Technical Tip: Configuring GTP apn-shaper to rate-limit GTP Session Requests

[scollins]

Description	This article demonstrates how the FortiCarrier responds to requests when the GTP apn-shaper is configured.
Scope	FortiCarrier.
Solution	The following two documents detail how to configure APNs and how they are referenced in the apn-shaper configuration: Creating APNs APN Traffic Shaping The following example shows a capture of a GTP response message sent back from the FortiCarrier once the configured rate-limit in the apn-shaper has been exceeded and the action is set to 'reject'.  If the action is set to 'drop', then no response is provided: In the above example, the cause code in the Response message is 113. This is because the original request was a GTPv2 request. The cause code in response to a GTPv1 request = 229. Note: The first link (creating APNs) shows an example wildcard APN. It is important to note that APNs configured in this way are not supported when referenced in the apn-shaper configuration. When defining APNs for use with the apn-shaper, they must be configured as full APNs. For example: internet.mcc333.mcn111.gprs. In the apn-shaper configuration in FortiOS versions before v7.0.1, set apn <blank> would find any APN. This will also be the case in v7.2.12+, v7.4.8+, and v7.6.3+. In all versions in between, leaving the set apn <blank> matches nothing, which may not be desired.