Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 346)

100

101

21-20

Cisco Security Appliance Command Line Configuration Guide

OL-6721-01

Chapter 21 Applying Application Layer Protocol Inspection

Managing GTP Inspection

The UMTS is the commercial convergence of fixed-line telephony, mobile, Internet and computer

technology. UTRAN is the networking protocol used for implementing wireless networks in this system.

GTP allows multi-protocol packets to be tunneled through a UMTS/GPRS backbone between a GGSN,

an SGSN and the UTRAN.

GTP does not include any inherent security or encryption of user data, but using GTP with the security

appliance helps protect your network against these risks.

The SGSN is logically connected to a GGSN using GTP. GTP allows multiprotocol packets to be

tunneled through the GPRS backbone between GSNs. GTP provides a tunnel control and management

protocol that allows the SGSN to provide GPRS network access for a mobile station by creating,

modifying and deleting tunnels. GTP uses a tunneling mechanism to provide a service for carrying user

data packets.

Enabling and Configuring GTP Inspection

GTP application inspection is disabled by default, so you need to complete the procedures described in

this section to enable GTP inspection.

Note GTP inspection requires a special license. If you enter GTP-related commands on a security appliance

without the required license, the security appliance displays an error message.

To enable or change GTP configuration, perform the following steps:

Step 1 Define access control lists to identify the two ports required for receiving GTP traffic. For example, the

following commands identify the default ports for GTP inspection.

hostname(config)# access-list gtp_acl permit udp any any eq 3386

hostname(config)# access-list gtp_acl permit udp any any eq 2123

Step 2 Name the traffic class by entering the following command in global configuration mode:

hostname(config)# class-map

class_map_name

Replace class_map_name with the name of the traffic class, for example:

hostname(config)# class-map gtp_port

When you enter the class-map command, the CLI enters the class map configuration mode, and the

prompt changes, as in the following example:

hostname(config-cmap)#

Step 3 In the class map configuration mode, define the match command, as in the following example:

hostname(config-cmap)# match access-list gtp_acl

hostname(config-cmap)# exit

hostname(config)#

Step 4 (Optional) Create a GTP map by entering the following command:

hostname(config)# gtp-map

gtp_map_name

Replace gtp_map_name with the name of the GTP map, for example:

hostname(config)# gtp-map inbound_gtp

This map is automatically enabled when you enable GTP without specifying a GTP map.

1 2 ... 341 342 343 344 345 346 347 348 349 350 351 ... 603 604

Kommentare zu diesen Handbüchern

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 346

Kommentare zu diesen Handbüchern