Adding an APN filter to a GTP profile

Use the following command to add an APN to a GTP profile:

config firewall gtp

edit <name>

set apn-filter enable

set default-apn-action {allow | deny}

config apn

edit <id>

set apnmember <apn-name>

set action {allow | deny}

set selection-mode {ms | net | vrf}

end

Set default-apn-action to allow to allow traffic, then use config apn to create APN filters to filter the allowed traffic. Set default-apn-action to deny to block all traffic and then use config apn to create APN filters that match the traffic to be allowed.

<apn-name> can be the name of an APN or an APN group.

selection-mode select one or more of the following APN modes. By default, all three modes are selected. The mode indicates where the APN originated and whether the Home Location Register (HLR) has verified the user subscription.

• ms MS-provided APN, subscription not verified, indicates that the mobile station (MS) provided the APN and that the HLR did not verify the user's subscription to the network.
• net Network-provided APN, subscription not verified, indicates that the network provided a default APN because the MS did not specify one, and that the HLR did not verify the user's subscription to the network.
• sub MS or Network-provided APN, subscription verified, indicates that the MS or the network provided the APN and that the HLR verified the user's subscription to the network.