Cisco ASA 5508-X, Configuration Manual

Page: 365 / 428

15-9
Cisco ASA Series Firewall CLI Configuration Guide
Chapter 15 Inspection of Database, Directory, and Management Protocols
GTP Inspection
To configure GSN pooling and thus support load balancing, create a network object group that specifies
the GSNs and specify this on the
from-object-group parameter. Likewise, create a network object group
for the SGSN and select it as on the to-object-group parameter. If the GSN responding belongs to the
same object group as the GSN that the GTP request was sent to and if the SGSN is in an object group
that the responding GSN is permitted to send a GTP response to, the ASA permits the response.
The network object group can identify the GSN or SGSN by host address or by the subnet that contains
them.
Example
The following example shows how to support GSN pooling by defining network objects for the GSN
pool and the SGSN. An entire Class C network is defined as the GSN pool but you can identify multiple
individual IP addresses, one per
network-object command, instead of identifying whole networks. The
example then modifies a GTP inspection map to permit responses from the GSN pool to the SGSN.
hostname(config)# object-group network gsnpool32
hostname(config-network)# network-object 192.168.100.0 255.255.255.0
hostname(config)# object-group network sgsn32
hostname(config-network)# network-object host 192.168.50.100
hostname(config)# policy-map type inspect gtp gtp-policy
hostname(config)# gtp-map gtp-policy
hostname(config-pmap)# parameters
hostname(config-pmap-p)# permit response to-object-group sgsn32
from-object-group gsnpool32
Example
The following example shows how to limit the number of tunnels in the network:
hostname(config)# policy-map type inspect gtp gmap
hostname(config-pmap)# parameters
hostname(config-pmap-p)# tunnel-limit 3000
hostname(config)# policy-map global_policy
hostname(config-pmap)# class inspection_default
hostname(config-pmap-c)# inspect gtp gmap
hostname(config)# service-policy global_policy global
Configure the GTP Inspection Service Policy
GTP inspection is not enabled in the default inspection policy, so you must enable it if you need this
inspection. You can simply edit the default global inspection policy to add GTP inspection. You can
alternatively create a new service policy as desired, for example, an interface-specific policy.
Procedure
Step 1
If necessary, create an L3/L4 class map to identify the traffic for which you want to apply the inspection.
class-map name
match parameter
Example:
hostname(config)# class-map gtp_class_map
hostname(config-cmap)# match access-list gtp