Operation Guide for Security NEs Management

Transcription

1 imanager U2000 Unified Network Management System V100R002C01 Operation Guide for Security NEs Management Issue 03 Date HUAWEI TECHNOLOGIES CO., LTD.

2

3 2010. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of Huawei Technologies Co., Ltd. Trademarks and Permissions and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd. All other trademarks and trade names mentioned in this document are the property of their respective holders. Notice The purchased products, services and features are stipulated by the contract made between Huawei and the customer. All or part of the products, services and features described in this document may not be within the purchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information, and recommendations in this document are provided "AS IS" without warranties, guarantees or representations of any kind, either express or implied. The information in this document is subject to change without notice. Every effort has been made in the preparation of this document to ensure accuracy of the contents, but all statements, information, and recommendations in this document do not constitute the warranty of any kind, express or implied. Huawei Technologies Co., Ltd. Address: Website: Huawei Industrial Base Bantian, Longgang Shenzhen People's Republic of China i

4

5 imanager U2000 Unified Network Management System About This Document About This Document Related Version The following table lists the product version related to this document. Product Name imanager U2000 Version V100R002C01 Intended Audience This document describes the functions of and the operation procedures, steps, and precautions for the Security NE Explorer. This document is intended for: Installation and Commissioning Engineer Network Monitoring Engineer Data Configuration Engineer System Maintenance Engineer NM Administrator Symbol Conventions The symbols that may be found in this document are defined as follows. Symbol Description DANGER WARNING Indicates a hazard with a high level of risk, which if not avoided, will result in death or serious injury. Indicates a hazard with a medium or low level of risk, which if not avoided, could result in minor or moderate injury. iii

6 About This Document imanager U2000 Unified Network Management System Symbol Description CAUTION Indicates a potentially hazardous situation, which if not avoided, could result in equipment damage, data loss, performance degradation, or unexpected results. TIP NOTE Indicates a tip that may help you solve a problem or save time. Provides additional information to emphasize or supplement important points of the main text. Command Conventions The command conventions that may be found in this document are defined as follows. Convention Boldface Italic Description The keywords of a command line are in boldface. Command arguments are in italics. [ ] Items (keywords or arguments) in brackets [ ] are optional. { x y... } Optional items are grouped in braces and separated by vertical bars. One item is selected. [ x y... ] Optional items are grouped in brackets and separated by vertical bars. One item is selected or no item is selected. { x y... } * Optional items are grouped in braces and separated by vertical bars. A minimum of one item or a maximum of all items can be selected. [ x y... ] * Optional items are grouped in brackets and separated by vertical bars. Several items or no item can be selected. GUI Conventions The GUI conventions that may be found in this document are defined as follows. Convention Boldface Description Buttons, menus, parameters, tabs, window, and dialog titles are in boldface. For example, click OK. > Multi-level menus are in boldface and separated by the ">" signs. For example, choose File > Create > Folder. iv

7 imanager U2000 Unified Network Management System About This Document Change History Updates between document issues are cumulative. Therefore, the latest document issue contains all updates made in previous issues. Changes in Based on Product Version V100R002C01 The third commercial release has the following changes: Some bugs in the manual of the previous version are fixed. Changes in Issue 02 ( ) Based on Product Version V100R002C01 The second commercial release has the following changes: Some bugs in the manual of the previous version are fixed. Changes in Issue 01 ( ) Based on Product Version V100R002C01 Initial commercial release. Chapter 6 SPU System to Chapter 14 License Management These chapters are added to describe how to manage the SIG series NEs through the U2000. Changes in Issue 01 ( ) Based on Product Version V100R002C00 Initial commercial release. The manual name is changed from U2000 Operation Guide (Managing Security NEs) to U2000 Operation Guide for Security NE Management. Chapter 4 GTP Management This chapter is added to describe how to transmit the packets through GTP on the GPRS networks. Chapter 5 Ethernet Service Networking This chapter is added to describe how to access NEs in the topology view of the U2000 through Telnet or SSH, and how to check the NE connectivity trough the ping, or tracert. Changes in Issue 02 ( ) Based on Product Version V100R001C00 The initial commercial release has the following changes: Some bugs in the manual of the previous version are fixed. Changes in Issue 01 ( ) Based on Product Version V100R001C00 Initial field trial release. v

8

9 imanager U2000 Unified Network Management System Contents Contents About This Document...iii 1 Setting Telnet/STelnet Parameters Configuring a Telnet/STelnet Parameter Template Setting Telnet/STelnet Parameters with a Template Manually Modifying Equipment Telnet/STelnet Parameters Managing Devices Viewing System Information Viewing Memory Information Viewing CPU Information Viewing Hard Disk Information Viewing SPU Information Viewing NE Status NE Panel Management Viewing the NE Panel Synchronizing NE Panel Information Viewing NE Alarms Viewing Board Alarms Viewing Port Alarms Monitoring the Real-time Performance of a Board Restarting a Board Switching the Active/Standby Status of a Control Board Viewing General NE Information Viewing General Board Information Viewing General Port Information Viewing Board Information Interface Management Interface Management Overview Interface Management Functions Basic Concepts General Configurations of Interfaces Configuring Interface Information Enabling or Disabling an Interface vii

10 Contents imanager U2000 Unified Network Management System Monitoring Real-time Performance of an Interface Configuring the Ethernet Interface Creating an Ethernet Subinterface GTP Management GTP Overview GTP Configuration Process Configuring GTP Global Parameters Configuring GTP Policies Configuring the Application of GTP Policies in Interzones Configuration Example Example for Configuring the GTP Policy Example for Configuring Defense Against GTP Overbilling Attacks Accessing NEs Through a Tool Ping Tracert Telnet SSH SPU System Viewing SPU System Information Viewing SPU Resource Information Viewing SPS Repository Viewing SPS Blacklist/Whitelist Service Management UCDB Management UCSS Management Component Management Web Management SGMS Management Policy Management BIS Management DAS Management ETL Management DB Management UPS Management Node Management Policy Management Viewing Policy Synchronization Status Viewing Policy Delivering Status Viewing User Policy Status Cluster Management viii

11 imanager U2000 Unified Network Management System Contents 10.1 Viewing DB Cluster Status Viewing Cluster Node Viewing Cluster SAS System Viewing Cluster User and Link Mapping Table Viewing Service Component Update Management Viewing Update Status Connection Management Viewing Connection Status Links Management Viewing Bypass Link Viewing Service Link Viewing SPS and UCSS Link License Management Viewing License Information ix

12

13 imanager U2000 Unified Network Management System Figures Figures Figure 4-1 Structure of the GPRS/TD-SCDMA/WCDMA network Figure 4-2 Flowchart of configuring the GTP function Figure 4-3 Networking diagram of configuring the GTP policy Figure 4-4 Networking diagram of configuring the defense against GTP overbilling attacks xi

14

15 imanager U2000 Unified Network Management System Tables Tables Table 4-1 Network topology planning Table 4-2 Apply the GTP policy in interzone from trust to untrust Table 4-3 Apply the GTP policy in interzone from untrust to trust xiii

16

17 imanager U2000 Unified Network Management System 1 Setting Telnet/STelnet Parameters 1 Setting Telnet/STelnet Parameters About This Chapter This topic describes how to set Telnet/STelnet parameters. Setting Telnet/STelnet parameters is the prerequisite for NE management. 1.1 Configuring a Telnet/STelnet Parameter Template This topic describes how to configure a Telnet/STelnet parameter template. With the Telnet/ STelnet parameter template, you can set the Telnet/STelnet parameters for multiple equipment at the same time. 1.2 Setting Telnet/STelnet Parameters with a Template This topic describes how to use a template to set the Telnet/STelnet parameters of the U2000 for the communication with equipment. 1.3 Manually Modifying Equipment Telnet/STelnet Parameters This topic describes how to manually modify equipment Telnet/STelnet parameters. 1-1

