show security gtp profile

Syntax

Description

Use this command to display the GTP configuration. IP addresses in GPRS tunneling protocol (GTP) message on Gp or the S8 interface are validated with the configured IP group list to prevent attacks. The GTP firewall determines the IP addresses in GTP messages and matches with the configured IP group list. Based on the match criteria, valid GTP messages are forwarded to Packet and Forwarding Engine, and invalid GTP messages are dropped.

From Junos OS Release 20.4R1 onwards, show security gprs gtp configuration is replaced by show security gtp profile <profile_name>. The identifier option is replaced by profile-name in Junos OS Release 20.4R1.

Options

profile-name —Displays specific GTP profile.
all —Displays all the GTP profile list.

Required Privilege Level

view

Output Fields

Table 1 lists the output fields for the show security gtp profile GTP command. Output fields are listed in the approximate order in which they appear.

Table 1: show security gtp profile GTP
Field Name	Field Description
Index	An internal number associated with the GTP message.
Min Message Length	Displays minimum message payload length (in bytes).
Max Message Length	Displays maximum message payload length (in bytes).
Timeout	Elapsed time without activity after which the profile is terminated.
Rate Limit Alarm Threshold Rate Limit Drop Threshold	Displays limit rate of control traffic to any GSN defined in a GTP profile. A drop threshold option and an alarm threshold option reduces the duplicate drop logs for destination GSN.
Remove R6Remove R7Remove R8Remove R9	Displays count of IEs that are removed from GTP messages.
Deny Nested GTP	Represents the deny of nested GTP profiles.
Validated	Represents validated address of the end user.
Restart Path	Represents the restart status of the GTP path.
Log Forwarded	Represents packets that the security device transmitted because it was valid.
Log event	A packet that the security device dropped because it failed stateful inspection, log alarms, and tunnel management events.
Log Prohibited	packet that the security device dropped because it was invalid.
Log Ratelimited	A packet that the security device dropped because it exceeded the maximum rate limit of the destination GSN.
Drop AA Create PDU	Represents Create AA PDU Context Request and Create AA PDU Context Response messages.
Drop AA Delete PDU	Represents Delete AA PDP Context Request and Delete AA PDP Context Response messages.
Drop Bearer Resource	Represents Bearer Resource Command and Bearer Resource Failure messages.
Drop Change Notification	Represents Change Notification Request and Change Notification Response messages.
Drop Config Transfer	Represents Configuration Transfer Tunnel messages.
Drop Context	Represents Context Request and Context Response messages.
Drop Create Bear	Represents Create Bearer Request and Create Bearer Response messages.
Drop Create Data Forwarding	Represents Create Indirect Data Forwarding Request and Create Indirect Data Forwarding Response messages.
Drop Create PDU	Represents Create PDU Context Request and Create PDU Context Response messages.
Drop Create Session	Represents Create Session Request and Create Session Response messages.
Drop Create Forwarding Tnl	Represents Create Forwarding Tunnel Request and Create Forwarding Tunnel Response messages.
Drop CS Paging	Represents CS Paging Indication messages.
Drop Data Record	Represents Data Record Request and Data Record Response messages.
Drop Delete Bearer	Represents Delete Bearer Request and Delete Bearer Response messages.
Drop Delete Command	Represents Delete Bearer Command and Delete Bearer Failure messages.
Drop Delete Data Forwarding	Represents Delete Indirect Data Forwarding Request and Delete Indirect Data Forwarding Response messages.
Drop Delete PDN	Represents Delete PDN Connection Set Request and Delete PDN Connection Set Response messages
Drop Delete PDP	Represents Delete PDP Context Request and Delete PDP Context Response messages.
Drop Delete Session	Represents Delete Session Request and Delete Session Response messages.
Drop Detach	Represents Detach Notification and Detach Acknowledgement messages.
Drop Downlink Notification	Represents Downlink Data Notification, Downlink Data Acknowledgement, and Downlink Data Notification Failure Indication messages.
Drop Echo	Represents Echo Request and Echo Response messages.
Drop Error Indication	Represents Error Indication messages.
Drop Failure Report	Represents Failure Report Request and Failure Report Response messages.
Drop FWD Access	Represents Forward Access Context Notification and Forward Access Context Acknowledgment messages.
Drop FWD Relocation	Represents Forward Relocation Request, Forward Relocation Response, Forward Relocation Complete, and Forward Relocation Complete Acknowledge messages.
Drop FWD SRNS Context	Represents Forward SRNS Context Request and Forward SRNS Context Response messages.
Drop G-PDU	Represents G-PDU and T-PDU messages.
Drop Identification	Represents Identification Request and Identification Response messages.
Drop MBMS Sess Start	Represents MBMS Session Start Request and MBMS Session Start Response messages.
Drop MBMS Sess Stop	Represents MBMS Session Stop Request and MBMS Session Stop Response messages.
Drop MBMS Sess Update	Represents MBMS Session Update Request and MBMS Session Update Response messages.
Drop Modify Bearer	Represents Modify Bearer Request and Modify Bearer Response messages.
Drop Modify Command	Represents Modify Bearer Command and Modify Bearer Failure messages.
Drop Node Alive	Represents Node Alive Request and Node Alive Response messages.
Drop Note MS Present	Represents Note MS GPRS Present Request and Note MS GPRS Present Response messages.
Drop PDU Notification	Represents PDU Notification request and PDU Notification response messages.
Drop Ran Info	Represents Ran Info Relay messages.
Drop Redirection	Represents Redirection Request and Redirection Response messages.
Drop Release Access
Drop Relocation Cancel	Represents Relocations Cancel Request and Relocation Cancel Response messages.
Drop Resume	Represents Resume Notification and Resume Acknowledgement messages.
Drop Send Route	Represents Send Route Info Request and Send Route Info Response messages.
Drop SGSN Context	Represents SGSN Context Request and SGSN Context Response messages.
Drop Stop Paging	Represents Stop Paging Indication messages.
Drop Supported Extension	Represents Supported Extension Headers Notification messages.
Drop Suspend	Represents Suspend Notification and Suspend Acknowledgement messages.
Drop Trace Session	Represents Trace Session Activation in GTP.
Drop Update Bearer	Represents Update Bearer Request and Update Bearer Response messages.
Drop Update PDN	Represents Update PDN Set Connection Request and PDN Set Connection Response messages.
Drop Update PDP	Represents Update PDP Request and Update PDP Response messages.
Drop Ver Not Supported	Represents Version Not Supported messages.
Handover group name	Name of the handover IP address group.
NE group name	Name of the network equipment group.
UE group name	Name of the user equipment group.
Must-IE profile V1	Represents GTPv1 Must-IE check.
Must-IE profile V2	Represents GTPv2 Must-IE check.
Remove-ie-set V1	Represents GTPv1 IE Removal.
Remove-ie-set V2	Represents GTPv2 IE Removal.
Listening-mode	Represents listening-mode for GTP inspection.

Sample Output

Refer the following sample outputs for Junos OS 20.3R1 or previous releases

show security gtp configuration all (GTP Profile)
show security gtp configuration 1 (GTP Profile)
show security gtp profile name (listening-mode, rate-limit, log event)

show security gtp configuration all (GTP Profile)

show security gtp configuration 1 (GTP Profile)

Refer the following sample output for Junos OS 20.4R1 or later releases.