Introduction to GPRS

General Packet Radio Service (GPRS) networks connect to several external networks including those of roaming partners, corporate customers, GPRS Roaming Exchange (GRX) providers, and the public Internet. GPRS network operators face the challenge of protecting their network while providing and controlling access to and from these external networks. Juniper Networks provides solutions to many of the security problems plaguing GPRS network operators.

In the GPRS architecture, the fundamental cause of security threats to an operator’s network is the inherent lack of security in the GPRS tunneling protocol (GTP). GTP is the protocol used between GPRS support nodes (GSNs). GTP is used to establish a GTP tunnel for individual user endpoints (UEs) and between a Service Gateway (S-GW) and a PDN Gateway (P-GW) in 4G. A GTP tunnel is a channel between GSNs through which two hosts exchange data. The SGSN (S-GW ) receives packets from the user endpoints and encapsulates them within a GTP header before forwarding them to the GGSN through the GTP tunnel. When the GGSN receives the packets, it decapsulates them and forwards them to the external host.

Communication between different GPRS networks is not secure because GTP does not provide any authentication, data integrity, or confidentiality protection. Implementing IP Security (IPsec) for connections between roaming partners, setting traffic rate limits, and using stateful inspection can eliminate a majority of the GTP’s security risks. The GTP firewall features in Junos OS address key security issues in mobile operators’ networks.

Juniper Networks security devices mitigate a wide variety of attacks on the following types of GPRS interfaces:

• Gn—The Gn interface is the connection between an SGSN (S-GW ) and a GGSN within the same public land mobile network (PLMN).

  S5 - The S5 interface is the connection between a S-GW and P-GW within the PLMN in 4G networks.

• Gp—The Gp interface is the connection between two PLMNs.

  S8 -The S8 interface is the bearer plane connection between home and visited PLMNs in 4G networks.

• Gi—The Gi interface is the connection between a GGSN and the Internet or destination networks connected to a PLMN.

  SGi - The SGi interface is the connection between a P-GW and the Internet or destination networks connected to a PLMN in 4G networks.

The term interface has different meanings in Junos OS and in GPRS technology. In Junos OS, an interface is a doorway to a security zone that allows traffic to enter and exit the zone. In GPRS, an interface is a connection, or a reference point, between two components of a GPRS infrastructure, for example, an SGSN (S-GW) and a GGSN (P-GW).

Starting in Junos OS Release 18.4R1, GPRS tunneling protocol (GTP) traffic security inspection is supported on IPv6 addresses along with existing IPv4 support. With this enhancement, a GTP tunnel using either IPv4 and IPv6 addresses is established for individual user endpoints (UEs) between a Serving GPRS Support Node (SGSN) in 3G or a Service Gateway (S-GW) and a Gateway GPRS Support Node (GGSN) in 3G or a PDN Gateway (P-GW) in 4G. With IPv6 support, GTP Application Layer Gateway (ALG) inspects or ignores IPv6 GTP sessions according to the policy configurations. All ALG functions on IPv4 are supported on IPv6. You can Inspect GTP signaling or data messages transmitted over IPv6 based on the policy configurations.

This topic contains the following sections:

• Gp and Gn Interfaces
• Gi Interface
• Operational Modes
• GTP In-Service Software Upgrade

Gp and Gn Interfaces

You implement a security device on the Gn interface to protect core network assets such as the SGSN (S-GW) and GGSN (P-GW). To secure GTP tunnels on the Gn interface, you place the security device between SGSNs (S-GW) and GGSNs (P-GW) within a common PLMN.

When you implement a security device to the Gp interface, you protect a PLMN from another PLMN. To secure GTP tunnels on the Gp interface, you place the SGSNs (S-GW) and GGSNs(P-GW) of a PLMN behind the security device so that all traffic, incoming and outgoing, goes through the firewall.

Figure 1 illustrates the placement of Juniper Networks SRX Series devices used to protect PLMNs on the Gp and Gn interfaces.

Figure 1: Gp and Gn Interfaces

Gi Interface

When you implement a security device on the Gi interface, you can simultaneously control traffic for multiple networks, protect a PLMN against the Internet and external networks, and protect mobile users from the Internet and other networks. Junos OS provides a great number of virtual routers, making it possible for you to use one virtual router per customer network and thereby allow the separation of traffic for each customer network.

The security device can securely forward packets to the Internet or destination networks using the Layer 2 Tunneling Protocol (L2TP) for IPsec virtual private network (VPN) tunnels.

SRX Series devices do not support full L2TP.

Figure 2 illustrates the implementation of a security device to protect a PLMN on the Gi interface.

Figure 2: Gi Interface

The GTP Application Layer Gateway (ALG) maintains the status of the tunnels and permits tunnel update request packets only for the existing tunnels. When the user equipment moves to a new location and attaches to another SGSN, the new SGSN information must be updated in the original tunnel. Because few GTP-C messages are bidirectional, and messages can be sent either sent by the SGSN or the GGSN, correct session distribution is not guaranteed. That is, the GTP ALG stops creating a session if the first packet originates from an unknown direction. In this case, the first packet and the other pending packets are dropped.

To prevent GTP-C packets from being dropped, a new flow session is created and the GTP-C traffic is allowed to pass even if the GGSN or SGSN direction is not determined. Later, the GGSN IP is determined using the correct SPU to create the flow session; otherwise, the session is migrated to the designated SPU.

Starting from Junos OS Release 18.4R1, the GTP-C tunnel is enhanced to support the tunnel-based session distribution to speed up the tunnel set up process and load balance the sessions between the SPUs. The tunnel-based session guarantees that the GTP-C tunnel messages reach the control tunnel and finish the stateful inspection. If the GTP-C distribution is enabled, the GTP-C tunnels and the GTP-C tunnel sessions are distributed by the SGSN tunnel endpoint identifier (TEID) of the tunnel. Use the set security forwarding-process application-services enable-gtpu-distribution command to enable the tunnel-based session distribution where the GTP-C traffic of different tunnels are spread across different SPUs. This command is mandatory. If it's missing from the configuration, the GTP ALG will stop working and will not inspect GTP packets.

Starting in Junos OS Release 15.1X49-D40 and Junos OS Release 17.3R1, the central point architecture is enhanced. Enhancements are as follows:

• Prevent GTP-C packet drop issues during the SGSN handover.

• Support the GTP-C message rate-limiting to protect the GGSN from flooding of GTP-C messages.

• Distribute GTP-C and GTP-U traffic handled by a GGSN and SGSN pair on all SPUs by switching to tunnel-based session distribution in which the GTP-C and GTP-U traffic of different tunnels is spread across different SPUs. Use the enable-gtpu-distribution command to enable GTP-C or GTP-U session distribution.

• GTP Tunnel Management
• GSN
• Path Object Management