user@srx> show configuration security policies from-zone A to-zone B 
policy gtp-lab-policy-allow-all {
    match {
        source-address any;
        destination-address any;
        application junos-gtp;
    }
    then {
        permit {
            application-services {
                gtp-profile GTP;
            }
        }
    }
}

user@srx> show configuration security gtp
profile GTP {
...

Questions and answers:

• Question: Is it possible to use this inspection object (GTP) as a default deny and then permit certain message types to pass it?
  • Answer: No, the inspection object is designed that we deny messages based on configuration and have implicit permit.

• Question: Is it possible to use numerical values indicating GTP message type instead of message-type names?
  • Answer: No, in configuration stanzas we use message-type names.

• Question: What happens if a GTP inspection is turned on and a message type arrives to SRX with unsupported message-type? Is it denied or permitted?
  • Answer: It is permitted and no further checks are done for such messages.

• Question: Is it possible to do GTP source based rate-limiting or are all rate-limiting features in GTP services global?
  • Answer: No, source based limiting is not supported, but there are a few other options available:
    • For all GTP packets: set security gtp profile GTP rate-limit ...
    • Per GTP message: set security gtp profile GTP rate-limit message ...
    • For IP pairs: set security gtp profile GTP path-rate-limit ...
    • GTP-C APN: set security gtp apn-control PROFILE rate-limit ...