GPRS tunneling protocol, user plane (GTP-U)

GTP-U carries user data between the radio access network and the GPRS core network. The transported user data can be an IPv4 or IPv6 packet type. GTP firewall performs security checks on the GTP-U packets, including packet sanity checking, stateful inspection, sequence checking, and end-user address checking of GTP-U packets.

At the [edit security gprs gtp profile] hierarchy level:

• u-tunnel-validated -- When enabled, GTP-PDU packets must match one of the existing GTP-U tunnels; otherwise the packet is dropped.
• seq-number-validated --When enabled, GTP-PDU packets must match one of the existing GTP-U tunnels and its sequence number is checked. The packet is dropped if there is a tunnel mismatch or an incorrect sequence number. GTP-PDU without a sequence number will pass without a sequence check.
• end-user-address-validated -- When enabled , GTP-PDU packets must match one of the existing GTP-U tunnels and the end-user address (only an IPv4 user address is supported) is checked. The packet is dropped if there is a tunnel mismatch or an IPV4 end user address mismatch.
• log gtp-u -- When enabled, GTP-U inspection log is generated. If log gtp-u is set to all, then every GTP-U packet will generate a system log message. If log gtp-u is set to dropped, then only dropped GTP-U packets will generate a system log message. GTP-U packet inspection includes these four CLI configuration statements and the existing set security gprs gtp profile gtp-in-gtp-denied configuration statement. Use the show security gprs gtp tunnels detail CLI statement to display details of each GTP tunnel