
waiting for a response, from 1 to 4294967295. The default is 200.
When the limit has been reached and a new request arrives, the request that has been in the queue
for the longest time is removed. The Error Indication, the Version Not Supported and the SGSN
Context Acknowledge messages are not considered as requests and do not enter the request queue
to wait for a response.
i. To change the inactivity timers for a GTP session, enter the following command:
ciscoasa(config-gtp-map)# timeout {gsn | pdp-context | request | signaling | tunnel}
hh:mm:ss