Cisco FirePOWER ASA 5500 series

25-34
Cisco Security Appliance Command Line Configuration Guide
OL-10088-01
Chapter 25 Configuring Application Layer Protocol Inspection
GTP Inspection
For example, the following command creates an object group named gsnpool32:
hostname(config)# object-group network gsnpool32
hostname(config-network)#
e. Use the network-object command to specify the load-balancing GSNs. You can do so with one
network-object command per GSN, using the host keyword. You can also using network-object
command to identify whole networks containing GSNs that perform load balancing.
hostname(config-network)# network-object host IP-address
For example, the following commands create three network objects representing individual hosts:
hostname(config-network)# network-object host 192.168.100.1
hostname(config-network)# network-object host 192.168.100.2
hostname(config-network)# network-object host 192.168.100.3
hostname(config-network)#
f. To create an object to represent the SGSN that the load-balancing GSNs are permitted to respond
to, perform the following steps:
a. Use the object-group command to define a new network object group that will represent the
SGSN that sends GTP requests to the GSN pool.
hostname(config)# object-group network SGSN-name
hostname(config-network)#
For example, the following command creates an object group named sgsn32:
hostname(config)# object-group network sgsn32
hostname(config-network)#
b. Use the network-object command with the host keyword to identify the SGSN.
hostname(config-network)# network-object host IP-address
For example, the following command creates a network objects representing the SGSN:
hostname(config-network)# network-object host 192.168.50.100
hostname(config-network)#
g. To allow GTP responses from any GSN in the network object representing the GSN pool, defined
in c., d, to the network object representing the SGSN, defined in c., f., enter the following
commands:
hostname(config)# gtp-map map_name
hostname(config-gtp-map)# permit response to-object-group SGSN-name from-object-group
GSN-pool-name
For example, the following command permits GTP responses from any host in the object group
named gsnpool32 to the host in the object group named sgsn32:
hostname(config-gtp-map)# permit response to-object-group sgsn32 from-object-group
gsnpool32
The following example shows how to support GSN pooling by defining network objects for the GSN
pool and the SGSN. An entire Class C network is defined as the GSN pool but you can identify
multiple individual IP addresses, one per network-object command, instead of identifying whole
networks. The example then modifies a GTP map to permit responses from the GSN pool to the
SGSN.
hostname(config)# object-group network gsnpool32
hostname(config-network)# network-object 192.168.100.0 255.255.255.0
hostname(config)# object-group network sgsn32