Technical Tip: Configuring GTP apn-shaper to rate-limit GTP Session Requests

The following two documents detail how to configure APNs and how they are referenced in the apn-shaper configuration:

• Creating APNs
• APN Traffic Shaping

The following example shows a capture of a GTP response message sent back from the FortiCarrier once the configured rate-limit in the apn-shaper has been exceeded and the action is set to 'reject'.  If the action is set to 'drop', then no response is provided:

In the above example, the cause code in the Response message is 113. This is because the original request was a GTPv2 request.

The cause code in response to a GTPv1 request = 229.

Note:

• The first link (creating APNs) shows an example wildcard APN. It is important to note that APNs configured in this way are not supported when referenced in the apn-shaper configuration.

When defining APNs for use with the apn-shaper, they must be configured as full APNs. For example: internet.mcc333.mcn111.gprs.

• In the apn-shaper configuration in FortiOS versions before v7.0.1, set apn <blank> would find any APN. This will also be the case in v7.2.12+, v7.4.8+, and v7.6.3+.

In all versions in between, leaving the set apn <blank> matches nothing, which may not be desired.