Cisco Systems GTP Inspection

13-3
Cisco ASA Series Firewall CLI Configuration Guide
Chapter13 Configuring Inspection for Management Application Protocols
GTP Inspection
The following example shows how to define a DCERPC inspection policy map with the timeout
configured for DCERPC pinholes.
ciscoasa(config)# policy-map type inspect dcerpc dcerpc_map
ciscoasa(config-pmap)# timeout pinhole 0:10:00
ciscoasa(config)# class-map dcerpc
ciscoasa(config-cmap)# match port tcp eq 135
ciscoasa(config)# policy-map global-policy
ciscoasa(config-pmap)# class dcerpc
ciscoasa(config-pmap-c)# inspect dcerpc dcerpc-map
ciscoasa(config)# service-policy global-policy global
GTP Inspection
This section describes the GTP inspection engine. This section includes the following topics:
•GTP Inspection Overview, page13-3
•Configuring a GTP Inspection Policy Map for Additional Inspection Control, page13-4
•Verifying and Monitoring GTP Inspection, page13-7
Note GTP inspection requires a special license. If you enter GTP-related commands on a ASA without the
required license, the ASA displays an error message.
GTP Inspection Overview
GPRS provides uninterrupted connectivity for mobile subscribers between GSM networks and corporate
networks or the Internet. The GGSN is the interface between the GPRS wireless data network and other
networks. The SGSN performs mobility, data session management, and data compression.
The UMTS is the commercial convergence of fixed-line telephony, mobile, Internet and computer
technology. UTRAN is the networking protocol used for implementing wireless networks in this system.
GTP allows multi-protocol packets to be tunneled through a UMTS/GPRS backbone between a GGSN,
an SGSN and the UTRAN.
GTP does not include any inherent security or encryption of user data, but using GTP with the ASA helps
protect your network against these risks.
The SGSN is logically connected to a GGSN using GTP. GTP allows multiprotocol packets to be
tunneled through the GPRS backbone between GSNs. GTP provides a tunnel control and management
protocol that allows the SGSN to provide GPRS network access for a mobile station by creating,
modifying, and deleting tunnels. GTP uses a tunneling mechanism to provide a service for carrying user
data packets.
Note When using GTP with failover, if a GTP connection is established and the active unit fails before data
is transmitted over the tunnel, the GTP data connection (with a “j” flag set) is not replicated to the
standby unit. This occurs because the active unit does not replicate embryonic connections to the standby
unit.