# SS7 firewall for signaling fraud and grey routes - Canonical URL: https://www.broadnet.me/operators/ss7-firewall - Language: en - Last updated: 2026-10-10 - Publisher: BroadNet (https://www.broadnet.me) - Markdown version of the page above, generated from the rendered page. SS7 SMS firewall · Operator-grade Stop grey routes. Monetize A2P. Protect the signaling layer. BroadNet's SS7 firewall stops signaling fraud and grey-route A2P traffic for mobile operators by inspecting SS7 signaling in-line, before it reaches the core network. An SS7 firewall with in-line MAP/SCCP filtering between the international STP and your core network. Sender ID control, route validation, SRI-SM cache filtering, content filtering and A2P monetization — all from a single signaling-layer firewall. Deployed at Tier-1 operators across the MENA region. [Request signaling security review](https://www.broadnet.me/contact?topic=signaling-security&product=ss7-firewall) [Discuss network protection](https://www.broadnet.me/contact?topic=network-protection&product=ss7-firewall) <5ms Inspection latency 99.99% In-line uptime 1,000+ MNO connections Signaling stream · sample data stp-edge-01 · mena-1 Blocked 12,842 Allowed 184,902 Quarantined 317 Op · Origin GT Verdict - AnyTimeInterrogation GT 882 16xxxxx Cat 1 BLOCK ↳ Location tracking attempt - MT-ForwardSM GT 971 50xxxxx Cat 3 ALLOW ↳ SRI-SM cache match - MT-ForwardSM GT 234 80xxxxx Cat 2 BLOCK ↳ Spoofed origin · A2P leakage - ProvideSubscriberInfo GT 7 921xxxxx Cat 1 BLOCK ↳ Foreign HLR probe - MO-ForwardSM GT 971 50xxxxx Cat 3 ALLOW ↳ Sender ID registry match - CAP InitialDP GT 850 2xxxxxx Cat 3 QUARANTINE ↳ Wangiri pattern · velocity - SendRoutingInfo GT 880 17xxxxx Cat 1 BLOCK ↳ IRSF reconnaissance FS.11 rule pack · v2026.1 <5 ms / msg Inspection latency <5ms Every MAP, CAP and SCCP unit decoded, scored and decided in-line at the STP In-line uptime 99.99% Active-active firewall pairs on the international signaling path MNO connections 1,000+ Direct operator connections, direct binds in 86 countries, since 2003 Tier-1 operators MENA Deployed at Tier-1 operators across the MENA region How it sits in the signaling plane ## From international STP to home core, in 5 hops. One firewall on the international signaling path. Every MAP, CAP and SCCP unit is decoded per-IE, categorized against GSMA FS.11, and a verdict is returned in under five milliseconds. No re-route, no broken roaming. 1. 01 · Ingress Int'l STP International SS7 (SIGTRAN, M3UA) links inbound from roaming partners and grey routes. no added hop 2. 02 · Decode Signaling firewall MAP, CAP and SCCP per-IE decode. GT, AC, CdPA/CgPA, IMSI, MSISDN normalized for policy lookup. decode < 0.8ms 3. 03 · Score FS.11 · SRI-SM Category 1/2/3 classification, SRI-SM cache validation, sender-ID and route checks, velocity buckets. score < 2.0ms 4. 04 · Verdict Policy DSL Allow · modify · quarantine · drop · monetize. Per-route, per-partner, per-subscriber. Maker-checker promoted rules. verdict < 1.0ms 5. 05 · Core HLR / SMSC / MSC Only validated signaling reaches the home network. Quarantined messages mirrored for fraud team review. total p99 < 5ms 6. ← signed audit · regulator export · NOC stream 01 · Ingress Int'l STP International SS7 (SIGTRAN, M3UA) links inbound from roaming partners and grey routes. no added hop 02 · Decode Signaling firewall MAP, CAP and SCCP per-IE decode. GT, AC, CdPA/CgPA, IMSI, MSISDN normalized for policy lookup. decode < 0.8ms 03 · Score FS.11 · SRI-SM Category 1/2/3 classification, SRI-SM cache validation, sender-ID and route checks, velocity buckets. score < 2.0ms 04 · Verdict Policy DSL Allow · modify · quarantine · drop · monetize. Per-route, per-partner, per-subscriber. Maker-checker promoted rules. verdict < 1.0ms 05 · Core HLR / SMSC / MSC Only validated signaling reaches the home network. Quarantined messages mirrored