# SS7 and Diameter signaling security in 2026: FS.11, FS.19, and the modern signaling firewall

> Interconnect signaling is where location tracking, SMS interception, and roaming fraud live. Here is the 2026 threat model, the GSMA rule sets that govern it, and what a signaling firewall does — and does not — stop.

- Canonical URL: https://www.broadnet.me/blog/ss7-diameter-signaling-security-2026-fs11-fs19
- Language: en
- Last updated: 2026-08-08
- Publisher: BroadNet (https://www.broadnet.me)

- Published: 2026-07-11
- Author: BroadNet Operator Solutions

A signaling firewall inspects SS7 and Diameter interconnect traffic and blocks messages that have no legitimate purpose — unauthorised location queries, SMS-interception setups, and roaming fraud. It applies category-based filtering from GSMA FS.11 (SS7) and FS.19 (Diameter). Firewalls stop most external attacks, but sophisticated and nation-state actors persist, so defense-in-depth is required.

## Why interconnect signaling is a security problem

SS7 and Diameter are the control-plane protocols that let networks route calls, deliver SMS, and support roaming. They were designed for a small club of trusted operators, so they largely assume the sender is honest. In a world of thousands of interconnect partners and resold access, that assumption breaks. An attacker with signaling access can query and manipulate the network as if they were a legitimate roaming partner.

## The threat model

- Location tracking — abusing queries such as anyTimeInterrogation or ProvideSubscriberInfo to learn where a subscriber is, with no roaming justification.
- SMS interception — using SS7 MAP operations (for example manipulating where messages are routed) to divert a subscriber's SMS, including OTPs, to an attacker-controlled point.
- Subscriber reconnaissance — unauthorised SendRoutingInfoForSM (SRI-SM) requests harvesting IMSI and serving-network data to prepare targeted attacks.
- Roaming interconnect fraud — MT-ForwardSM injection and related abuse that bypasses the home network's controls and any A2P agreement.
- Denial and disruption — malformed or high-velocity signaling used to degrade service for targeted subscribers.

The through-line is that all of these ride on legitimate protocol operations. There is no single 'attack message' to blocklist — the same operation is benign from a genuine roaming partner and malicious from an actor with no reason to send it. That is what makes signaling security a filtering-and-context problem rather than a simple allow/deny list.

## The rule sets: FS.11, FS.19, and the supporting specs

A competent signaling firewall does not invent its categories — it implements the GSMA-defined guidance. These documents codify which operations to monitor, which to block from which sources, and how to categorise interconnect messages by risk.

| Document | Scope | What it defines |
|---|---|---|
| GSMA FS.11 | SS7 interconnect | SS7 security monitoring and firewall guidelines; message categories and controls |
| GSMA FS.19 | Diameter interconnect | Diameter (4G/LTE) interconnect security guidance |
| GSMA IR.70 / IR.71 | SMS / interconnect | SMS interworking and interconnect best practice |
| 3GPP TS 23.840 | Core network | Technical reference underpinning SMS routing behaviour |

In FS.11, SS7 MAP messages are grouped into categories by whether they should ever arrive from an interconnect partner, whether they are only valid for a subscriber's home network, and whether they are only valid when the subscriber is actually roaming on the requesting network. The firewall enforces those categories, adds velocity limits per partner, and applies cross-checks — for example rejecting an MT-ForwardSM for a subscriber the network knows is not roaming on the claimed visited network.

## What a signaling firewall stops — and what it does not

Deployed and tuned, a signaling firewall blocks the large majority of external SS7 and Diameter attacks: the location queries, the reconnaissance, the interception setups, and the roaming fraud that make up the bulk of the threat. That is a substantial reduction in subscriber and revenue risk.

It is not a complete guarantee. Sophisticated and well-resourced actors — including nation-state operations — continue to find paths: novel message combinations, abuse of legitimate-looking roaming states, or access obtained through a trusted partner's compromised network. This is why signaling security is framed as defense-in-depth, not a single appliance: firewalling plus monitoring plus anomaly detection plus partner governance, layered so that a bypass at one layer is caught at another.

> BroadNet's [SS7 firewall](https://www.broadnet.me/operators/ss7-firewall) implements FS.11 and FS.19 categories with per-partner velocity limits and roaming-state cross-checks, and feeds signaling events into [signaling and CDR analytics](https://www.broadnet.me/platforms/signaling-cdr) so anomalies that slip a static rule still surface in monitoring.

## How operators deploy it

A typical rollout runs in monitor-only mode first to baseline normal interconnect behaviour without dropping traffic, then moves to active blocking once categories and velocity thresholds are tuned to the operator's real partner mix. The monitoring output is valuable on its own — many operators discover interconnect partners sending operations they had no legitimate reason to send. For the concepts in brief, see our answers on [SS7 signaling security](https://www.broadnet.me/answers/ss7-signaling-security) and [Diameter signaling security](https://www.broadnet.me/answers/diameter-signaling-security).

## Frequently asked questions

### What is the difference between SS7 and Diameter security?

SS7 is the legacy signaling protocol for 2G/3G networks; Diameter is its counterpart for 4G/LTE. Both carry interconnect and roaming signaling that can be abused for tracking, interception, and fraud. GSMA FS.11 gives the security guidance for SS7 and FS.19 covers Diameter, so a full defense needs firewalling on both planes, not just one.

### Can a signaling firewall stop all SS7 attacks?

No. A well-tuned firewall blocks the large majority of external SS7 and Diameter attacks — location tracking, reconnaissance, interception setups, and roaming fraud. But sophisticated and nation-state actors can still find novel paths, so signaling security is defense-in-depth: firewalling plus monitoring plus anomaly detection plus partner governance, layered together.

### What are GSMA FS.11 and FS.19?

They are GSMA security guidelines for interconnect signaling. FS.11 covers SS7 interconnect security monitoring and firewall guidelines, defining message categories and controls. FS.19 covers Diameter interconnect security for 4G/LTE. A signaling firewall implements their categories rather than reinventing them, alongside supporting specs such as IR.70/IR.71 and 3GPP TS 23.840.

### How does SS7 signaling let attackers intercept SMS?

By abusing legitimate MAP operations to influence where a subscriber's messages are routed, an attacker with signaling access can divert incoming SMS — including one-time passwords — to a point they control. The firewall defends against this with category-based filtering and roaming-state cross-checks that reject operations arriving from partners with no valid reason to send them.

## References

- GSMA — FS.11 SS7 Interconnect Security Monitoring and Firewall Guidelines: [gsma.com](https://www.gsma.com/solutions-and-impact/technologies/security/)
- GSMA — FS.19 Diameter Interconnect Security: [gsma.com](https://www.gsma.com/solutions-and-impact/technologies/security/)
- 3GPP — Specification portal (TS 23.840): [3gpp.org](https://www.3gpp.org/dynareport?code=23.840)