18 1 Setting Telnet/STelnet Parameters imanager U2000 Unified Network Management System 1.1 Configuring a Telnet/STelnet Parameter Template This topic describes how to configure a Telnet/STelnet parameter template. With the Telnet/ STelnet parameter template, you can set the Telnet/STelnet parameters for multiple equipment at the same time. Step 5 Step 6 Choose Administration > NE Communicate Parameter > NE Telnet/STelnet Template Management from the Main Menu. In the dialog box that is displayed, click Create. Click OK after setting Protocol Name and Template Name in the New Template dialog box. To configure a Telnet parameter template, set Protocol Name to Telnet. To configure an STelnet parameter template, set Protocol Name to STelnet. In the Details group box of the Telnet/STelnet Template Management dialog box, configure the Telnet/STelnet parameter template. Click Apply. The Telnet/STelnet parameter template is configured. Click OK. The dialog box is closed. 1.2 Setting Telnet/STelnet Parameters with a Template This topic describes how to use a template to set the Telnet/STelnet parameters of the U2000 for the communication with equipment. Prerequisite Context The related parameters, such as the user name and password, must be set on equipment. The Telnet/STelnet template must be configured on the U2000. Security authentication modes are not adopted for the Telnet mode. Packets are transmitted through TCP in plain text, which brings security risks. The U2000 adopts STelnet to reduce security risks, using SSH features to ensure security and effective authentication. In the topology navigation tree or the topology view, select the device whose Telnet/STelnet parameters need to be set. Choose Administration > NE Communicate Parameter > Set NE Telnet/STelnet Parameter from the Main Menu. 1-2

19 imanager U2000 Unified Network Management System 1 Setting Telnet/STelnet Parameters NOTE You can also right-click the selected equipment and then choose Set NE Telnet/STelnet Parameter from the shortcut menu. In the Device Telnet/STelnet Parameter Management dialog box, click Import. Step 5 Step 6 In the Select Telnet/STelnet Template dialog box, select the template to be used, and then click OK. Click Test. If the message indicating successful test is displayed, click OK. If the message indicating test failure is displayed, modify the settings of the Telnet/STelnet parameters according to the prompt. Click OK. 1.3 Manually Modifying Equipment Telnet/STelnet Parameters This topic describes how to manually modify equipment Telnet/STelnet parameters. Context In the U2000, you can configure one Telnet parameter template and one STelnet parameter template. If required, you can manually modify the configured templates to set the Telnet/ STelnet parameters for equipment. In the Main Topology, select the equipment whose Telnet/STelnet parameters need to be modified. Choose Administration > NE Communicate Parameter > Set NE Telnet/STelnet Parameter from the Main Menu. 1-3

20 1 Setting Telnet/STelnet Parameters imanager U2000 Unified Network Management System NOTE You can also right-click the selected equipment and then choose Set NE Telnet/STelnet Parameter from the shortcut menu. Step 5 Step 6 In the Details group box of the Device Telnet/STelnet Parameter Management dialog box, modify Telnet/STelnet parameters manually. To modify Telnet parameters: Set Protocol Name to Telnet. To modify STelnet parameters: Set Protocol Name to STelnet. Click Apply. Click Test. If the message indicating successful test is displayed, click OK. If the message indicating test failure is displayed, modify the settings of the Telnet/STelnet parameters according to the prompt. Click OK. 1-4

21 imanager U2000 Unified Network Management System 2 Managing Devices 2 Managing Devices About This Chapter This describes how to maintain devices, such as viewing device information, resetting devices, switching devices, and refreshing the device status. 2.1 Viewing System Information This describes how to view system information of the device, such as the system name, object ID, and device version. 2.2 Viewing Memory Information This describes how to view the memory information about devices. 2.3 Viewing CPU Information This topic describes how to view the CPU information about devices. 2.4 Viewing Hard Disk Information This describes how to view the hard disk information about devices. 2.5 Viewing SPU Information This describes how to view the SPU information about devices. 2.6 Viewing NE Status This describes how to view the status about NEs. 2.7 NE Panel Management A NE panel is an illustration of the front panel of a device. A NE panel displays the running status and alarm status of boards and ports through alarm indicators and legends of different colors. With a NE panel, you can perform operations such as viewing the general information about and alarms of the NE, boards, and ports, viewing the real-time performance of boards and ports, resetting boards and switching the active/standby status of a control board. 2.8 Viewing Board Information This describes how to refresh board information. When you need to synchronize the latest board information from the database to the NMS, you need to use the function of refreshing board information. 2-1

22 2 Managing Devices imanager U2000 Unified Network Management System 2.1 Viewing System Information This describes how to view system information of the device, such as the system name, object ID, and device version. Right-click an NE on the main topology and choose NE Explorer from the shortcut menu. In the service tree, choose Device Management > System Information. On the System Information tab, view the following information: System Name, Object ID, Device Version, Duration, Location, Contact, IP Address, MAC Address, and Description. NOTE You can modify the values of System Name, Location, and Contact. Optional: Click Synchronize to refresh system information displayed on the U Viewing Memory Information This describes how to view the memory information about devices. Context Only the security NEs of the SIG Server, NE40E80E-DPI Server, URL Classify Server, and RADIUS Proxy support this operation. Step 5 Step 6 Right-click an NE on the Main Topology and choose NE Explorer from the shortcut menu. In the Service Tree, choose Device Management > Memory Information. On the Memory Information tab, you can view IP Address, Memory Total Real, Memory Avail Real, Memory Total Swap, and Memory Avail Swap. Right-click the blank space and choose Synchronize from the shortcut menu to synchronize the device memory information. Optional: Click Refresh. Synchronizes the data saved in the NMS database to clients. Right-click a record and choose Monitor Real-time Performance from the shortcut menu, and view the real-time performance indicators in the dialog box that is displayed. 2-2

23 imanager U2000 Unified Network Management System 2 Managing Devices 2.3 Viewing CPU Information Context This topic describes how to view the CPU information about devices. Only the security NEs of the SIG Server, NE40E80E-DPI Server, URL Classify Server, and RADIUS Proxy support this operation. Step 5 Step 6 Right-click an NE on the Main Topology and choose NE Explorer from the shortcut menu. Choose Device Management > CPU Information from the service tree. On the CPU Information tab page, you can view IP Address, Time Space of Load, and Usage. Right-click in the blank area and choose Synchronize from the shortcut menu to synchronize the device CPU information. Optional: Click Refresh. Synchronizes the data saved in the NMS database to clients. Right-click a record and choose Monitor Real-time Performance from the shortcut menu. In the dialog box that is displayed, view the real-time performance indicators. 2.4 Viewing Hard Disk Information Context This describes how to view the hard disk information about devices. Only the security NEs of the SIG Server, NE40E80E-DPI Server, URL Classify Server, and RADIUS Proxy support this operation. Step 5 Right-click an NE on the Main Topology and choose NE Explorer from the shortcut menu. In the Service Tree, choose Device Management > Hard Disk Information. On the Hard Disk Information tab, you can view IP Address, Partition Name, Path, Total Size, Avail Size, and Usage. Right-click the blank space and choose Synchronize from the shortcut menu to synchronize the device hard disk information. Optional: Click Refresh. Synchronizes the data saved in the NMS database to clients. 2-3

24 2 Managing Devices imanager U2000 Unified Network Management System 2.5 Viewing SPU Information This describes how to view the SPU information about devices. Context Only the security NEs of the SIG 9810, SIG 9820, NE40E-DPI and NE80E-DPI support this operation. Step 5 Right-click an NE on the Main Topology and choose NE Explorer from the shortcut menu. In the Service Tree, choose Device Management > SPU Information. On the SPU Information tab, you can view Location, CPU Usage, CPU Threshold, Memory Usage, Memory Usage Threshold, Temperature, and Temperature Threshold. Right-click the blank space and choose Synchronize from the shortcut menu to synchronize the device SPU entity information. Optional: Click Refresh. Synchronizes the data saved in the NMS database to clients. 2.6 Viewing NE Status This describes how to view the status about NEs. Context Only the security NEs of the RADIUS Proxy support this operation. Step 5 Right-click an NE on the Main Topology and choose NE Explorer from the shortcut menu. In the Service Tree, choose Device Management > NE Status. On the NE Status tab, you can view Internal IP Address, External IP Address, Service Port, Status, HA Status, Startup Time, and Number of Online Users. Right-click the blank space and choose Synchronize from the shortcut menu to synchronize the NE status. Optional: Click Refresh. Synchronizes the data saved in the NMS database to clients. 2-4

