Cisco 500 Series, Configuration Manual

Page: 495 / 1140

25-31
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 25 Configuring Application Layer Protocol Inspection
GTP Inspection
Verifying and Monitoring FTP Inspection
FTP application inspection generates the following log messages:
•
An Audit record 302002 is generated for each file that is retrieved or uploaded.
• The FTP command is checked to see if it is RETR or STOR and the retrieve and store commands
are logged.
•
The username is obtained by looking up a table providing the IP address.
• The username, source IP address, destination IP address, NAT address, and the file operation are
logged.
•
Audit record 201005 is generated if the secondary dynamic channel preparation failed due to
memory shortage.
In conjunction with NAT, the FTP application inspection translates the IP address within the application
payload. This is described in detail in RFC 959.
GTP Inspection
This section describes the GTP inspection engine. This section includes the following topics:
•
GTP Inspection Overview, page 25-31
• Configuring a GTP Inspection Policy Map for Additional Inspection Control, page 25-32
•
Verifying and Monitoring GTP Inspection, page 25-36
Note
GTP inspection requires a special license. If you enter GTP-related commands on a security appliance
without the required license, the security appliance displays an error message.
GTP Inspection Overview
GPRS provides uninterrupted connectivity for mobile subscribers between GSM networks and corporate
networks or the Internet. The GGSN is the interface between the GPRS wireless data network and other
networks. The SGSN performs mobility, data session management, and data compression (See
Figure 25-3 ).