GTP Shared Tunnel Limit

The GTP Shared Tunnel limit is the total number of GTP tunnels created by multiple GTP profiles. A Global shared tunnel limit gives the flexibility of limiting the number of GTP tunnels flowing through different profiles. A shared global limit is defined and then referenced in the profiles. Before FortiOS 6.0, the GTP tunnel limit could be set on a per-profile basis. The GTP tunnel limits can now be set per VDOM.

Per profile tunnel limiting is still possible but restrictive limits between the global limit and the profile limit will be enforced.

Example:

• Global shared tunnel limit defined as 12
• GTP Profile A - per profile tunnel limit defined as 8
• GTP Profile B - per profile tunnel limit defined as 14

You can have eight tunnels active in profile A, but the ninth will be dropped due to the profile limit of 8.

If Profile A still has eight active tunnels, you can have four tunnels active in profile B and the fifth will be dropped even though the profile allows fourteen, because the global share limit is twelve.

Configuring the GTP tunnel limit

The tunnel limit shaper is created/edited by configuring the object config gtp tunnel-limit.

Each GTP profile selects a shaper to use from the object configured in the CLI.

These values are shared by all of the profiles associated with the indicated shaper:

• Each GTP profile selects the shared tunnel limiter from the CLI.
• Each shared tunnel limiter counts the total number of alive GTP tunnels created by GTP profiles that select the limiter.
• Once the total number exceeds the shared limits, new tunnel requests of those GTP profiles will be rejected.

CLI syntax:

config gtp tunnel-limit

edit "gtp-tl-1"

set tunnel-limit <integer value from 1 to 16000000>

end

Use the syntax below to assign the tunnel limit to the GTP profile.

CLI syntax:

config firewall gtp

edit "gtp1"

set global-tunnel-limit "gtp-tl-1"

next

edit "gtp2"

set global-tunnel-limit "gtp-tl-1"

end

Diagnose command

A diagnose command is available to show the shared tunnel limiters.

diagnose firewall gtp tunnel-limit list

Example output:

name=gtp-tl-1 tunnel_limit=50 tunnel_count=0