Adding basic filters

Use the following command to add a basic filter (or IMSI filter) to a GTP profile:

config firewall gtp

edit <name>

set imsi-filter {disable | enable}

set default-imsi-action {allow | deny}

config imsi

edit <id>

set mcc-mnc <mcc-mnc-name>

set msisdn-prefix <prefix>

set apnmember <apn-name>

set action {allow | deny}

set selection-mode {ms | net | vrf}

end

Set default-imsi-action to allow to allow traffic, then use config imsi to create IMSI filters to filter the allowed traffic. Set default-imsi-action to deny to block all traffic and then use config imsi to create IMSI filters that match the traffic to be allowed.

mcc-mnc optionally create a Mobile Country Code (MCC) and Mobile Network Code (MNC) to filter on. Together these numbers uniquely identify the carrier and network of the GGSN/PGW being used.

msisidn-prefix optionally create an MSISDN prefix to filter on.

apnmember optionally select one or more APNs and APN groups. To create APNs and APN groups, see APN filtering.

selection-mode select one or more of the following modes. By default, all three modes are selected. The mode indicates where the APN originated and whether the Home Location Register (HLR) or Home Subscriber Server (HSS) has verified the user subscription.

• ms MS-provided APN, subscription not verified, indicates that the mobile station (MS) provided the APN and that the HLR/HSS did not verify the user's subscription to the network.
• net Network-provided APN, subscription not verified, indicates that the network provided a default APN because the MS did not specify one, and that the HLR/HSS did not verify the user's subscription to the network.
• sub MS or Network-provided APN, subscription verified, indicates that the MS or the network provided the APN and that the HLR/HSS verified the user's subscription to the network.

From the GUI:

1. Go to Security Profiles > GPRS Tunneling Protocol.
2. Add or edit a GTP profile.
3. Enable Basic Filtering.

4. Set the Default Action for the basic filter

5. Select Create New to add a basic filter.

6. Optionally select an APN. You can also create a new APN.

7. Select one or more of the available APN Modes (Mobile Station, Network, or Subscription Verified).

8. Optionally add an MCC-MNC.
9. Optionally add an MSISDN.