Enabling support for GTP-U with dynamic source ports
If your network is using GTP-U with dynamic source ports, FortiOS can receive multiple GTP-U sessions with the same source and destination addresses but different source ports. By default, FortiOS adds a new session to its session table for each source port; (or two sessions for bi-directional traffic) resulting the need to maintain multiple sessions for traffic with the same source and destination address. Each session uses additional system memory. If FortiOS is processing large numbers of GTP-U sessions with dynamic source ports, the system may have to maintain a large number of sessions, potentially using a large amount of memory. As well, the first packets of each new session are sent to the CPU. Once the session is established, the sessions are offloaded to NP6 or NP7 processors.
With GTP-U with dynamic source port support enabled, FortiOS on FortiGates with NP7 processors creates one session for each source and destination address pair (or two sessions for bi-directional traffic). These sessions are used for all packets between the source and destination address pair, even if GTP-U with dynamic source ports changes the source port.
If FortiOS is processing large numbers of GTP-U sessions, enabling this feature can reduce the number of sessions that FortiOS maintains, saving memory and potentially improving performance. As well, this feature can save CPU resources because the first packet received with a new source port but the same source and destination address can be offloaded by NP7 processors, instead of being sent to the CPU to establish a new session.
Use the following command to enable or disable support for GTP-U with dynamic source ports:
config system global
set gtpu-dynamic-source-port {enable | disable}
end
This option is disabled by default.
After enabling gtpu-dynamic-source-port, the first two GTP-U packets from a source and destination address pair are processed by the CPU and the GTP-U session is set up. If the session is bi-directional, the first two packets in each direction (for a total of four) are processed by the CPU. All other packets with the same source and destination address are offloaded to NP7 processors, including packets with different source ports.
|
This feature is available on on standard FortiOS and FortiOS Carrier. This feature requires a FortiGate with NP7 processors. GTP-U and GTP-C sessions helpers must be enabled. You must have configured a firewall policy to accept GTP traffic and that policy must include a GTP profile. This feature is not affected by the config system npu set gtp-support {disable | enable} set gtp-enhanced-mode {disable | enable} end |