Adding IE allow lists to GTP profiles

You can add an IE allow list to a GTP profile to allow GTP packets that contain out of state IEs in selected message types. Normally messages with out-of-state IEs would be blocked. But it you want to be able to allow some out-of-state IEs, you can add them to an IE allow list that contains pairs of allowed out-of-state IEs and message types. Then you can add this allow list to a GTP profile.

You can use the following command to create IE allow lists:

config gtp ie-allow-list

edit <ie-allow-list-name>

config entries

edit <index>

set message <id>

set ie <id>

next

edit <index>

set message <id>

set ie <id>

end

You can use the following command to apply an IE allow list to GTPv0/v1 or GTPv2 traffic accepted by GTP profile:

config firewall gtp

edit <name>

set ie-allow-list-v0v1 <ie-allow-list-name>

set ie-allow-list-v2 <ie-allow-list-name>

end

From the GUI,

1. Go to Security Profiles > GPRS Tunneling Protocol > IE Allow List.

2. Select Create new to add a new IE Allow list.

3. Add a Name for the IE Allow list.

4. Select Create new to add message IDs and IE IDs to the allow list.

5. Select OK to save the IE Allow list.

6. To add the IE Allow list to a GTP profile, go to Security Profiles > GPRS Tunneling Protocol > Profiles.

7. Add or edit a GTP profile.

8. Open IE Allow List and select a IP Allow list for GTPv0/v1 or GTPv2.