Cisco 7604 Configuration Guide - Page 454

GTP Inspection Chapter 22 Applying Application Layer Protocol Inspection Step 5 Step 6 b. Configure GTP inspection parameters. To do so, use the GTP map configuration mode commands that you want to enforce. For a list of commands, see Table 22-4. Create a policy map or modify an existing policy map that you want to use to apply the GTP inspection engine to GTP traffic. To do so, use the policy-map command, as follows. hostname(config-cmap)# policy-map policy_map_name hostname(config-pmap)# where policy_map_name is the name of the policy map. The CLI enters the policy map configuration mode and the prompt changes accordingly. Specify the class map, created in Step 2, that identifies the GTP traffic. Use the class command to do so, as follows. hostname(config-pmap)# class class_map_name hostname(config-pmap-c)# where class_map_name is the name of the class map you created in Step 2. The CLI enters the policy map class configuration mode and the prompt changes accordingly. Step 7 Step 8 Enable GTP application inspection. To do so, use the inspect gtp command, as follows: hostname(config-pmap-c)# inspect gtp [map_name] hostname(config-pmap-c)# where map_name is the GTP map that you may have created in optional Step 4. Use the service-policy command to apply the policy map globally or to a specific interface, as follows: hostname(config-pmap-c)# service-policy policy_map_name [global | interface interface_ID] hostname(config)# where policy_map_name is the policy map you configured in Step 5. If you want to apply the policy map to traffic on all the interfaces, use the global option. If you want to apply the policy map to traffic on a specific interface, use the interface interface_ID option, where interface_ID is the name assigned to the interface with the nameif command. The FWSM begins inspecting GTP traffic, as specified. Example 22-6 shows how to use access lists to identify GTP traffic, define a GTP map, define a policy, and apply the policy to the outside interface. Example 22-6 Enabling and Configuring GTP Inspection hostname(config)# access-list gtp_acl permit udp any any eq 3386 hostname(config)# access-list gtp_acl permit udp any any eq 2123 hostname(config)# class-map gtp-traffic hostname(config-cmap)# match access-list gtp_acl hostname(config-cmap)# gtp-map sample_map hostname(config-gtp-map)# request-queue 300 hostname(config-gtp-map)# permit mcc 111 mnc 222 hostname(config-gtp-map)# message-length min 20 max 300 hostname(config-gtp-map)# drop message 20 hostname(config-gtp-map)# tunnel-limit 10000 hostname(config)# policy-map sample_policy hostname(config-pmap)# class gtp-traffic hostname(config-pmap-c)# inspect gtp sample_map hostname(config)# service-policy sample_policy outside 22-38 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM OL-20748-01