Fortinet black logo

Handbook

Basic filtering options

6.0.0
Copy Link
Copy Doc ID 4afb0436-a998-11e9-81a4-00505692583a:595305
Download PDF

Basic filtering options

The International Mobile Station Identity (IMSI) is used by a GPRS Support Node (GSN) to identify a mobile station. Three elements make up every IMSI:

  • the mobile country code (MCC)
  • the mobile network code (MNC)
  • the mobile subscriber identification number (MSIN).

The subscriber's home network—the public land mobile network (PLMN)—is identified by the IMSI prefix, formed by combining the MCC and MNC.

By default, the unit allows all IMSIs. You can add IMSI prefixes to deny GTP traffic coming from non-roaming partners. Any GTP packets with IMSI prefixes not matching the prefixes you set will be dropped. GTP Create pdp request messages are filtered and only IMSI prefixes matching the ones you set are permitted. Each GTP profile can have up to 1000 IMSI prefixes set.

An IMSI prefix and an APN can be used together to filter GTP packets if you set an IMSI filter entry with a non-empty APN.

note icon You cannot add an IMSI when creating a new profile. You must add it after the profile has been created and you are editing the profile.
IMSI Filtering section of the New GTP Profile
Enable IMSI Filter Select to enable IMSI filtering.
Default IMSI Action Select the default action for IMSI filtering. If you select Allow, all sessions are allowed except those blocked by individual IMSI filters. If you select Deny, all sessions are blocked except those allowed by individual IMSI filters.
APN The APN that is part of the IMSI that will be filtered.
MCC-MNC The MCC-MNC part of the IMSI that will be filtered.
Mode The type of mode that indicates where the APN originated and whether the Home Location Register (HLR) has verified the user subscription.
Action The type of action that will be taken.
Edit Modifies settings to an IMSI filter. When you select Edit, the Edit window appears, which allows you to modify the IMSI filter’s settings.
Delete Removes an IMSI filter from within the table, in the IMSI Filtering section.
Add IMSI Adds a new IMSI filter to the list. When you select Add IMSI, the New window appears, which allows you to configure IMSI filter settings.
New IMSI page
APN Enter the APN part of the IMSI to be filtered.
MCC-MNC Enter the MCC-MCC part of the IMSI to be filtered.
Mode Select one or more of the available modes to indicate where the APN originated and whether the Home Location Register (HLR) has verified the user subscription.
Mobile Station provided MS-provided APN, subscription not verified, indicates that the mobile station (MS) provided the APN and that the HLR did not verify the user's subscription to the network.
Network provided Network-provided APN, subscription not verified, indicates that the network provided a default APN because the MS did not specify one, and that the HLR did not verify the user's subscription to the network.
Subscription Verified MS or Network-provided APN, subscription verified, indicates that the MS or the network provided the APN and that the HLR verified the user's subscription to the network
Action Select Allow or Deny.

Basic filtering options

The International Mobile Station Identity (IMSI) is used by a GPRS Support Node (GSN) to identify a mobile station. Three elements make up every IMSI:

  • the mobile country code (MCC)
  • the mobile network code (MNC)
  • the mobile subscriber identification number (MSIN).

The subscriber's home network—the public land mobile network (PLMN)—is identified by the IMSI prefix, formed by combining the MCC and MNC.

By default, the unit allows all IMSIs. You can add IMSI prefixes to deny GTP traffic coming from non-roaming partners. Any GTP packets with IMSI prefixes not matching the prefixes you set will be dropped. GTP Create pdp request messages are filtered and only IMSI prefixes matching the ones you set are permitted. Each GTP profile can have up to 1000 IMSI prefixes set.

An IMSI prefix and an APN can be used together to filter GTP packets if you set an IMSI filter entry with a non-empty APN.

note icon You cannot add an IMSI when creating a new profile. You must add it after the profile has been created and you are editing the profile.
IMSI Filtering section of the New GTP Profile
Enable IMSI Filter Select to enable IMSI filtering.
Default IMSI Action Select the default action for IMSI filtering. If you select Allow, all sessions are allowed except those blocked by individual IMSI filters. If you select Deny, all sessions are blocked except those allowed by individual IMSI filters.
APN The APN that is part of the IMSI that will be filtered.
MCC-MNC The MCC-MNC part of the IMSI that will be filtered.
Mode The type of mode that indicates where the APN originated and whether the Home Location Register (HLR) has verified the user subscription.
Action The type of action that will be taken.
Edit Modifies settings to an IMSI filter. When you select Edit, the Edit window appears, which allows you to modify the IMSI filter’s settings.
Delete Removes an IMSI filter from within the table, in the IMSI Filtering section.
Add IMSI Adds a new IMSI filter to the list. When you select Add IMSI, the New window appears, which allows you to configure IMSI filter settings.
New IMSI page
APN Enter the APN part of the IMSI to be filtered.
MCC-MNC Enter the MCC-MCC part of the IMSI to be filtered.
Mode Select one or more of the available modes to indicate where the APN originated and whether the Home Location Register (HLR) has verified the user subscription.
Mobile Station provided MS-provided APN, subscription not verified, indicates that the mobile station (MS) provided the APN and that the HLR did not verify the user's subscription to the network.
Network provided Network-provided APN, subscription not verified, indicates that the network provided a default APN because the MS did not specify one, and that the HLR did not verify the user's subscription to the network.
Subscription Verified MS or Network-provided APN, subscription verified, indicates that the MS or the network provided the APN and that the HLR verified the user's subscription to the network
Action Select Allow or Deny.