> Source: [sk106469](https://support.checkpoint.com/results/sk/sk106469)

# sk106469 - Security Gateway drops GTP traffic with the log "Message includes unexpected information element type"

| Property | Value |
|----------|-------|
| Solution ID | sk106469 |
| Date Created | 2015-06-15 |
| Last Modified | 2026-02-01 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- Security Gateway drops GTP traffic with this traffic log:

`Message includes unexpected information element type XXX, failing parse. In case the IE should be accepted please add it to gtpv2_ignore_elements table in gtp.def`

Example:

`Message includes unexpected information element type 200, failing parse. In case the IE should be accepted please add it to gtpv2_ignore_elements table in gtp.def`

## Cause

The Security Gateway received an Information Element that is not expected with the particular message type (according to the 3GPP specification supported by the Security Gateway).

This can often occur after equipment upgrade in the operator's or roaming partner's network.

## Solution

This problem was fixed. The fix is included in:

* [Jumbo Hotfix Accumulator for R82](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) starting from Take 44
* [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 119
* [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 183

If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/.contact-support/) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597).

Also, you can follow the available **workaround** procedure:

### Background

GPRS Tunneling Protocol (GTP) is the communications protocol of mobile networks.
**Important note:**

After installing the relevant fix, the behavior of *gtpv2_ignore_elements* has changed. The system now supports two tables for ignoring Information Elements (IE):

* *gtpv2_ignore_elements* -- recommended table, where IEs are matched more reliably, including those within group IEs.
* *gtpv2_ignore_remaining_elements* -- a fallback table.

### Action Plan

1. Review a full GTP packet capture and locate the Information Element (IE) that is being dropped.

2. In the packet capture, look for this section:

   **IE Type: \<IP Address\> (\<NUMBER\>)**

   This is the Information Element (IE) that you will need to add to the relevant ***gtp.def*** file on the Security Management Server / Multi-Domain Security Management Server.

   Refer to [sk107499](https://support.checkpoint.com/results/sk/sk107499) for the location of the relevant file.
   1. Connect to the command line on the Security Management Server / Multi-Domain Security Management Server that manages the Security Gateway / Cluster.

   2. Log in to the Expert mode.

   3. Back up the relevant *gtp.def* file (in our example, we work with *$FWDIR/lib/gtp.def* ):

      `cp -v $FWDIR/lib/gtp.def{,_BKP}`
   4. Edit the file in plain-text editor:

      `vi $FWDIR/lib/gtp.def`
   5. In the file, locate this line:

      `gtpv2_ignore_elements = {<MSG_ID1,IE_TYPE1>, <MSG_ID2,IE_TYPE2>};`
   6. Add the IE that you wish to ignore in one of the following format:

      * Recommended table to insert elements to be ignored: `gtpv2_ignore_elements = {<MSG_ID1,IE_TYPE1>, <MSG_ID2,IE_TYPE2>};`

        Example for the message type 33 with IE 84 and type 32 with IE 121: `gtpv2_ignore_elements = {<33,84>, <32,121>};`
      * Fallback table: `gtpv2_ignore_remaining_elements = {IE_TYPE1>, <IE_TYPE2>};`  

        Example for the IE 84 and IE 121: `gtpv2_ignore_remaining_elements = {<84>, <121>};`
   7. Save the changes in the file and exit Vi editor.

   8. In SmartConsole, install the Access Control policy on the Security Gateway / Cluster.

   9. Test the GTP traffic.

### Important Note

Some Information Elements (IEs) are mandatory according to the 3GPP specification. Therefore, adding them to the **gtpv2_ignore_elements** table will cause the parsing fail due to their absence from the verification. For this reason, we recommend to add exceptions for IEs for each affected message type, as demonstrated in the example in point 2-f above.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content