25 imanager U2000 Unified Network Management System 2 Managing Devices 2.7 NE Panel Management A NE panel is an illustration of the front panel of a device. A NE panel displays the running status and alarm status of boards and ports through alarm indicators and legends of different colors. With a NE panel, you can perform operations such as viewing the general information about and alarms of the NE, boards, and ports, viewing the real-time performance of boards and ports, resetting boards and switching the active/standby status of a control board Viewing the NE Panel This describes how to view the NE panel. You can view the information shown on the NE panel such as the cabinet, board, subcard, and port Synchronizing NE Panel Information This describes how to synchronize NE panel information in NE Explorer. If you want to synchronize the latest NE panel information from a device to the NMS, you need to use the function of synchronizing NE panel information Viewing NE Alarms This describes how to view NE alarms Viewing Board Alarms This describes how to view board alarms Viewing Port Alarms This describes how to view port alarms Monitoring the Real-time Performance of a Board This describes how to monitor the real-time performance of a board. The related performance indicators include temperature, voltage, memory usage, and CPU usage Restarting a Board This describes how to restart a board. Through the NMS, you can restart the SRU board. When the software of a board needs to be updated or a fault occurs on a board, you can reset the board Switching the Active/Standby Status of a Control Board This describes how to perform active/standby switchover on a control board Viewing General NE Information This describes how to view general NE information, such as the NE board, and NE storage space Viewing General Board Information This describes how to view general board information, such as CPU usage, memory usage, voltage, and temperature Viewing General Port Information This describes how to view general port information, such as port configurations Viewing the NE Panel This describes how to view the NE panel. You can view the information shown on the NE panel such as the cabinet, board, subcard, and port. Right-click an NE on the main topology and choose NE Explorer from the shortcut menu. 2-5

26 2 Managing Devices imanager U2000 Unified Network Management System The NE Panel tab is displayed. Optional: If you are currently visiting other tabs on the NE Explorer tab, you can choose Device Management > NE Panel from the navigation tree to access the NE Panel tab. The information on the NE Panel tab is as follows: The device information shown in the NE panel includes the cabinet, board, subcard, and port. The colors of the board indicate the running statuses of these objects. The colors of the alarm indicators for the board, power supply, and fan indicate the alarm statuses of these objects but do not indicate the alarm status of the port. The colors of the port indicate the port status. When the administrative status of a port is Down, the color of the port is grey. When the administrative status of a port is Up, the color of the port indicates the alarm status of the port. When the administrative status of a port is Up, the operating status of the port is Down. When there is no alarm, both the color of the port and that of the critical alarm are red. Click the Legend tab to the right of the panel for details. The empty slot is displayed as grayed out. When viewing the device panel, you can click the bar in the panel to view the back frame. The standby board is marked with the letter (S) to differentiate from the control board. The board view does not contain screws. Select a port in the panel. Information about the port is then displayed on the Port Information tab. NOTE If the ports exist on the board, you can access the Port Information tab by double-clicking a board Synchronizing NE Panel Information This describes how to synchronize NE panel information in NE Explorer. If you want to synchronize the latest NE panel information from a device to the NMS, you need to use the function of synchronizing NE panel information. Right-click an NE on the main topology and choose NE Explorer from the shortcut menu. The NE Panel tab is displayed. Optional: If you are currently visiting other tabs on the NE Explorer tab, you can choose Device Management > NE Panel from the navigation tree to access the NE Panel tab. Click Synchronize Viewing NE Alarms This describes how to view NE alarms. 2-6

27 imanager U2000 Unified Network Management System 2 Managing Devices Right-click an NE on the main topology and choose NE Explorer from the shortcut menu. The NE Panel tab is displayed. Optional: If you are currently visiting other tabs on the NE Explorer tab, you can choose Device Management > NE Panel from the navigation tree to access the NE Panel tab. Right-click a board in the NE panel and choose View Alarm from the shortcut menu, or rightclick a frame and choose View Alarm from the shortcut menu. The Current Alarms window is displayed. You can view all the current alarms related to the selected NE Viewing Board Alarms This describes how to view board alarms. Right-click an NE on the main topology and choose NE Explorer from the shortcut menu. The NE Panel tab is displayed. Optional: If you are currently visiting other tabs on the NE Explorer tab, you can choose Device Management > NE Panel from the navigation tree to access the NE Panel tab. Right-click a board in the NE panel and choose View Alarm from the shortcut menu. The Current Alarms window is displayed. You can view all the current alarms related to the selected board Viewing Port Alarms This describes how to view port alarms. Right-click an NE on the main topology and choose NE Explorer from the shortcut menu. The NE Panel tab is displayed. Optional: If you are currently visiting other tabs on the NE Explorer tab, you can choose Device Management > NE Panel from the navigation tree to access the NE Panel tab. Right-click a port in the NE panel and choose View Alarm from the shortcut menu. The Current Alarms window is displayed. You can view all the current alarms related to the selected port Monitoring the Real-time Performance of a Board This describes how to monitor the real-time performance of a board. The related performance indicators include temperature, voltage, memory usage, and CPU usage. 2-7

28 2 Managing Devices imanager U2000 Unified Network Management System Prerequisite Before monitoring real-time performance or querying performance data, please make sure that the version of SNMP protocol is SNMPv2c or higher when creating NEs. Otherwise, the NMS cannot properly collect the performance data. Right-click an NE on the main topology and choose NE Explorer from the shortcut menu. The NE Panel tab is displayed. Optional: If you are currently visiting other tabs on the NE Explorer tab, you can choose Device Management > NE Panel from the navigation tree to access the NE Panel tab. Right-click the board to be monitored and choose Monitor Real-time Performance from the shortcut menu. On the Real-Time Performance tab, set the related parameters, and then view the real-time performance graph. NOTE Restarting a Board When viewing real-time performance for the first time, you need to select the real-time performance indicators, and then click OK. This describes how to restart a board. Through the NMS, you can restart the SRU board. When the software of a board needs to be updated or a fault occurs on a board, you can reset the board. Prerequisite The device is configured with Telnet or STelnet parameters. Information on the device is synchronized to the NMS. Context CAUTION In most cases, do not restart a board, because the network related to the board will be Down for a while. When you restart a board, do not perform hot swap for the board. Only SIG9800, USG9100 and Euedmon 8000E devices support the function of restarting a board. Right-click an NE on the main topology and choose NE Explorer from the shortcut menu. The NE Panel tab is displayed. 2-8

29 imanager U2000 Unified Network Management System 2 Managing Devices Optional: If you are currently visiting other tabs on the NE Explorer tab, you can choose Device Management > NE Panel from the navigation tree to access the NE Panel tab. Select the board to be restarted on the NE panel, right-click it, and then select Reset Board. Click OK in the Confirm dialog box. Postrequisite If the status of the board is still offline after the board is reset for 10 minutes, click Synchronize in the lower part of the NE panel to manually synchronize the status of the NE panel. The status of the board cannot be refreshed when the configurations of other modules are being synchronized Switching the Active/Standby Status of a Control Board This describes how to perform active/standby switchover on a control board. Prerequisite The standby control board is available on the device. Telnet or STelnet parameters are set on the NMS for accessing the device. Device configurations are synchronized to the NMS. Only the security NEs of the SIG 9810, SIG 9820, NE40E-DPI and NE80E-DPI support the function of switching the active/standby status of a control board. Right-click an NE on the main topology and choose NE Explorer from the shortcut menu. The NE Panel tab is displayed. Optional: If you are currently visiting other tabs on the NE Explorer tab, you can choose Device Management > NE Panel from the navigation tree to access the NE Panel tab. Right-click the desired standby control board in the NE panel and choose Switch Active/ Standby Board from the shortcut menu. In the Confirm dialog box, click OK Viewing General NE Information Context This describes how to view general NE information, such as the NE board, and NE storage space. The general information about an NE can be viewed through the following shortcut menu items: View NE Version View NE Board and Subcard View NE Clock 2-9

