SCTP data chunk filtering by PPID

Data in SCTP packets is contained in data chunks. Each data chunk includes a payload protocol identifier (PPID) that identifies the type of data in the chunk, followed by the data itself.

You can find the list of SCTP PPIDs here.

FortiOS and FortiOS Carrier STCP data chunk filtering allows you to filter SCTP traffic according to the PPIDs found in the SCTP packets. When an SCTP packet is found to contain a PPID that you have added to an SCTP data chunk filtering, you can choose to:

• Write a IPS log message when a match is found, but otherwise allow the traffic to proceed.

• Replace the data chunk (including the PPID) with zeros and write an IPS log message.

• Terminate the SCTP session in which the PPID was found and write an IPS log message.

To apply an SCTP data chunk filter to traffic, you must create an SCTP data chunk filter profile and add the profile to a firewall policy that accepts SCTP traffic. SCTP data chunk filtering uses the IPS to find PPIDs in SCTP packets, so you must enable UTM profiles in the firewall policy to be able to add a SCTP data chunk filtering profile. The IPS creates a log message each time a SCTP data chunk filtering profile matches a PPID.

Use the following command to create an SCTP data chunk filter profile to look for one or more PPIDs:

config sctp-filter profile

edit <sctp-filter-profile-name>

set comment <string>

config ppid-filters

edit <id>

set ppid <ppid-value>

set action {pass | replace | reset}

set comment <string>

end

ppid is the PPID value in the range of 0 to 4294967295 (see SCTP Payload Protocol Identifiers). Each PPID value identifies a PPID type. For example, the IUA PPID has a PPID value of 1 and the RUA PPID has a PPID value of 20.

action {pass | replace | reset} set the action to take when match is found.

• pass allow the packet to continue to its destination without making any changes and write an IPS log message to indicate the match.

• reset terminate the SCTP session and write an IPS log message.

• replace replace the of the data chunk, both the content and PPID with zeros and write an IPS log message. This option allows the session to continue.

Use the following command to add a PPID data chunk filter profile to a firewall policy:

config firewall policy

edit <ID>

set name <name>

set srcintf <interface>

set dstintf <interface>

set action accept

set srcaddr <address>

set dstaddr <address>

set schedule <schedule>

set service ALL

set utm-status enable

set sctp-filter-profile <sctp-filter-profile-name>

end

You need to enable utm-status to be able to add an SCTP data chunk filter to the firewall policy because SCTP data chunk filtering uses the IPS and is similar to a UTM profile.

Example configuration to add a SCTP data chunk filter to a firewall policy that would replace all S1 Application Protocol (S1AP) data chunks with zeros.

config sctp-filter profile

edit S1AP-sctp-pro

set comment "S1AP profile"

config ppid-filters

edit 1

set ppid 18

set action replace

set comment "Replace S1AP chunks"

end

config firewall policy

edit <id>

set name "sctp-example"

set srcintf "port1"

set dstintf "port2"

set action accept

set srcaddr "all"

set dstaddr "all"

set schedule "always"

set service "ALL"

set utm-status enable

set sctp-filter-profile S1AP-sctp-pro

end