GTP APN and IMSI Prefix Configuration

A NetScreen device can filter GTP packets based on either or the combination of an IMSI prefix and an APN.

Access Point Name Filters

By default, the NetScreen device permits all APNs. However, you can configure the device to perform APN filtering to restrict roaming subscribers’ access to external networks. You can configure up to 2000 APNs.

To enable APN filtering, you must specify one or more APNs. To set an APN, you need to know the domain name of the network (for example, “mobiphone.com”), and the operator ID. Because the domain name (network ID) portion of an APN can potentially be very long and contain many characters, you can use the wildcard “*” as the first character of the APN. The wild card indicates that the APN is not limited only to “mobiphone.com”, but also includes all the characters that might precede it.

You must also set a Selection Mode for the APN. The Selection Mode indicates the origin of the APN and whether or not the HLR (Home Location Register) verified the user-subscription. You set the Selection Mode according to the security needs of your network. The possible Selection Modes are the following:

Mobile Station – MS-provided APN, subscription not verified
This Selection Mode indicates that the mobile station (MS) provided the APN and that the HLR did not verify the user’s subscription to the network.

Network – Network-provided APN, subscription not verified
This Selection Mode indicates that the network provided a default APN because the MS did not specify one, and that the HLR did not verify the user’s subscription to the network.

Verified – MS or Network-provided APN, subscription verified
This Selection Mode indicates that the MS or the network provided the APN and that the HLR verified the user’s subscription to the network.

APN filtering applies only to “create pdp request” messages. When performing APN filtering, the NetScreen device inspects GTP packets looking for APNs that match APNs that you set. If the APN of a GTP packet matches an APN that you specified, the NetScreen device then verifies the Selection Mode and only forwards the GTP packet if both the APN and the Selection Mode match the APN and the Selection Mode that you specified. Because APN filtering is based on perfect matches, using the wildcard “*” when setting an APN suffix can prevent the inadvertent exclusion of APNs that you would otherwise authorize. The NetScreen device automatically denies all other APNs that do not match.

IMSI Prefixes

A GSN (GPRS Support Node) identifies a mobile station by its IMSI (International Mobile Station Identity). An IMSI is composed of three elements: the MCC (Mobile Country Code), the MNC (Mobile Network Code), and MSIN (Mobile Subscriber Identification Number). The MCC and MNC combined constitute the IMSI prefix and identify the mobile subscriber’s home network, or PLMN.

You can configure the NetScreen device to deny GTP traffic coming from non-roaming partners by setting IMSI prefixes. By default, a NetScreen device does not perform IMSI prefix filtering on GTP packets. By setting IMSI prefixes, you configure the NetScreen device to filter “create pdp request” messages and only permit GTP packets with IMSI prefixes that match the ones you set. The NetScreen device drops GTP packets with IMSI prefixes that do not match any of the IMSI prefixes that you set. You can set up to 1000 IMSI prefixes.

To Configure an APN and IMSI Prefix Filter