30 2 Managing Devices imanager U2000 Unified Network Management System View NE Storage Space View NE System Resource Usage NOTE The following takes the View NE Version item as an example to describe how to view general NE information. Right-click an NE on the main topology and choose NE Explorer from the shortcut menu. The NE Panel tab is displayed. If you are currently visiting other tabs on the NE Explorer tab, you can choose Device Management > NE Panel from the navigation tree to access the NE Panel tab. Right-click a frame in the NE panel and choose View NE Version from the shortcut menu. NOTE You can also view general NE information by the following operations. Right-click a board in the NE panel and choose NE Name > View NE Version. Optional: In the Display NE Version dialog box, click Save to save the queried NE version information to a local NE Viewing General Board Information This describes how to view general board information, such as CPU usage, memory usage, voltage, and temperature. Context The general information about a board can be viewed through the following shortcut menu items: View Board Information View Board CPU View Board Memory View Board Voltage View Board Temperature NOTE The general information varies according to board types. The following takes the View Board Information item as an example to describe how to view general board information. Right-click an NE on the main topology and choose NE Explorer from the shortcut menu. The NE Panel tab is displayed. If you are currently visiting other tabs on the NE Explorer tab, you can choose Device Management > NE Panel from the navigation tree to access the NE Panel tab. 2-10

31 imanager U2000 Unified Network Management System 2 Managing Devices Right-click a board in the NE panel and choose View Board Information from the shortcut menu. Optional: In the View Board Information dialog box, click Save to save the queried board information to a local device Viewing General Port Information This describes how to view general port information, such as port configurations. Context The general information about a port can be viewed through the following shortcut menu items: View Port Information View Current Port Configurations NOTE The following takes the View Port Information item as an example to describe how to view general interface information. Right-click an NE on the main topology and choose NE Explorer from the shortcut menu. The NE Panel tab is displayed. If you are currently visiting other tabs on the NE Explorer tab, you can choose Device Management > NE Panel from the navigation tree to access the NE Panel tab. Right-click a port in the NE panel and choose View Port Information from the shortcut menu. Optional: In the View Port Information dialog box, click Save to save the queried port information to a local device. 2.8 Viewing Board Information This describes how to refresh board information. When you need to synchronize the latest board information from the database to the NMS, you need to use the function of refreshing board information. Context If you want to obtain the latest board information from a device, it is recommended that you synchronize the NE panel information before refreshing board information. For details about how to synchronize the NE panel information, see Synchronizing NE Panel Information. Right-click an NE on the main topology and choose NE Explorer from the shortcut menu. 2-11

32 2 Managing Devices In the service tree, expand Device Management, and then click Board Information. Click Refresh. imanager U2000 Unified Network Management System The query result area displays the latest board information. Select a board record in the query result area. The details about this board are displayed in the detailed information area. 2-12

33 imanager U2000 Unified Network Management System 3 Interface Management 3 Interface Management About This Chapter Interface management includes configuring the interface information and Ethernet interface. 3.1 Interface Management Overview This describes the functions provided by interface management and the related basic concepts. 3.2 General Configurations of Interfaces This describes the operations on the general configurations of interfaces, including enabling and disabling interfaces, viewing the real-time performance of interfaces, and configuring interface information. 3.3 Configuring the Ethernet Interface This describes how to configure an Ethernet interface, including the general information and IP address. You need to configure the Ethernet interface if you use the Ethernet to transmit packets. 3.4 Creating an Ethernet Subinterface This describes how to create an Ethernet subinterface. Setting the parameters of an Ethernet subinterface is similar to creating a subinterface. The following takes the creation of an Ethernet subinterface as an example to describe the operation procedure. 3-1

34 3 Interface Management imanager U2000 Unified Network Management System 3.1 Interface Management Overview This describes the functions provided by interface management and the related basic concepts Interface Management Functions This describes the functions provided by interface management Basic Concepts This describes basic concepts of the Ethernet interface Interface Management Functions This describes the functions provided by interface management. The NMS provides Ethernet interface of configuring. Device interface include physical interfaces and logical interfaces. Physical interfaces are on the corresponding physical components and exist actually. Logical interfaces can perform data exchange. They, however, do not exist physically and must be created through configuration. NOTE Basic Concepts Interface Overview The NMS Interface management is adapted to different NEs: The functions that are not supported on the NEs are set to unavailable or hidden in the interface management window. Move the mouse pointer to a text box. A prompt is displayed, indicating the related value range. This describes basic concepts of the Ethernet interface. Through the interface, an NE can exchange data and interact with other NEs on the network. The interface can be divided into two types: Physical interfaces Logical interfaces Physical interfaces have corresponding physical components and exist actually. Logical interfaces realize data exchange but do not physically exist and need to be configured. Logical interfaces include the following: Sub-interfaces Loopback interfaces Basic Concepts of Subinterface Generally, one physical interface can be configured with only one IP address. In a point-to-point connection, one IP address can meet the requirements of applications. If the link layer of an interface supports the multiplexing of multiple connections, one IP address may also meet the 3-2

35 imanager U2000 Unified Network Management System 3 Interface Management requirements. For example, when the frame relay (FR) supports multiple virtual connections and if the peer network and local IP addresses of these virtual connections are in the same network segment, one IP address is enough. If the peers of virtual connections are, however, in different network segments, one IP address on the interface cannot meet the requirements of applications. In this case, a sub-interface must be used. The sub-interface supports multiple logical interfaces or network interconnecting on one physical interface, that is, connecting multiple interfaces to one physical interface. These logical interfaces share the configuration parameters with the physical interface, though they have their own configuration parameters on the link layer and the network layer. Basic Concepts of Ethernet Interface Ethernet Interface The LAN includes the Ethernet and token ring network. Characterized by flexible, simple, and easy implementation, the Ethernet becomes the most important LAN networking technology. The conventional Ethernet interface complies with 10Base-T physical layer specifications and operates with a rate of 10 Mbit/s. The fast Ethernet (FE) interface complies with 100Base-TX physical layer specifications and is compatible with the 10Base-T standard on the physical layer. The Gigabit Ethernet interface complies with 1000Base-TX physical layer specifications and is compatible with the 10Base-T and 100Base-TX standards on the physical layer. MTU The Maximum Transmission Unit (MTU) refers to the length of the load in a frame, expressed in bytes. The specific MTU value range of an Ethernet interface is determined by the specific NE. On an Ethernet, MTU is generally divided into MTU in the receiving direction and MTU in the receiving direction. The length of Ethernet frames is controlled to be less than the length of MTU in the receiving direction. When the frame length exceeds the value, the packets are discarded. Working Mode Rate An Ethernet interface may work in either of the following modes: Half-duplex mode Each station can receive and send packets, but the station cannot receive or send packets at the same time. When one station is sending packets, the other station can only receive packets. In half-duplex mode, no matter which station starts transmission, the whole link bandwidth is occupied. Full-duplex mode Two stations can receive and send packets at the same time. In full-duplex mode, two stations share the link bandwidth. Auto-negotiation mode In auto-negotiation mode, a station can negotiate with other network NEs to select the most appropriate working mode and rate. Thus, the configuration and management of the system are greatly simplified. The Ethernet electrical interface supports multiple rates. The FE electrical interface supports the rate at 10 Mbit/s and 100 Mbit/s. The FE optical interface supports only the rate at 100 Mbit/s. The GE optical interface supports the rate at 1000 Mbit/s, 2.5Gbit/s and 3-3

36 3 Interface Management imanager U2000 Unified Network Management System 10Gbit/s, and the rate cannot be configured. Thus, only the Ethernet electrical interface needs to be configured. The default rate of the FE electrical interface is 100 Mbit/s. Select the auto-negotiation mode, which is also called the auto-sensing mode, to configure the rate. 3.2 General Configurations of Interfaces This describes the operations on the general configurations of interfaces, including enabling and disabling interfaces, viewing the real-time performance of interfaces, and configuring interface information Configuring Interface Information This describes how to configure general information about or the IP address of an interface Enabling or Disabling an Interface When the interface service is configured, you can set Administrative Status to Up to enable the service on the interface Monitoring Real-time Performance of an Interface This describes how to monitor the real-time performance of an Ethernet interface Configuring Interface Information Prerequisite This describes how to configure general information about or the IP address of an interface. The data of the related interface module must be synchronized to the U2000. Right-click the NE in the Main Topology and choose NE Explorer from the shortcut menu. Choose Interface Management > Interface Information from the service tree. Click Condition. In the Set Filter Condition dialog box, set the query conditions and then click OK. NOTE If you want to query all records, directly click Query without setting the query conditions. Step 5 Step 6 Step 7 After you click Query, all the records that meet the set query conditions are displayed. In the query result area, select the interface to be configured. On the Interface Information tab, click Configure. In the Modify Interface Information dialog box, you can set related parameters. Click the General tab. Then, set Interface Description. Click the IP Address tab. Then, set IP Address. NOTE If the interface is a Layer 2 interface, the IP address of the interface cannot be set. 3-4

