S7 — the signalling protocol family that runs between mobile networks for routing, roaming, authentication, and SMS — was designed in an era when only a few hundred operator networks could send each other signalling messages, all of them trusted. That trust assumption no longer holds. Interconnect access has broadened dramatically, much of it through resellers and aggregators, and a meaningful fraction of SS7 traffic on the global signalling network is now hostile: location tracking, SMS interception, fraud-call origination, OTP harvesting, and SIM-swap reconnaissance. An SS7 firewall is the mobile operator's defensive control at the signalling boundary. This piece is what operators need to know about the attack surface it covers, the standards it aligns to, the topology to deploy it in, and the tuning process that makes it useful in production.
The SS7 attack surface in three layers
GSMA categorises SS7 attacks into three broad categories that map cleanly to defensive controls — FS.07 and FS.11 define them and the recommended filtering categories.
Category 1 — messages that should never come from outside the home network
Examples: anyTimeInterrogation (operator-internal subscriber-state queries), provideSubscriberInformation, sendRoutingInformation (the unrestricted variant used for call routing within the home network). These messages have no legitimate use from a foreign network; an inbound Category 1 message from interconnect is always either an attack or a misconfiguration. The filter rule is straightforward: drop, log, alert. False-positive risk is minimal because legitimate roaming and call setup do not require them.
Category 2 — messages that should only come from the subscriber's currently serving network
Examples: provideSubscriberInformation when issued by the visited network during active roaming, sendRoutingInfoForSM (SRI-SM) used by foreign SMSCs to route messages to home subscribers, Diameter S6a update-location for LTE. These are legitimate from the right network at the right time but indistinguishable from attacks if the source network is not where the subscriber actually is. The filter rule requires cross-checking: is this subscriber actually currently roaming on the network sending the message? If not, the message is suspicious. The filter needs access to the home HLR/HSS state to answer.
Category 3 — messages that may be legitimate but are commonly abused
Examples: SRI-SM at high volume from a single source (subscriber-enumeration reconnaissance), MT-ForwardSM with originating addresses that do not exist on the claimed source network (sender spoofing), updateLocation patterns that suggest SIM-swap fraud. These cannot be blocked on a per-message basis without false-positiving legitimate traffic; they need velocity-based, pattern-based, and cross-protocol detection. Behavioural ML earns its keep in this category.
What an SS7 firewall actually inspects
On the SS7 side, the firewall sits in the path of signalling messages — typically as a Diameter / SCTP-attached node on the operator's SS7 backbone, capable of inspecting both classical SS7 (MAP, CAMEL) and Diameter (S6a, S9, S6b). Inspection covers:
- Message-category filtering against the FS.07 / FS.11 taxonomy.
- Source-network validation — does the SCCP calling-party-address (or Diameter Origin-Host) belong to a network with a legitimate roaming or interconnect relationship?
- Cross-message correlation — does the MAP MT-ForwardSM follow a legitimate SRI-SM for the same subscriber, or did it arrive cold?
- Velocity limits per origin and per category — bursty SRI-SM from a single source is reconnaissance.
- Cross-protocol consistency — does the visited-network claim in the MAP message match what the HSS knows from the most recent Diameter S6a update-location?
- Subscriber-state validation — for messages that depend on the subscriber being roaming, is the subscriber actually roaming?
An SS7 firewall that does only the first item on this list is a Category 1 filter; the ones from item three onwards are what protect against the Category 3 attacks that matter most.
Deployment topology
Like the SMS firewall, an SS7 firewall can deploy inline (every signalling message traverses the firewall before reaching the operator's core), in mirror mode (a copy of signalling is fed to the firewall for observation without enforcement), or hybrid (mirror by default with selective inline enforcement on specific message categories or specific peers). The same trade-offs apply, with one additional consideration: SS7 latency budgets are tight — many signalling exchanges have multi-second SLAs measured at the user-experience level — and inline deployment must be capable of inspecting at line rate without adding meaningful latency. Capacity planning is more demanding than for SMS firewalls because the signalling-message rate on a large network is high.
Standards alignment — FS.07, FS.11, and the regulator conversation
GSMA FS.07 covers SS7 signalling protection broadly; FS.11 covers SMS-specific filtering recommendations. Both are referenced explicitly by national regulators in the GCC, in Europe, and increasingly in Africa and Asia as the baseline against which operator controls are evaluated. An SS7 firewall implementation that maps its filter categories onto FS.07 and FS.11 explicitly produces three benefits at once: the operator's own audit conversation is much easier (the controls map to a recognised taxonomy), the regulator audit is much easier (the regulator can verify alignment against the standard), and peer-review at the GSMA Fraud and Security Group is much easier (the operator can demonstrate the controls in a vocabulary the peer review uses). Specify FS.07 / FS.11 alignment in any procurement; refuse vendors who answer with proprietary taxonomies.
