Cisco 6500 - Catalyst Series 10 Gigabit EN Interface Module Expansion, Configuration Manual, Page: 454 / 742

22-38
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
OL-20748-01
Chapter 22 Applying Application Layer Protocol Inspection
GTP Inspection
b.
Configure GTP inspection parameters. To do so, use the GTP map configuration mode commands
that you want to enforce. For a list of commands, see
Table 22-4 .
Step 5 Create a policy map or modify an existing policy map that you want to use to apply the GTP inspection
engine to GTP traffic. To do so, use the
policy-map command, as follows.
hostname(config-cmap)# policy-map policy_map_name
hostname(config-pmap)#
where policy_map_name is the name of the policy map. The CLI enters the policy map configuration
mode and the prompt changes accordingly.
Step 6 Specify the class map, created in Step 2 , that identifies the GTP traffic. Use the class command to do so,
as follows.
hostname(config-pmap)# class class_map_name
hostname(config-pmap-c)#
where class_map_name is the name of the class map you created in Step 2 . The CLI enters the policy
map class configuration mode and the prompt changes accordingly.
Step 7 Enable GTP application inspection. To do so, use the inspect gtp command, as follows:
hostname(config-pmap-c)# inspect gtp [ map_name ]
hostname(config-pmap-c)#
where map_name is the GTP map that you may have created in optional Step 4 .
Step 8 Use the service-policy command to apply the policy map globally or to a specific interface, as follows:
hostname(config-pmap-c)# service-policy policy_map_name [ global | interface interface_ID ]
hostname(config)#
where policy_map_name is the policy map you configured in Step 5 . If you want to apply the policy map
to traffic on all the interfaces, use the global option. If you want to apply the policy map to traffic on a
specific interface, use the interface interface_ID option, where interface_ID is the name assigned to the
interface with the nameif command.
The FWSM begins inspecting GTP traffic, as specified.
Example 22-6 shows how to use access lists to identify GTP traffic, define a GTP map, define a policy,
and apply the policy to the outside interface.
Example 22-6 Enabling and Configuring GTP Inspection
hostname(config)# access-list gtp_acl permit udp any any eq 3386
hostname(config)# access-list gtp_acl permit udp any any eq 2123
hostname(config)#
class-map gtp-traffic
hostname(config-cmap)# match access-list gtp_acl
hostname(config-cmap)# gtp-map sample_map
hostname(config-gtp-map)#
request-queue 300
hostname(config-gtp-map)# permit mcc 111 mnc 222
hostname(config-gtp-map)# message-length min 20 max 300
hostname(config-gtp-map)#
drop message 20
hostname(config-gtp-map)# tunnel-limit 10000
hostname(config)# policy-map sample_policy
hostname(config-pmap)#
class gtp-traffic
hostname(config-pmap-c)# inspect gtp sample_map
hostname(config)# service-policy sample_policy outside