Cisco FirePOWER ASA 5500 series Configuration Manual page 451

Chapter 25 Configuring Application Layer Protocol Inspection
Where the message_id is an alphanumeric identifier between 1 and 255. The lower_range is lower range
of message IDs. The upper_range is the upper range of message IDs.
To match a message length, enter the following command:
Step 5
hostname(config-pmap)# match [not] message length min min_length max max_length
Where the min_length and max_length are both between 1 and 65536. The length specified by this
command is the sum of the GTP header and the rest of the message, which is the payload of the UDP
packet.
To match the version, enter the following command:
Step 6
hostname(config-pmap)# match [not] version [version_id | range lower_range upper_range]
Where the version_id is between 0and 255. The lower_range is lower range of versions. The
upper_range is the upper range of versions.
To configure parameters that affect the inspection engine, perform the following steps:
Step 7
To enter parameters configuration mode, enter the following command:
a.
hostname(config-pmap)# parameters
hostname(config-pmap-p)#
The mnc network_code argument is a two or three-digit value identifying the network code.
By default, the security appliance does not check for valid MCC/MNC combinations. This command
is used for IMSI Prefix filtering. The MCC and MNC in the IMSI of the received packet is compared
with the MCC/MNC configured with this command and is dropped if it does not match.
This command must be used to enable IMSI Prefix filtering. You can configure multiple instances
to specify permitted MCC and MNC combinations. By default, the security appliance does not check
the validity of MNC and MCC combinations, so you must verify the validity of the combinations
configured. To find more information about MCC and MNC codes, see the ITU E.212
recommendation, Identification Plan for Land Mobile Stations.
b. To allow invalid GTP packets or packets that otherwise would fail parsing and be dropped, enter the
following command:
hostname(config-pmap-p)# permit errors
By default, all invalid packets or packets that failed, during parsing, are dropped.
c. To enable support for GSN pooling, use the permit response command.
If the security appliance performs GTP inspection, by default the security appliance drops GTP
responses from GSNs that were not specified in the GTP request. This situation occurs when you
use load-balancing among a pool of GSNs to provide efficiency and scalability of GPRS.
You can enable support for GSN pooling by using the permit response command. This command
configures the security appliance to allow responses from any of a designated set of GSNs,
regardless of the GSN to which a GTP request was sent. You identify the pool of load-balancing
GSNs as a network object. Likewise, you identify the SGSN as a network object. If the GSN
responding belongs to the same object group as the GSN that the GTP request was sent to and if the
SGSN is in a object group that the responding GSN is permitted to send a GTP response to, the
security appliance permits the response.
To create an object to represent the pool of load-balancing GSNs, perform the following steps:
d.
Use the object-group command to define a new network object group representing the pool of
load-balancing GSNs.
hostname(config)# object-group network GSN-pool-name
hostname(config-network)#
OL-10088-01
Cisco Security Appliance Command Line Configuration Guide
GTP Inspection
25-33