FortiCarrier Web Based Manager Settings

Advanced filtering options

The FortiOS Carrier firewall supports advanced filtering against the attributes RAT, RAI, ULI, APN restriction, and IMEI-SV in GTP to block specific harmful GPRS traffic and GPRS roaming traffic. The following table shows some of the GTP context requests and responses that the firewall supports.

Attributes supported by FortiCarrier firewalls

GTP Create PDP Context Request GTP Create PDP Context Response GTP Update PDP

GTP Update PDP Con-

Context text Request

Response

APN yes yes
APN

Restriction

yes yes
IMEI-SV yes
IMSI yes yes
RAI yes yes
RAT yes yes
ULI yes yes

When editing a GTP profile, select Advanced Filtering > Add to create and add a rule. When the rule matches traffic it will either allow or deny that traffic as selected in the rule.

Advanced Filtering
Enable Select to enable advanced filtering.
Default Action Select the default action for advanced filtering. If you select Allow, all sessions are allowed except those blocked by individual advanced filters. If you select Deny, all sessions are blocked except those allowed by individual advanced filters.
Messages The messages, for example, Create PDP Context Request.
APN Restriction The APN restriction.
RAT Type The RAT types associated with that filter.
ULI The ULI pattern.
RAI The RAI pattern.

 

IMEI The IMEI pattern.
Action The action that will be taken.
Edit Modifies the filter’s settings. When you select Edit, the Edit window appears, which allows you to modify the filter’s settings.
Delete Removes a filter from the list.
Add Adds a filter to the list. When you select Add, the New window appears, which allows you to configure settings for messages, APN, IMSI, MSISDN, RAT type, ULI, RAI, IMEI patterns as well as the type of action.
New Filtering page
Messages The PDP content messages this profile will match.
Create PDP

Context Request

Select to allow create PDP context requests.
Create PDP

Context Response

Select to allow create PDP context responses.
Update PDP

Context Request

Select to allow update PDP context requests.
Update PDP

Context Response

Select to allow update PDP context responses.
APN Enter the APN.
APN Mode Select an APN mode as one or more of

•  Mobile Station provied

•  Network provided

•  Subscription provied

This field is only available when an APN has been entered.

Mobile Station provided MS-provided PAN, subscription not verified, indicates that the mobile station (MS) provided the APN and that the HLR did not verify the user’s subscription to the network.
Network provided Network-provided APN, subscription not verified, indicates that the network provided a default APN because the MS did not specify one, and that the HLR did no verify the user’s subscription to the network.
Subscription verified MS or Network-provided APN, subscription verified, indicates that the MS or the network provided the APN and that the HLR verified the user’s subscription to the network.
APN Restriction Select the type of restriction that you want. You can choose all of the types, or one of the types. You cannot choose multiple types. Types include:

•  all

•  Public-1

•  Public-2

•  Private-1

•  Private-2

IMSI Enter the IMSI.
MSISDN Enter the MSISDN.
RAT Type Optionally select the RAT type as any combination of the following:

•  Any

•  UTRAN

•  GERAN

•  Wifi

•  GAN

•  HSPA

Some RAT types are GTPv1 specific.

ULI pattern Enter the ULI pattern.
RAI pattern Enter the RAI pattern.
IMEI pattern Enter the IMEI pattern.
Action Select either Allow or Deny.

Having trouble configuring your Fortinet hardware or have some questions you need answered? Check Out The Fortinet Guru Youtube Channel! Want someone else to deal with it for you? Get some consulting from Fortinet GURU!

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.