37 imanager U2000 Unified Network Management System 3 Interface Management Step 8 Click OK. The dialog box is closed. The information about the modified interface is displayed in the query result area Enabling or Disabling an Interface When the interface service is configured, you can set Administrative Status to Up to enable the service on the interface. Prerequisite The data of the related interface module must be synchronized to the U2000. Context When a physical interface is idle or not connected to a cable, you need to disable the interface to avoid the interface anomaly caused by interference. Right-click the NE in the Main Topology and choose NE Explorer from the shortcut menu. Choose Interface Management > Interface Information from the service tree. Click Condition. In the Set Filter Condition dialog box, set the query conditions and then click OK. NOTE If you want to query all records, directly click Query without setting the query conditions. Step 5 After you click Query, all the records that meet the set query conditions are displayed. In the query result area, select the interface to be enabled or disabled and perform one of the following operations: Right-click the selected interface and select Up on the shortcut menu to enable the interface. Right-click the selected interface and select Down on the shortcut menu. In the Confirm dialog box that is displayed, click OK to disable the interface Monitoring Real-time Performance of an Interface This describes how to monitor the real-time performance of an Ethernet interface. Prerequisite The data of the related interface module must be synchronized to the U2000. Before monitoring real-time performance or querying performance data, please make sure that the version of SNMP protocol is SNMPv2c or higher when creating NEs. Otherwise, the NMS cannot properly collect the performance data. 3-5

38 3 Interface Management imanager U2000 Unified Network Management System Right-click the NE in the Main Topology and choose NE Explorer from the shortcut menu. The NMS provides real-time performance for the Ethernet interface. To monitor real-time performance of an interface, do as follows: Expand Interface Management in the service tree, and then click Interface Information. You can monitor the real-time performance of all the interfaces that support this function. In the query result area, select the interface to be monitored and right-click it. Then, select Monitor Real-Time Performance on the shortcut menu. On the Real-Time Performance tab, set related parameters, and then view the real-time performance graph. NOTE When viewing real-time performance for the first time, you need to select the real-time performance indicators. Then click OK. 3.3 Configuring the Ethernet Interface This describes how to configure an Ethernet interface, including the general information and IP address. You need to configure the Ethernet interface if you use the Ethernet to transmit packets. Prerequisite The data of the related interface module must be synchronized to the U2000. Ethernet interfaces exist on the NE and are supported by the NE. Context When you configure the Ethernet interface, note that except for the IP address of the interface, all the parameters have default values. If you need to modify the default values, make sure that the changed values are consistent with the corresponding values on the peer NE. Right-click the NE in the Main Topology and choose NE Explorer from the shortcut menu. Choose Interface Management > Ethernet Interface from the service tree. Click Condition. In the Set Filter Condition dialog box, set the query conditions and then click OK. NOTE If you want to query all records, directly click Query without setting the query conditions. Step 5 Step 6 After you click Query, all the records that meet the set query conditions are displayed. In the query result area, select the interface to be configured. Click Configure. 3-6

39 imanager U2000 Unified Network Management System 3 Interface Management Step 7 In the Configure Ethernet Interface dialog box, you can set corresponding parameters as required. Click the General tab. Then, set Interface Description. Click the Physical Feature tab. Then, set Work Mode and Rate. Click the Ethernet Feature tab. Then, set the user termination mode, interface layer, and MTU. For the configurations on a PE, set the IP address and MAC address of the Ethernet interface connecting to the CE and set whether to enable broadcast. Click the IP Address tab. Then, set parameters, such as the IP address of the interface. NOTE If the layer of the interface is Layer 2, the IP address of the interface cannot be set. Step 8 Click OK. The dialog box is closed. The information about the modified interface is displayed in the query result area. 3.4 Creating an Ethernet Subinterface This describes how to create an Ethernet subinterface. Setting the parameters of an Ethernet subinterface is similar to creating a subinterface. The following takes the creation of an Ethernet subinterface as an example to describe the operation procedure. Prerequisite The data of the related interface module must be synchronized to the U2000. Ethernet interfaces and Ethernet subinterfaces exist on the NE and Ethernet subinterfaces are supported by the NE. Context After subinterfaces are added, the interface layer cannot be configured. Right-click the NE in the Main Topology and choose NE Explorer from the shortcut menu. Choose Interface Management > Ethernet Interface from the service tree. On the Ethernet Interface tab, click Create. NOTE After creation, you can also select the subinterface to be configured in the query result area and then click Configure to modify the created subinterface. In the Create Ethernet Subinterface dialog box, you can set corresponding parameters as required. Click the General tab. Then, setsubinterface No. and Subinterface Description. Click the Subinterface Feature tab. Then, set termination mode for the subinterface. Click the IP Address tab. Then, set the IP address of the subinterface. 3-7

40 3 Interface Management imanager U2000 Unified Network Management System Click the Advanced tab. Then, set the MTU of the subinterface. For the configurations on a PE, set the IP address and MAC address of the interface connecting to the CE and set whether to enable broadcast. Step 5 Optional: Click Apply. The subinterface is added. You can add more subinterfaces. After the setting, click Apply. The information about the new subinterface is displayed in the query result area. Step 6 Click OK. The dialog box is closed. 3-8

41 imanager U2000 Unified Network Management System 4 GTP Management 4 GTP Management About This Chapter This describes how to set the parameters of the GTP in the U2000, thus implement the function of GTP management. NOTE Currently, only the security NEs of the E8080E/8160E V100R001C05 and USG9310/9320 V100R001C05 support this function in the U GTP Overview GPRS Tunneling Protocol (GTP) is the interface protocol between GSN nodes on GPRS networks. Through GTP, packets on the GPRS networks can be transmitted. 4.2 GTP Configuration Process This topic describes the process of configuring the GTP function. 4.3 Configuring GTP Global Parameters This topic describes how to configure GTP global parameters. In GTP management, it is optional to set GTP global parameters. 4.4 Configuring GTP Policies This topic describes how to configure GTP policies. With GTP policies, security NEs can filter GTP packets according to various rules, thus implementing security protection on the GPRS network. GTP policies support message content filtering, message type filtering, message information element (IE) filtering, extended filtering, and packet log filtering. 4.5 Configuring the Application of GTP Policies in Interzones This topic describes how to configure the application of GTP policies in interzones. After a GTP policy is configured, you must apply it in interzones so that the policy can take effect. You can apply only one policy in each direction of the interzone. 4.6 Configuration Example This describes the example for configuring GTP, including the examples for configuring the GTP policy and configuring the defense against GTP overbilling attacks. 4-1

42 4 GTP Management imanager U2000 Unified Network Management System 4.1 GTP Overview GPRS Overview GPRS Tunneling Protocol (GTP) is the interface protocol between GSN nodes on GPRS networks. Through GTP, packets on the GPRS networks can be transmitted. With the evolution of the 3rd Generation Partnership Project (3GPP), the mobile communications networks and their services change all the time. Mobile communications networks 2G Global System for Mobile Communications (GSM) evolves to 2.5G General Packet Radio Service (GPRS) and then to 3G Universal Mobile Telecommunications System (UMTS). The mobile communications network realizes the integration of wide area coverage, high-speed wireless data transmission, and Internet. Provided services Provides diversified services such as voice, data, and video, meeting the requirements of users to communicate with each other in multiple modes. GPRS is the 2.5G network developed based on the GSM network to support packet services. Time Division-Synchronous Code Division Multiple Access (TD-SCDMA)/ Wideband Code Division Multiple Access (WCDMA) is the 3G network and supports Circuit Switching (CS) and Packet Switching (PS) services. TD-SCDMA/WCDMA packet domain has the same structure as the GPRS network. Figure 4-1 shows the structure of the GPRS/TD-SCDMA/WCDMA network. There are a series of devices in the core network CS domain but not listed in Figure 4-1. Figure 4-1 Structure of the GPRS/TD-SCDMA/WCDMA network RAN GSM/GPRS BSS BTS BSC CN-CS SS7 PSTN, ISDN MS UTMS UTRAN NodeB RNC Billing Center Other PLMN FW SGSN BG Core Network DNS Server CG GGSN CN-PS FW DNS Server Internet, Intranet PDN WAP Gateway AAA Server MS: Mobile Station CN-CS: Core Network-Circuit Switching RAN: Radio Access Network CN-PS: Core Network-Packet Switching 4-2

