General Packet Radio Service (GPRS) Tunneling Protocol Version 2 (GTPv2), also known as evolved packet services—GTP or eGTP, is modified and enhanced from the GPRS Tunneling Protocol used in 2G and 3G mobile networks. GTPv2 has two flavors, a control plane protocol (GTPv2-C) and a user plane protocol (GTPv2-U). GTPv2 is primarily used for control signaling between the Serving Gateway (SGW) and the Packet Data Network (PDN) Gateway (PGW) in an Evolved Packet Core (EPC) network.

The 3rd-Generation Partnership Project (3GPP) develops globally acceptable specifications for 3rd-Generation (3G) mobile systems. GPRS integrates with the existing Global System for Mobile Communication (GSM) networks and provides always-on packet-switched data services to corporate networks and the Internet.

For more information on GTPv0 and GTPv1, see the “Configuring GPRS Tunneling Protocol Support” chapter in the Security Configuration Guide: Zone-Based Policy Firewall.

Figure 1. General Format of the GTPv2-C Header

Figure 2. Format of Echo and Version Not Supported Message GTPv2-C Header

The usage of the GTPv2-C header for EPC-specific interfaces is defined below:

Octet 1:

• Octet 1 represents Version (bits 8 through 6) that is set to decimal 2 (“010”).
• If the “T” flag (bit 4) is set to 1, the Tunnel Endpoint Identifier (TEID) field immediately follows the Length field in octets 5 through 8.
• The “P” flag (Piggybacking Support) is not supported.

Octet 2:

• Octet 2 represents the Message Type field. This field supports GTPv2-C message type values.

Octets 3-4:

• Octets 3 and 4 represent the Length field. This is the length of the message in octets excluding the mandatory part of the GTPv2-C header (the first 4 octets).

Octets 5-8:

• Octets 5 through 8 represent the Tunnel Identifier field if the “T” flag is set in the first octet.

Octets 9-10:

• Octets 9 and 10 represent the Sequence Number field if the TEID is present. If the TEID field is not present, the Sequence Number field will be contained in octets 5 and 6.

Note	Apart from the following messages, all other GTPv2-C messages contain the TEID in their headers. Echo Request Echo Response Version Not Supported Indication

Figure 3. General Format of GTPv2 Message for Control Plane

Stateful inspection, also referred to as dynamic packet filtering, examines a packet based on the information in its header and tracks and validates each connection to which a firewall is connected. During stateful inspection, firewalls close ports until a connection request to a specific port is received.

A global database is built on the GTP Application Inspection and Control (AIC) policies for stateful inspection of the GTPv2 traffic. When GTPv2 messages traverse the zone-based firewall, GTP AIC policies inspect messages based on the Packet Data Protocol (PDP) context database. Packets that require Layer 7 inspection (the packet payload must be inspected or altered) are passed to the control plane.

A GTP header contains a number of options fields called Information Elements (IEs). An IE may be present in a GTP protocol data unit (PDU). The IE may be included in a message header.

An IE is identified by an IE type and an instance value. The combination of IE type and instance value uniquely identifies an IE in a message. Grouped IEs contain more than one IE and have a 4-octet IE header. Each IE within a grouped IE also has a 4-octet IE header. The IE format in GTPv2 is TLIV (Type, Length, Instance, Value) encoded. The length value of a grouped IE is the total length of the embedded IEs.

Figure 4. General Format of an Information Element (IE) in a GTPv2-C Message

Octet 1:

Octet 1 represents the IE Type field. The IE Type field supports GTPv2-C IE type values.

Octets 2-3:

Octets 2 and 3 represent the length of the IE excluding the Type and the Length field.

Octet 4:

Octet 4 represents the instance number (bit 4-1) of the IE.

Octets 5-n:

Octets 5 through n represent the actual data contained in the IE.

GPRS Tunneling Protocol Version 2 (GTPv2) is configured using the zone-based firewall structure of policies and class maps. Because GTPv2 and GTPv1 protocols share the same destination port, Layer 4 class maps cannot classify GTPv2 and GTPv1; they are classified by Layer 7 class maps.

1.    enable


2.    configure terminal


3.    parameter-map type regex parameter-map-name


4.    pattern expression


5.    exit


6.    parameter-map type inspect-global gtp


7.    gtpv2 {request-queue elements | tunnel-limit tunnels}


8.    end

Device> enable

Device# configure terminal

Device(config)# parameter-map type regex PARAM-REG

Device(config-profile)# pattern apn.cisco.com

Device(config-profile)# exit

Device(config)# parameter-map type inspect-global gtp

Device(config-profile)# gtpv2 request-queue 429496

Device(config-profile)# end

1.    enable


2.    configure terminal


3.    class-map type inspect protocol-name {match-any | match-all} class-map-name


4.    match {apn regex parameter-name | {mcc country-code mnc network-code | message-length msisdn regex parameter-name | version number}


5.    exit


6.    policy-map type inspect protocol-name policy-map-name


7.    class type inspect protocol-name class-map-name


8.    inspect


9.    service-policy protocol-name policy-map


10.    end

Device> enable

Device# configure terminal

Device(config)# class-map type inspect gtpv1 match-any gtpv2-cl7-1

Device(config-cmap)# match version 2

Device(config-cmap)# exit

Device(config)# policy-map type inspect gtpv1 gtpv2-POLICY-MAP

Device(config-pmap)# class type inspect gtpv1 gtpv2-cl7-1

Device(config-pmap-c)# inspect

Device(config-pmap-c)# service-policy gtpv1 gtpv2-POLICY-MAP

Device(config-pmap-c)# end

1.    enable


2.    configure terminal


3.    zone security {zone-name | default}


4.    exit


5.    zone-pair securityzone-pair-namesource {source-zone-name | self | default} destination {destination-zone-name | self | default}


6.    service-policy type inspect policy-map-name


7.    exit


8.    interface type number


9.    zone-member security zone-name


10.    end

Device> enable

Device# configure terminal

Device(config)# zone security z1
Device(config)# zone security z2

Device(config-sec-zone)# exit

Device(config)# zone-pair security clt2srv1 source z1 destination z2

Device(config-sec-zone-pair)# service-policy type inspect gtpv2-POLICY-MAP

Device(config-sec-zone-pair)# exit

Device(config)# interface gigabitethernet 0/0/0

Device(config-if)# zone-member security z1

Device(config-if)# end