Protocol Anomaly prevention options
Use protocol anomaly detection options to detect or deny protocol anomalies according to GTP standards and tunnel state. Protocol anomaly attacks involve malformed or corrupt packets that typically fall outside of the protocol specifications. Packets cannot pass through if they fail the sanity check.
| Protocol Anomaly | |
| Invalid Reserved Field | GTP version 0 (GSM 09.60) headers specify a number of fields that are marked as ”Spare” and contain all ones (1). GTP packets that have different values in these fields are flagged as anomalies. GTP version 1 (GSM 29.060) makes better use of the header space and only has one, 1bit, reserved field. In the first octet of the GTP version1 header, bit 4 is set to zero. |
| Reserved IE | Both versions of GTP allow up to 255 different Information Elements (IE). However, a number of Information Elements values are undefined or reserved. Packets with reserved or undefined values will be filtered. |
| Miss Mandatory IE | GTP packets with missing mandatory Information Elements (IE) will not be passed to the GGSN. |
| Out of State Message | The GTP protocol requires a certain level of state to be kept by both the GGSN and SGSN. Some message types can only be sent when in a specific GTP state. Packets that do not make sense in the current state are filtered or rejected
Both versions of GTP allow up to 255 different message types. However, a number of message type values are undefined or reserved. Best practices dictate that packets with reserved or undefined values will be filtered. |
| Out of State IE | GTP Packets with out of order Information Elements are discarded. |
| Spoofed Source Address | The End User Address Information Element in the PDP Context Create & Response messages contain the address that the mobile station (MS) will use on the remote network. If the MS does not have an address, the SGSN will set the End User Address field to zero when sending the initial PDP Context Create message. The PDP Context Response packet from the GGSN will then contain an address to be assigned to the MS. In environments where static addresses are allowed, the MS will relay its address to the SGSN, which will include the address in the PDP Context Create Message. As the MS address is negotiated within the PDP Context creation handshake, any packets originating from the MS that contain a different source address are detected and dropped. |
Anti-Overbilling options
You can configure the FortiOS Carrier firewall to prevent overbilling subscribers for traffic over the. To enable anti-overbilling, you must configure both the Gn/Gp firewall and the Gi firewall.
Expand Anti-Overbilling in the GTP profile to reveal these settings.
Anti-Overbilling
| Gi Firewall IP Address | The IP address of the unit’s interface configured as a Gi gateway. |
| Port | The SG security port number. The default port number is port 21123. Change this number if your system uses a different SG port. |
| Interface | Select the unit interface configured as a Gi gateway. |
| Security Context ID | Enter the security context ID. This ID must match the ID entered on the server Gi firewall. The default security context ID is 696. |
Log options
All the GTP logs are treated as a subtype of the event logs. To enable GTP logging, you must:
l configure the GTP log settings in a GTP profile l enable GTP logging when you configure log and report settings.
Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!