43 imanager U2000 Unified Network Management System 4 GTP Management BSS: Base Station System BTS: Base Transceiver Station NodeB: UMTS base station SS7: CCITT Signaling System No.7 SGSN: Serving GPRS Support Node BG: Border Gateway DNS Server UTRAN: Universal Terrestrial Radio Access Network BSC: Base Station Controller RNC: Radio Network Controller CG: Charging Gateway GGSN: Gateway GPRS Support Node Billing Center WAP Gateway: Wireless Access Protocol Gateway FW: Firewall PDN: Public Data Network AAA Server: authentication, authorization, and accounting server PLMN: Public Land Mobile Network On the GPRS network, data from the mobile phone need to pass the MS, BSS, SGSN, and GGSN to reach the Internet. The functions of these four devices are as follows: MS MS is a device of the mobile user, and can initiate and receive calls through the air interface. When data services are implemented, the MS establishes a logical link with the CN-PS. BSS The BSS includes a series of devices. The BSS is in charge of allocating air channel resources. Information is forwarded between the MS and SGSN. SGSN SGSN is a new element device that provides the packet service and is mainly used to forward input/output IP packets for the MSs in the local SGSN service area. SGSN mainly provides the routing and forwarding, encryption and authentication, session management, mobility management, logical link management, and generation and output of accounting information for user packets. GGSN GGSN is a new element device that provides the packet service. It also provides the routing and encapsulation of data packets between GPRS/TD-SCDMA/WCDMA networks and external data networks. GGSN is the gateway where the MS is connected to the external packet network. From the external network, GGSN is similar to a router of all user IP addresses on the addressable GPRS/TD-SCDMA/WCDMA network. GGSN receives the data sent by MSs, selects routes to the corresponding external network, or receives the data from the external network and selects the transmission tunnel on the GPRS/TD-SCDMA/WCDMA network according to the destination IP address, and sends the data to the corresponding SGSN. GTP Overview The GPRS network is a bearer network reconstructed through the adding of network elements, such as SGSNs and GGSNs to the current GSM network. These network elements are called GPRS Supporting Nodes (GSNs). To ensure the communications between the added network elements, and between the network elements and other networks, data interfaces including Gb, Gn, Gp, and Gi interfaces and signaling interfaces including Gr, Gs, Gd, and Gf interfaces are added. In the application scenario of the security NEs, pay special attention to Gn, Gp, and Gi interfaces. 4-3

44 4 GTP Management imanager U2000 Unified Network Management System Gn Gp Gi Interface between different GSNs in the same PLMN. The Gn interface runs the GTP protocol to ensure the interconnection between the SGSN and GGSN in the same PLMN. Interface between the GSNs on different PLMNs to realize the data roaming service between different PLMNs. The Gp interface runs the GTP protocol to ensure the interconnection between the SGSN and GGSN on different PLMNs. Interface between the GGSN and PDN. The Gi interface realizes the interconnection between the GPRS network and external data network. The Gi interface runs the IP protocol to ensure the data transmission between the GGSN and external network. GTP is a tunneling protocol defined for the Gn and Gp interfaces to support data communications between GSNs. GTP is based on UDP, including the GTP-C and GTP-U. GTP-C On the GTP-C, the signaling mechanism is adopted to create, modify, and delete channels. GTP-U On the GTP-U, the tunnel mechanism is adopted to transmit the data packets of users. GTP includes two versions, namely, Version 0 and Version 1. GTP Version 0 belongs to 3GPP Release 98, and is used on the GPRS network. GTP Version 1 belongs to 3GPP Release 99, and is used on the 3G network. GTP Version 1 is compatible with GTP Version 0. They can be classified through the values of the version fields of the headers of GTP packets. In addition, GTP includes GTP' used for charging. Application of the Security NEs on the CN-PS The GTP-C and GTP-U adopt various messages for packet interaction, for example: Path management messages Tunnel management messages Location management messages Mobility management messages Information elements The data services of the GPRS network are carried by the GTP tunnel. Thus, the security NEs mainly applies to resolving GTP, and filters the GTP packet according to the pre-configured rule. Thus, the security of the GPRS network is ensured. The following applications are available for the security NEs on the CN-PS: The security NE works on the Gn interface. It filters malicious packets, thus ensuring the security of NEs on the same PLMN. The security NE works on the Gp interface. When a PLMN connects with other PLMNs, malicious packets from other PLMNs are filtered out, thus ensuring the security of NEs on the PLMN. The security NE works on the Gi interface. When a PLMN connects with the external IP network, malicious packets from the external IP network are filtered out, thus ensuring the security of NEs on the PLMN. 4-4

45 imanager U2000 Unified Network Management System 4 GTP Management The security NE defends against GTP overbilling attacks. When interfaces on the security NE work in routing or transparent mode, GTP is supported. NOTE Currently, the U2000 manages the GTP function on only the Eudemon 8080E/8160E and USG9310/ GTP Configuration Process This topic describes the process of configuring the GTP function. Figure 4-2 shows the process of configuring the GTP function. Figure 4-2 Flowchart of configuring the GTP function Configure global parameters Configure GTP policy Apply policy in interzone Required Optional Configure basic information Configure message content filtering Configure message type filtering Configure message IE filtering Configure extended filtering Configure log function 4.3 Configuring GTP Global Parameters This topic describes how to configure GTP global parameters. In GTP management, it is optional to set GTP global parameters. Right-click the NE in the Main Topology and choose NE Explorer from the shortcut menu. Choose GTP Management > GTP Global Parameters from the service tree. 4-5

46 4 GTP Management imanager U2000 Unified Network Management System On the GTP Global Parameters tab page, click Synchronize to synchronize the data configured on the NEs to the U2000. Set global parameters. 1. Optional: Select the Enable check box to the right of GTP-in-GTP filtering to enable the GTP-in-GTP filtering function. 2. Optional: Select the Enable check box to the right of GTP tunnel log to enable the GTP tunnel log function. 3. Optional: Select the Enable check box to the right of GTP status check to enable the GTP status detection function. 4. Optional: Select the Enable check box to the right of GTP statistics to enable the GTP statistics function. 5. Optional: Set the GTP aging time. NOTE By default, the aging time is 3600 seconds. You can set different aging time as required. After the GTP aging time is specified, the security NE updates the aging time of the established GTP tunnels according to the new aging time. It is recommended that you set the aging time in the initial configuration, and do not change it during the running of GTP. 6. Optional: Configure GTP restriction. Set Control-msg rate and Surport-ExHeader Notify-msg rate to protect the GSN nodes on the GPRS network against excessive GTP packet attacks. Set Maximum number of tunnels to check whether the number of GTP tunnels on the security NE exceeds the set threshold. The GTP packets exceeding the threshold are discarded. 7. Optional: Configure GTP overbilling attack defense. a. Select Enable after Defense against GTP overbilling attacks to enable GTP overbilling attack defense. b. Click the option button to set the working location. c. Set the associated ID of overbilling attack defense. The ID ranges from 1 to 50. Set the same IDs when the firewalls working on the Gn and Gi interface interwork. d. Set IP address of interworking firewall for receiving interworking information. 8. Optional: Configure the MNC. Add an MNC. a. Click Add. In the Set the MNC dialog box, set MCC and MNC. b. Click OK. Modify the MNC. a. Select the MNC to be modified, and then click Modify. b. In the Set the MNC dialog box, modify MCC and MNC. c. Click OK. 4-6