for fraud team review. total p99 < 5ms What the firewall does ## Six layers, one signaling engine. Decoded at the STP, scored in real time, and acted on in under five milliseconds. One signaling-layer engine handles MAP, CAP and SCCP; one policy DSL writes the rules; one audit store keeps the evidence. ### SS7 signaling inspection One firewall on the signaling path. MAP, CAP and SCCP are decoded, normalized and scored against a single policy engine before any message reaches your SMSC, HLR or MSC. Protocols MAP·CAP·SCCP Decode Per-IE Mode Inline / OOB ### GSMA FS.11 category enforcement Out-of-the-box rule packs aligned with GSMA FS.11 for SS7 interconnect. Category 1 never crosses the network boundary; Category 2 is validated against home-network origin; Category 3 is velocity-scored per subscriber. FS.11 Cat 1–3 Boundary Cat 1 drop Updates Quarterly ### Real-time threat scoring Every message is fingerprinted across origin GT, SCCP CdPA/CgPA, application context and historical pattern. Anomaly scores feed a policy DSL that decides allow, modify, quarantine or drop in a single hop. Scoring Per-msg Signals Multi Actions 5 verbs ### Location-tracking detection AnyTimeInterrogation, ProvideSubscriberInfo, ProvideSubscriberLocation and SendRoutingInfo abuse are caught at first contact. Foreign GTs probing for IMSI–MSC–VLR tuples are blocked before a single subscriber is geolocated. ATI Blocked PSL Origin-checked SRI Cache-validated ### SMS fraud at the signaling layer MT-ForwardSM is validated against a live SRI-SM cache by IMSI / MSC / SMSC tuple. Spoofed sender IDs, A2P leakage onto grey routes and SIM-swap reconnaissance are stopped before the SMSC sees them, not after. SRI cache 24h TTL Spoof Blocked A2P leak Recovered ### Forensic audit logging Every signaling decision is committed to a tamper-evident audit store with HMAC-signed event chains. Regulator-ready exports, role-based dashboards and incident replays — your NOC sees what the firewall saw, frame-for-frame. Retention 12 mo Signed HMAC Export Regulator Threat catalog ## What we see crossing your border. The five signaling attack classes that account for most subscriber harm and most operator revenue loss — and the layer at which the firewall catches each one. ### SMS spoofing MAP · MT-ForwardSM Originator addresses fabricated to impersonate banks, brands and government services. Caught by SRI-SM cache mismatch and sender-ID registry cross-check. ### Location tracking MAP · ATI / PSI / PSL Foreign GTs query the HLR to triangulate a subscriber's serving cell. Blocked at the network boundary as GSMA FS.11 Category 1 messages. ### SIM-swap reconnaissance MAP · SendIMSI / UpdateLocation Attackers probe for IMSI–MSC bindings ahead of social-engineered swaps. Pattern-scored per origin, then quarantined for fraud-team review. ### Fraud calls and CLI spoofing CAP · InitialDP / SS7 IAM International revenue-share fraud, Wangiri loops and spoofed CLIs intercepted at the signaling layer before they ring the subscriber. ### A2P leakage and grey routes MAP · MT-ForwardSM Unmonetized enterprise traffic injected via roaming partners. Forced onto the agreed commercial route — or blocked, with the revenue recovered. Attack catalogue · MAP layer ## Two MAP operations behind most signalling abuse. Two MAP operations explain a disproportionate share of the subscriber-privacy and OTP-interception incidents reaching regulators today. The firewall handles both at the international edge — categorised, scored and signed — before they reach a home HLR or SMSC. GSMA FS.11 Categories 1 & 2 FS.11 · Cat 1 Boundary drop MAP_PROVIDE_SUBSCRIBER_INFO ### Location tracking Foreign HLR probes that resolve to a serving cell ID, used by surveillance operators and abusers to triangulate a subscriber's real-world position. The firewall classifies these as GSMA FS.11 Category 1 and drops them at the