Fortinet black logo

FortiOS Carrier

Logging

Logging

Use the following options to configure logging for a GTP profile.

config firewall gtp

edit <name>

set forwarded-log {disable | enable}

set denied-log {disable | enable}

set rate-limited-log {disable | enable}

set state-invalid-log {disable | enable}

set tunnel-limit-log {disable | enable}

set extension-log {disable | enable}

set traffic-count-log {disable | enable}

set log-freq <frequency>

set gtpu-forwarded-log {disable | enable}

set gtpu-denied-log {disable | enable}

set gtpu-log-freq <frequency>

set log-gtpu-limit <limit>

set log-imsi-prefix <prefix>

set log-msisdn-prefix <prefix>

end

GTP logs are a subtype of the event logs. You can view GTP logs by going to Log & Report > GTP.

From the GUI to configure logging in a GTP profile, open Logging.

Option

Description

forwarded-log GUI Forwarded Log. Enable to log forwarded GTP packets. Forwarded packets are allowed by the GTP profile.
denied-log GUI Denied Log. Enable to log GTP packets denied or blocked by the GTP profile.
rate-limited-log GUI Rate Limited Log. Enable to log rate-limited GTP packets. Rate limited packets have been dropped because they exceed the maximum rate limit of the destination GSN.
state-invalid-log GUI State Invalid Log. Enable to log invalid GTP packets that have failed stateful inspection.
tunnel-limit-log GUI Tunnel Limit Log. Enable to log packets dropped because the maximum limit of GTP tunnels for the destination GSN is reached.
extension-log

GUI Extension Log. Enable to log extended information about GTP packets. When enabled, this additional information will be included in log entries:

  • IMSI
  • MSISDN
  • APN
  • Selection Mode
  • SGSN address for signaling
  • SGSN address for user data
  • SGW and PGW session information
  • GGSN address for signaling
  • GGSN address for user data
traffic-count-log

GUI Traffic count Log. Enable to log the total number of control and user data messages received from and forwarded to the GGSNs and SGSNs that the unit protects.

FortiOS Carrier can report the total number of user data and control messages received from and forwarded to the GGSNs and SGSNs it protects. Alternately, the total size of the user data and control messages can be reported in bytes. The unit differentiates between traffic carried by each GTP tunnel, and also between GTP-User and GTP-Control messages.

The number of messages or the number of bytes of data received from and forwarded to the SGSN or GGSN are totaled and logged if a tunnel is deleted.

When a tunnel is deleted, the log entry contains:

  • Timestamp
  • Interface name (if applicable)
  • SGSN IP address
  • GGSN IP address
  • SGW, PGW, and ePDG information
  • TID
  • Tunnel duration time in seconds
  • Number of messages sent to the SGSN
  • Number of messages sent to the GGSN

log-freq

GUI Log Frequency. The number of messages to drop between logged messages.

An overflow of log messages can sometimes occur when logging rate-limited GTP packets exceed their defined threshold. To conserve resources, you can specify that some log messages are dropped. For example, if you want only every twentieth message to be logged, set a log frequency of 20. This way, 20 messages are skipped and the next logged. Acceptable frequency values range from 0 to 2147483674. When set to ‘0’, no messages are skipped.

gtpu-forwarded-log

GUI GTPU Forwarded Log: Enable to log forwarded GTPU packets.

gtpu-denied-log

GUI GTPU Denied Log. Enable to log GTPU packets denied or blocked by this GTP profile.

gtpu-log-freq

GUI GTPU Log Frequency. The number of messages to drop between logged GTPU messages.

log-gtpu-limit

The user data log limit in the range of 0 to 512 bytes.

log-imsi-prefix

Specify an IMSI prefix for selective logging

log-msisdn-prefix

Specify an MSISDN prefix for selective logging.

Logging

Use the following options to configure logging for a GTP profile.

config firewall gtp

edit <name>

set forwarded-log {disable | enable}

set denied-log {disable | enable}

set rate-limited-log {disable | enable}

set state-invalid-log {disable | enable}

set tunnel-limit-log {disable | enable}

set extension-log {disable | enable}

set traffic-count-log {disable | enable}

set log-freq <frequency>

set gtpu-forwarded-log {disable | enable}

set gtpu-denied-log {disable | enable}

set gtpu-log-freq <frequency>

set log-gtpu-limit <limit>

set log-imsi-prefix <prefix>

set log-msisdn-prefix <prefix>

end

GTP logs are a subtype of the event logs. You can view GTP logs by going to Log & Report > GTP.

From the GUI to configure logging in a GTP profile, open Logging.

Option

Description

forwarded-log GUI Forwarded Log. Enable to log forwarded GTP packets. Forwarded packets are allowed by the GTP profile.
denied-log GUI Denied Log. Enable to log GTP packets denied or blocked by the GTP profile.
rate-limited-log GUI Rate Limited Log. Enable to log rate-limited GTP packets. Rate limited packets have been dropped because they exceed the maximum rate limit of the destination GSN.
state-invalid-log GUI State Invalid Log. Enable to log invalid GTP packets that have failed stateful inspection.
tunnel-limit-log GUI Tunnel Limit Log. Enable to log packets dropped because the maximum limit of GTP tunnels for the destination GSN is reached.
extension-log

GUI Extension Log. Enable to log extended information about GTP packets. When enabled, this additional information will be included in log entries:

  • IMSI
  • MSISDN
  • APN
  • Selection Mode
  • SGSN address for signaling
  • SGSN address for user data
  • SGW and PGW session information
  • GGSN address for signaling
  • GGSN address for user data
traffic-count-log

GUI Traffic count Log. Enable to log the total number of control and user data messages received from and forwarded to the GGSNs and SGSNs that the unit protects.

FortiOS Carrier can report the total number of user data and control messages received from and forwarded to the GGSNs and SGSNs it protects. Alternately, the total size of the user data and control messages can be reported in bytes. The unit differentiates between traffic carried by each GTP tunnel, and also between GTP-User and GTP-Control messages.

The number of messages or the number of bytes of data received from and forwarded to the SGSN or GGSN are totaled and logged if a tunnel is deleted.

When a tunnel is deleted, the log entry contains:

  • Timestamp
  • Interface name (if applicable)
  • SGSN IP address
  • GGSN IP address
  • SGW, PGW, and ePDG information
  • TID
  • Tunnel duration time in seconds
  • Number of messages sent to the SGSN
  • Number of messages sent to the GGSN

log-freq

GUI Log Frequency. The number of messages to drop between logged messages.

An overflow of log messages can sometimes occur when logging rate-limited GTP packets exceed their defined threshold. To conserve resources, you can specify that some log messages are dropped. For example, if you want only every twentieth message to be logged, set a log frequency of 20. This way, 20 messages are skipped and the next logged. Acceptable frequency values range from 0 to 2147483674. When set to ‘0’, no messages are skipped.

gtpu-forwarded-log

GUI GTPU Forwarded Log: Enable to log forwarded GTPU packets.

gtpu-denied-log

GUI GTPU Denied Log. Enable to log GTPU packets denied or blocked by this GTP profile.

gtpu-log-freq

GUI GTPU Log Frequency. The number of messages to drop between logged GTPU messages.

log-gtpu-limit

The user data log limit in the range of 0 to 512 bytes.

log-imsi-prefix

Specify an IMSI prefix for selective logging

log-msisdn-prefix

Specify an MSISDN prefix for selective logging.