47 imanager U2000 Unified Network Management System 4 GTP Management NOTE The Mobile Country Code (MCC) comprises of three digits, and uniquely identifies a country that mobile subscribers belong to. The MCC of China is 460. The Mobile Network Code (MNC) comprises two or three digits, and uniquely identifies a mobile communications network that mobile subscribers belong to. MCC and MNC fields exist in both IMSI and RAI. Therefore, the security NE can determine the digits of the MNC according to the MCC when the IMSI and RAI are decoded. If the digits of the MNC are not specified, by default, it has two digits. Step 5 Click Apply to deploy the global parameters to NEs. 4.4 Configuring GTP Policies This topic describes how to configure GTP policies. With GTP policies, security NEs can filter GTP packets according to various rules, thus implementing security protection on the GPRS network. GTP policies support message content filtering, message type filtering, message information element (IE) filtering, extended filtering, and packet log filtering. Step 5 Right-click the NE in the Main Topology and choose NE Explorer from the shortcut menu. Choose GTP Management > GTP Policy from the service tree. On the GTP Policy tab page, click Add. In the Configure the GTP policy dialog box, click the Basic information tab to set the policy name. Optional: Configure the GTP message content filtering. NOTE Configure the filtering rules based on access point name (APN), International Mobile Subscriber Identity (IMSI) prefix, Mobile Station International ISDN Number (MSISDN), and Routing Area Identity (RAI) prefix. The filtering rules can be used to filter GTP packets containing specific message contents. 1. Click the Msg content filtering tab. 4-7

48 4 GTP Management imanager U2000 Unified Network Management System 2. Click Add. In the Rule configuration dialog box, configure the filtering rule. 4-8

49 imanager U2000 Unified Network Management System 4 GTP Management 3. Click OK. Step 6 Optional: Configure the GTP message type filtering. NOTE You can configure the filtering rules for specific types of messages, illegal relocation messages, and illegal location management messages. The filtering rules can be used to filter the GTP packets containing specific types of messages. Filtering messages of specific types refers to the filtering of all GTP messages, GTP' messages, and unknown GTP messages. More message types are defined in GTP of version 0 and version 1, and you can set filtering rules for any of these message types. 1. Click the Msg type filtering tab. 4-9

50 4 GTP Management imanager U2000 Unified Network Management System 2. Set the type of the messages to be filtered. Configure the message of the specific type. Select the Enable check box to the right of Filter the messages of all types to enable the filtering of all types of messages. Select the Enable check box to the right of gtp' to enable the filtering of GTP' messages. In the unknown area, set the unknown message type to filter unknown GTP messages. Set filtering parameters for GTP v0. a. Click v0 advanced configurations. In the v0 advanced configurations dialog box, set the required parameters. b. Click OK. Set filtering parameters for GTP v1. a. Click v1 advanced configurations. In the v1 advanced configurations dialog box, set the required parameters. b. Click OK. Set filtering parameters for relocation messages. a. Click relocation message filtering. In the relocation message filtering configuration dialog box, select the Enable check box. 4-10

51 imanager U2000 Unified Network Management System 4 GTP Management b. Set the IP address of the SGSN. 1) Click Add. In the Set the IP address dialog box, set the IP address. 2) Click OK. c. Click OK. Set the filtering parameter of the location management message. a. Click Location management message filtering. In the Location management message filtering dialog box, set the required parameters. b. Set the IP addresses of the GGSN. 1) Click Add. In the Set the IP address dialog box, set the IP address. 2) Click OK. c. Click OK. Step 7 Optional: Configure the GTP message IE filtering. NOTE The Information Element (IE) message is a type of GTP message. Security NEs can detect the mandatory IE and repeated IE and filter the GTP packets that contain the repeated IE and do not comply with the specifications defined in the relevant protocol. 1. Click the Msg IE filtering tab. Then, set the basic parameters. Select the Enable check box to the right of Repeated IE message filtering. 4-11

52 4 GTP Management imanager U2000 Unified Network Management System The GTP protocol stipulates that an NE processes only the first IE when receiving repeated IEs. Security NEs can detect repeated IEs. Thus, when a security NE receives repeated IEs, the GTP packet containing the repeated IE is dropped. Configure mandatory IE message detection. Select the Enable check box to the right of Mandatory IE message detection. Select the check boxes to the right of v0 and v1. On the Msg IE filtering tab page, configure mandatory IE message detection. Configure mandatory IE message detection for creat-pdp-context-request packets. a. Click creat-pdp-context-request. In the creat-pdp-context-request dialog box, set the required parameters. b. Click OK. Configure mandatory IE message detection for creat-pdp-context-response packets. a. Click creat-pdp-context-response. In the creat-pdp-context-response dialog box, set the required parameters. b. Click OK. Configure mandatory IE message detection for sgsn-context-request packets. a. Click sgsn-context-request. In the sgsn-context-request dialog box, set the required parameters. b. Click OK. Configure mandatory IE message detection for sgsn-context-response packets. a. Click sgsn-context-response. In the sgsn-context-response dialog box, set the required parameters. b. Click OK. Configure mandatory IE message detection for update-pdh-context-request packets. a. Click update-pdh-context-request. In the update-pdh-context-request dialog box, set the required parameters. b. Click OK. Configure mandatory IE message detection for update-pdh-context-response packets. a. Click update-pdh-context-response. In the update-pdh-context-response dialog box, set the required parameters. b. Click OK. Step 8 Optional: Configure the GTP extended filtering. 1. Click the Extended filtering tab. Then, set the basic parameters. 4-12

53 imanager U2000 Unified Network Management System 4 GTP Management Select the Enable check box to the right of Detect the sequence number of the GTP packet. Enable Detect the sequence number of the GTP packet to determine whether a GTP packet is legal. Security NEs drop illegal GTP packets. In the GTP message length filtering area, set the maximum and minimum lengths of GTP messages. Only the GTP packet whose message length falls in the specified range can pass through security NEs. In the GTP message extension header detection area, configure the detection of GTP message extension headers. Select the Enable check box to the right of Detect repeated extension header of GTP messages and Detect the extension header of specified message. Set Message extension header type by entering a value or through the spin box. Step 9 Optional: Configure the log function for GTP packets. NOTE Security NEs can record logs for the processing of GTP packets according to different processing results of GTP packets as well as specified conditions. In this manner, the security NEs can monitor the working status of GTP. 1. Click the Log tab. 4-13

54 4 GTP Management imanager U2000 Unified Network Management System The GTP module sends logs in the syslog format to the information center. The following log formats are available: basic Basic log information includes the timestamp, source IP address, destination IP address, message type, packet status (forwarded, prohibited, rate-limited, state-invalid, tunnellimited, matchmsgtype, matchimsi, matchmsisdn, and matchapn), and interface. extended The extended log information includes the basic log information, IMSI, MSISDN, APN, selection mode, address of the signaling SGSN, address of the data SGSN, address of the signaling GGSN, and address of the data GGSN. 2. Select the Enable check box to the right of GTP log. 3. Optional: In the Record logs according to processing results of GTP area, set the required parameters. The status of a GTP packet can be the following after the packet is processed by the security NE: forward The packet matches the GTP permit rule and the security NE forwards the packet. prohibit The packet matches the GTP deny rule and the security NE drops the packet. rate-limit 4-14

55 imanager U2000 Unified Network Management System 4 GTP Management The packet exceeds the maximum rate limit of the GTP tunnel and the security NE drops the packet. state-invalid The GTP state detection of the packet fails and the security NE drops the packet. tunnel-limit The number of GTP tunnels reaches the maximum and the security NE drops the packet. 4. Optional: In the Record logs according to specified conditions area, set the required parameters. Security NEs record logs for the matching GTP packets according to the specified APN, IMSI, and MSISDN, or the message type. a. Click message advanced configurations. In the message advanced configurations dialog box, set Request message, Response message, and Other. 4-15

56 4 GTP Management imanager U2000 Unified Network Management System b. Click OK. 0 Click OK to apply the configured GTP policy to NEs. 4-16