network boundary, with a signed audit entry for the regulator file. Operator impact · Subscriber-privacy compromise FS.11 · Cat 2 Boundary drop MAP_SEND_ROUTING_INFO_FOR_SM ### SMS interception groundwork SRI-SM queries that map a subscriber to their serving MSC/SMSC, the reconnaissance step before MT-ForwardSM hijack of OTP and 2FA traffic. The firewall validates each query against a 24-hour SRI-SM cache; cache-miss queries from foreign GTs quarantine for fraud-team review. Operator impact · OTP / 2FA bypass enablement 3-pillar rule engine ## Technical. Business. Dynamic. One verdict. The signalling layer needs protocol enforcement, commercial policy, and behaviour-aware adaptation in the same engine. The three pillars run as one decision path — sub-5 ms inspection latency per signalling unit — so the right verdict reaches the right network element on the first hop. Pillar 01 ### Technical rules Protocol-level enforcement at the signaling layer. MAP operation allow/deny, Global Title filtering, OPC/DPC point-code controls, MCC/MNC conditions per partner. Every malformed or out-of-context signaling unit drops at decode. MAP allow/deny GT filter OPC/DPC MCC/MNC Pillar 02 ### Business rules Commercial and operational policy expressed as data. Route selection per partner agreement, product-class policies (OTP, transactional, promotional), monetisation of bypass traffic toward agreed A2P channels. The firewall enforces the contract, not just the spec. Route policy Per-partner OTP vs promo Monetise bypass Pillar 03 ### Dynamic controls Behaviour-aware enforcement that adapts to live traffic. TPS thresholds, burst detection, time-of-day windows, velocity per origin GT. The dynamic layer catches what static rules cannot — emerging campaigns, new SIM-box farms, sudden roaming anomalies. TPS thresholds Burst detect Time windows Velocity Sub-5 ms inspection latency per signalling unit · decode + score + verdict All common signalling vendors Active-active STP pairs SIGTRAN M3UA · M2PA · SUA MAP · CAP · SCCP inspection Inline · in front of the SMSC Out-of-band tap option Policy DSL ## Rules your signaling engineers already think in. FS.11 categorisation expressed as readable YAML. MAP and CAP operations named, not numbered. Sender-ID, route and A2P rules promoted through maker-checker — versioned, signed, auditable. ss7fw.operator.local · rule pack v2026.1 Example ``` 1# /etc/broadnet/ss7fw/rules.d/fs11-category1.yaml2# GSMA FS.11 Category 1 — never crosses the network boundary3rule: cat1_ati_block4 match:5 application_context: anyTimeInterrogation6 origin: !is_home_network7 action: drop8 audit: regulator.signal_event9 fs_tag: FS.11-CAT110 11rule: cat1_psi_block12 match:13 application_context: provideSubscriberInfo14 origin: !is_home_network15 action: drop16 fs_tag: FS.11-CAT117 18# Category 2 — origin must be validated against home-network MAP19rule: cat2_sri_sm_validate20 match:21 application_context: sendRoutingInfoForSM22 validate:23 msc_id: from sri_sm_cache(ttl=24h)24 on_mismatch:25 action: quarantine26 notify: fraud-ops@operator.tld ``` Illustrative operator scenarios ## What signaling protection looks like in production. Tier-1 GCC operator MNO · GCC SA **Challenge** subscriber location-tracking probes were an active regulator concern with no domestic deterrent in place. **Approach** FS.11 categorization at the international SS7 edge, plus an SRI-SM cache for spoof detection. Signaling security lead Cat 1 Location probes blocked at edge SRI-SM Spoof detection live West African MNO group MNO · West Africa NG **Challenge** international STPs across multiple vendor stacks made the quarterly regulator return a manual exercise. **Approach** a single policy DSL unified rule enforcement across every edge with a versioned audit trail. Network security lead Unified One rule pack, every STP edge Quarantine Grey-route SMS held for review