False positives and the tuning process
Every SS7 firewall over-blocks at first deployment. The question is not whether to expect false positives but how the operator reduces them in the first 90 days.
The standard tuning sequence: deploy in mirror mode for two weeks while baselining the legitimate traffic, including the long tail of unusual but legitimate roaming agreements with smaller foreign networks. Move to selective inline enforcement on Category 1 messages first (low false-positive risk by definition), then expand to Category 2 with cross-checking enabled, then to Category 3 with behavioural thresholds tuned against the baseline. Throughout, maintain an analyst workflow for flagged messages, with the ability to whitelist specific source networks for specific message categories where genuine business relationships justify it. The end-state is a firewall blocking the hostile traffic with a sub-1% false-positive rate on legitimate roaming.
The attacks operators most often discover after deployment
Three categories of unauthorised activity surface in the first month of any first-deployment SS7 firewall, regardless of geography.
- Subscriber-location queries from foreign networks with no business reason to ask — a few percent of typical interconnect traffic, often from networks that have never had a roaming agreement with the operator.
- MT-ForwardSM injection bypassing the operator's own SMSC — the SS7-layer grey route equivalent of the SMS-layer grey route, often the same traffic the SMS firewall is also catching from a different angle.
- Pattern-matched SIM-swap reconnaissance — Update-Location and related queries against high-value subscriber ranges (banking, government) that correlate with attempted account takeover.
The first month's reports from a new SS7 firewall are uncomfortable to read because they show how much was happening unmitigated before. They are also the most useful artefact the operator's security team can take to the executive committee and the regulator.
Regulator audit support
Regulators across the region are progressively introducing audit requirements for operator signalling-layer protection — sometimes as part of broader subscriber-protection or cybersecurity frameworks, sometimes as standalone signalling-security mandates. A well-instrumented SS7 firewall produces the audit artefacts on demand: filter-category statistics, blocked-message logs (with appropriate retention), false-positive rates, alignment maps against FS.07 / FS.11, incident-response timelines. The operator that can produce these from a standing dashboard answers the regulator in a meeting; the operator that has to assemble them on request spends weeks doing so under scrutiny. Build the audit reporting into the deployment plan from day one.
Interaction with the SMS firewall — they belong together
An SS7 firewall and an SMS firewall cover overlapping but not identical attack surfaces. The SMS firewall catches A2P abuses at the SMSC boundary — sender-ID enforcement, SIM-farm termination detection, content filtering — and is most effective on traffic that reaches a sanctioned SMSC. The SS7 firewall catches abuses at the signalling layer below the SMSC — MT-ForwardSM injection that bypasses the SMSC, location tracking, fraud-call origination, SIM-swap reconnaissance. The two systems share telemetry where they can, alert on correlated patterns (an SS7-layer SIM-swap query followed by an SMS-layer OTP burst is a stronger signal than either alone), and together provide the layered defence operators need. Deploying one without the other leaves a meaningful gap.
BroadNet's SS7 firewall implements FS.07-aligned filter categories, cross-protocol correlation with the SMS firewall, and the audit-ready reporting that regulators in the region increasingly expect. Deployments in MENA networks are mirror-first, FS-aligned, and tuned against operator-specific baselines before any inline enforcement.
What good looks like, in numbers
A mature SS7 firewall deployment on a Tier-1 MENA network typically reaches: 99%+ of Category 1 messages blocked at the boundary (the easy category), >90% of Category 2 misuse blocked through cross-protocol correlation, >70% of Category 3 abuse blocked through behavioural detection, with sub-1% false-positive rate on legitimate roaming traffic. These numbers compound over time as the behavioural models train on the network's specific traffic; the year-2 numbers are typically materially better than the year-1 numbers without any new technology investment.
What this means for the next three years
SS7 is not going away. The industry has been predicting its replacement for two decades, and what has happened instead is that SS7 has been incrementally augmented with Diameter (for LTE) and HTTP/2 with SBI (for 5G core), but every operator still terminates SS7 because every other operator still terminates SS7. The defensive posture therefore needs to assume a long horizon. Invest in the firewall infrastructure as if it will be in service for ten years, not three; budget for the analyst capacity to maintain rules and review behavioural model outputs as standing operational cost, not project cost; build the data retention and audit-export pipelines as production-grade systems, not afterthoughts. The networks that have been doing this since the late 2010s are now well ahead of the ones starting now — there is no shortcut to mature deployment.
Related reading
- What is an SMS firewall, and why operators need one
- Direct routes versus grey routes in A2P SMS
- How flash-call verification affects operator A2P revenue
- Glossary — GSMA FS.07 / FS.11 signalling firewall, SS7 MAP explained, Diameter S6a explained
- Product pages — operator SS7 firewall and operator solutions overview
- Coverage — Saudi Arabia signalling protection and CST audit posture