57 imanager U2000 Unified Network Management System 4 GTP Management 4.5 Configuring the Application of GTP Policies in Interzones This topic describes how to configure the application of GTP policies in interzones. After a GTP policy is configured, you must apply it in interzones so that the policy can take effect. You can apply only one policy in each direction of the interzone. Right-click the NE in the Main Topology and choose NE Explorer from the shortcut menu. Choose GTP Management > Apply GTP Policy in Interzones from the service tree. Click Add. In the Apply the GTP policy in interzones dialog box, set the relevant parameters. Click Apply to apply the GTP policy to the NEs in interzones. NOTE Multiple GTP policies can be consecutively applied to the different directions of the same interzone or different interzones. Step 5 Click OK. 4.6 Configuration Example This describes the example for configuring GTP, including the examples for configuring the GTP policy and configuring the defense against GTP overbilling attacks Example for Configuring the GTP Policy This describes the networking application and configuration methods of a GTP policy by taking the configuration of a GTP policy as an example Example for Configuring Defense Against GTP Overbilling Attacks This describes the example for configuring the defense against GTP overbilling attacks. 4-17

58 4 GTP Management imanager U2000 Unified Network Management System Example for Configuring the GTP Policy Networking Requirements This describes the networking application and configuration methods of a GTP policy by taking the configuration of a GTP policy as an example. As shown in Figure 4-3, the FW works on the Gn interface and is deployed on the core network, thus protecting the data transmission between the devices on the SGSN and GGSN. The network environment is as follows: The SGSN belongs to the Trust zone, and connects to the FW through GigabitEthernet 1/0/1. The GGSN belongs to the Untrust zone, and connects to the FW through GigabitEthernet 1/0/2. Figure 4-3 Networking diagram of configuring the GTP policy U2000 Gn Trust Core Network GE1/0/ /24 Untrust GE1/0/ /24 Gn Gi Internet SGSN FW GGSN PDN GTP Tunnel CN-PS The following requirements are met through the configuration of the GTP policy: The name of the GTP policy is policy1. Filter GTP packets whose APNs are test. Filter GTP' packets. Detect repetitive IEs, and filter the repetitive IEs that do not comply with protocol specifications. Limit the length of the GTP packet to a range of 0 to 1400 bytes, and filter the GTP packets that do not meet the length requirement. Record the logs of the GTP packets that match the rules for allowing and forbidding GTP packets. The log format is extended. 4-18

59 imanager U2000 Unified Network Management System 4 GTP Management Data Planning Table 4-1 Network topology planning Interface name IP address of the interface Security Zone GigabitEthernet 1/0/ /24 trust GigabitEthernet 1/0/ /24 untrust Step 5 Step 6 Step 7 Configure firewalls to implement network interworking between devices. Add device FW to the NMS. Right-click the NE in the Main Topology and choose NE Explorer from the shortcut menu. Choose GTP Management > GTP Policy from the service tree. On the GTP Policy tab page, click Add. In the Configure the GTP policy dialog box, click the Basic information tab to set the policy name as policy1. Configure the GTP message content filtering to filter GTP packets whose APNs are test. 1. Choose the Msg content filtering tab. 4-19

60 4 GTP Management imanager U2000 Unified Network Management System 2. Click Add. In the Rule configuration dialog box, configure the filtering rule. 4-20

61 imanager U2000 Unified Network Management System 4 GTP Management 3. Click OK. Step 8 Configure the GTP message type filtering to filter GTP' packets. 1. Click the Msg type filtering tab. 4-21

62 4 GTP Management imanager U2000 Unified Network Management System 2. Select the Enable check box to the right of gtp' to enable the filtering of GTP' messages. Step 9 Configure the GTP message IE filtering to filter the repetitive IEs that do not comply with protocol specifications. 1. Click the Msg IE filtering tab. 4-22

63 imanager U2000 Unified Network Management System 4 GTP Management 2. Select the Enable check box to the right of Repeated IE message filtering. 0 Configure the GTP message length filtering to Limit the length of the GTP packet to a range of 0 to 1400 bytes. 1. Click the Extended filtering tab. 4-23

64 4 GTP Management imanager U2000 Unified Network Management System 2. In the GTP message length filtering group box, set the Minimum length as 0, Maximum as Configure the log function for GTP packets to Record the logs of the GTP packets that match the rules for allowing and forbidding GTP packets. 1. Click the Log tab. 4-24

65 imanager U2000 Unified Network Management System 4 GTP Management 2. Select the Enable check box to the right of GTP log. 3. Select the forward check box, and then select the related extended option button. 4. Select the prohibit check box, and then select the related extended option button. 2 Click OK. 3 Choose GTP Management > Apply GTP Policy in Interzones from the service tree. 4 Click Add. The Apply the GTP policy in interzones dialog box is shown. 1. Set the relevant parameters according to Table 4-2. Click Apply to apply the GTP policy in interzone from trust to untrust. 4-25

66 4 GTP Management imanager U2000 Unified Network Management System Table 4-2 Apply the GTP policy in interzone from trust to untrust Parameter Parameter value Virtual firewall -- High-priority security zone Low-priority security zone Direction GTP policy trust untrust outbound policy1 2. et the relevant parameters according to Table 4-3. Click Apply to apply the GTP policy in interzone from untrust to trust. Table 4-3 Apply the GTP policy in interzone from untrust to trust Parameter Parameter value Virtual firewall

67 imanager U2000 Unified Network Management System 4 GTP Management Parameter High-priority security zone Low-priority security zone Direction GTP policy Parameter value trust untrust inbound policy1 5 Click OK Example for Configuring Defense Against GTP Overbilling Attacks Networking Requirement This describes the example for configuring the defense against GTP overbilling attacks. As shown in Figure 4-4, FWA works on the Gn interface and FWB on the Gi interface. FWA interworks with FWB to defend against GTP overbilling attacks. The network environment is as follows: GigabitEthernet 1/0/1 on FWA belongs to the Trust zone and connects to the SGSN; GigabitEthernet 1/0/2 on FWA belongs to the Untrust zone and connects to the GGSN; GigabitEthernet 1/0/3 on FWA belongs to the Coop zone and connects to FWB. GigabitEthernet 1/0/1 on FWB belongs to the Trust zone and connects to the GGSN; GigabitEthernet 1/0/2 on FWB belongs to the Untrust zone and connects to the Internet; GigabitEthernet 1/0/3 on FWB belongs to the Coop zone and connects to FWA. Figure 4-4 Networking diagram of configuring the defense against GTP overbilling attacks Billing Center U2000 SGSN Core Network CG Trust GE1/0/1 Gn FW A Untrust GE1/0/2 Gn Coop GGSN GE1/0/3 CN-PS FW B Trust GE1/0/ /24 Gi Coop GE1/0/3 Untrust GE1/0/2 Serverip WAP Gateway Internet PDN cooperation 4-27

68 4 GTP Management imanager U2000 Unified Network Management System When the defense against GTP overbilling attacks is configured, and the MS is offline, FWA on the Gn interface notifies FWB on the Gi interface in real time. Then FWB discards the subsequent data packets of the user and thus defends against overbilling attacks on other users. Configure the firewall to implement interworking between devices. Add security NEs FWA and FWB on the U2000. Configure FWA. 1. In the main topology, right-click FWA and choose NE Explorer from the shortcut menu. 2. Choose GTP Management > GTP Global Parameters from Service Tree. 3. Click Synchronize to synchronize the data configured on the NE to the U In the Configure the defence against GTP overbilling attacks area, select the Enable check box to the right of Defence against GTP overbilling attacks to enable the defense against overbilling attacks. 5. Click the Gn option button for Working location to configure FWA to work on the Gn interface. 6. Set ID of the attack defense module to 15. CAUTION If ID of the attack defense module is the same as the set ID, the later configurations take effect during application. 7. Enter IP address of the interworking firewall as the IP address of the server that receives interworking information. 8. Click Apply. Configure FWB. 1. In the main topology, right-click FWB and choose NE Explorer from the shortcut menu. 2. Choose GTP Management > GTP Global Parameters from Service Tree. 4-28

69 imanager U2000 Unified Network Management System 4 GTP Management 3. Click Synchronize to synchronize the data configured on the NE to the U In the Configure the defence against GTP overbilling attacks area, select the Enable check box to the right of Defence against GTP overbilling attacks to enable the defense against overbilling attacks. 5. Select Gi for Working location to configure FWB to work on the Gi interface. 6. Set ID of the attack defense module to 15. The associated IDs of FWA and FWB must be the same. CAUTION If ID of the attack defense module is the same as the set ID, the later configurations take effect during application. 7. Click Apply. 4-29