Juniper NETWORK AND SECURITY MANAGER 2010.4 - ADMININISTRATION GUIDE REV1, Administration Manual

Page: 432 / 1026

The default minimum and maximum GTP message lengths are 0 and 65535, respectively.
Limiting GTP Message Rate
To limit the rate of network traffic from a security device to a GPRS Support Node (GSN),
you can specify the number of packets per second permitted for GTP-Control (GTP-C)
messages.
Because GTP-C messages require processing and replying, they can overwhelm a GSN.
Setting a rate limit on GTP-C messages can protect your GSNs from Denial-of-Service
(DoS) attacks such as:
• Border Gateway bandwidth saturation—A malicious operator connected to the same
GRX as your PLMN can generate enough network traffic directed at your Border
Gateway, so that legitimate traffic is starved for bandwidth in or out of your PLMN,
thus denying roaming access to or from your network.
• GTP flood—GTP traffic can flood a GSN, forcing it to spend its CPU cycles processing
illegitimate data. This can prevent subscribers from roaming, forwarding data to external
networks, or prevent a GPRS attach to the network.
To limit the GTP message rate, enable Limit (packets/second) and enter the maximum
number of packets per second that a security device can send to a GSN (the default is
unlimited).
Limiting GTP Tunnels
GSNs use GTP tunnels to transmit GTP traffic using the GPRS Tunneling Protocol (GTP).
Because GSNs have a limited capacity for GTP tunnels, you might want to configure the
security device to limit the number of GTP tunnels created.
To limit GTP tunnels, enable Limit (tunnels/GSN) and enter the maximum number of
tunnels permitted for each GSN (the default is unlimited).
Removing Inactive GTP Tunnels
To configure a security device to detect and remove inactive GTP tunnels automatically,
configure the GTP Tunnel Inactivity Timeout (hours). A GTP tunnel might hang (become
inactive) when a “ delete pdp context response” message gets lost on a network, or a
GSN does not properly shut down.
The security device automatically removes a GTP tunnel that is idle for the specified
timeout value. The default timeout value is 24 hours.
Validating Sequence Numbers
When using a security device between the GGSNs, you can configure the device to validate
sequence numbers for the GGSN and drop out-of-sequence packets. This helps conserve
GGSN resources by preventing the unnecessary processing of invalid packets.
The header of a GTP packet contains a Sequence Number field, which indicates the order
of the packets arriving at the GGSN. During the PDP context activation stage:
• The sending GGSN uses zero (0) as the Sequence Number value for the first G-PDU
it sends through a tunnel to another GGSN. The sending GGSN then increments the
Copyright © 2010, Juniper Networks, Inc. 382
Network and Security Manager Administration Guide