Everything worth knowing, nothing that isn't.
What FS.07 covers
FS.07 classifies SS7 MAP and CAP messages into three categories. Category 1: messages that should never come from outside the operator's network (e.g. Update-Location from a foreign address claiming to serve the operator's own IMSI range). Category 2: messages that should only come from confirmed roaming partners (e.g. Provide-Subscriber-Info). Category 3: messages that are legitimate from any peer but must be rate-limited and reputation-scored. The firewall enforces drop, rate-limit, or pass per category per peer.
What FS.11 covers
FS.11 is the monitoring and incident-response companion. It defines what events the firewall must log (every drop with full PDU), what aggregate metrics the SOC must track (per-peer Cat-1/2/3 ratios, anomaly baselines), and what to do when a known-bad pattern is detected (page the SOC, snapshot the PDU stream, notify GSMA T-FCS). FS.11 also defines the cross-operator information-sharing format for fraud intelligence.
Why the two are paired
FS.07 without FS.11 is a firewall with no audit trail — useless in a regulator's eyes. FS.11 without FS.07 is a SOC with no enforcement. Operators that pass GSMA partner audits implement both, and a tier-1 operator like Etisalat or STC will not sign a new IR.21 roaming agreement until the partner attests to FS.07/FS.11 compliance.
How BroadNet implements it
BroadNet's signalling firewall ships with the FS.07 category table preloaded and editable per peer. The same engine writes FS.11-compatible event logs to a tamper-evident store (SHA-256 chained, exportable to GSMA T-FCS quarterly report format). We have deployed it across 60+ operators in MENA, Africa, and Asia.