Levant MNO MNO · Levant JO **Challenge** the national regulator required FS.11 conformance evidence on short notice during an annual review. **Approach** rule-pack versioning produced a signed manifest plus an IR.71 / IR.82 regression report in a single run. Senior signaling engineer Signed FS.11 conformance manifest IR.82 Regression in one run Where it sits ## International signaling in. Clean traffic out. Inline between the international STP and your core. Every message passes the firewall before it reaches an HLR, SMSC or MSC — and every decision is streamed to your NOC in real time. Int'l STP SS7 / SIGTRAN Roaming partner SS7 / MAP Grey route Untrusted GT BroadNet Signaling Firewall Active / Active Decode Sender ID Route check SRI-SM cache Content filter Geo / origin Rate limit Policy DSL Audit log HLR SMSC MSC Billing Deployment options ### In-line at the STP ACTIVE / ACTIVE Active-active pair sits on the international signaling path. Decisions are enforced in real time — block, allow, modify, monetize. ### Out-of-band tap DETECT ONLY Mirror feed from the STP for baseline establishment and analytics. Move to in-line enforcement when policy and false-positive rates stabilize. ### Hybrid edge + core EDGE + CORE International edge runs in-line, domestic core runs in detect-and-alert. Common policy plane, common audit store, one operator dashboard. Compliance ## Aligned with the standards your regulator already reads. GSMA FS.11 categorization for SS7 interconnect is enforced by default and maintained by the BroadNet signaling security team, with regulator-ready exports on demand. GSMA Associate Member BroadNet is a GSMA Associate Member GSMA FS.11 SS7 interconnect security categorization (Cat 1–3) Revenue assurance A2P monetization and grey-route recovery, built in Regulator exports Country-specific signaling reports on demand Operator due diligence ## Eight answers for the RFI shortlist. Yes. The firewall presents as an SCCP/SIGTRAN signaling peer and integrates with the common STP platforms operators run today, across mixed vendor stacks. No STP routing-table surgery is required beyond redirecting the international point codes through the firewall pair. We almost always start with an out-of-band mirror from the STP for 14–30 days. That gives the security and RA teams a clean baseline of the international traffic and lets us tune the FS.11 rule pack against the operator's actual roaming-partner mix. Once the false-positive envelope is agreed in writing, the firewall flips to inline active-active. Hybrid (inline at the international edge, mirror at the domestic core) is the common steady state. BroadNet's signaling security team publishes a versioned rule pack every quarter, with hot-fix patches for new threat intelligence pushed in days. Each rule pack ships with the IR.71, IR.81, and IR.82 conformance test packs so your team can run regression before promoting it. The operator pins or vetoes any version from the dashboard — nothing is auto-promoted to production. Per inspected signaling unit (MAP/CAP), banded by monthly volume. No per-link, per-point-code or per-Erlang fee. There is a one-time NRE for the STP integration and a small annual maintenance fee covering rule-pack updates, the threat-intel feed, and quarterly architecture reviews. Operators typically see payback from recovered A2P revenue and avoided fraud loss. Yes. The policy DSL is the same one our security team uses internally. Operators routinely write rules to enforce their bilateral roaming agreements, to whitelist authorized law-enforcement location queries, to monetise specific bypass flows rather than drop them, and to feed verdicts to in-house SIEM and fraud platforms. Custom rules go through the same maker-checker promotion as ours, with full audit trail. TTL is 24h by default and tunable per operator. The cache is populated from observed legitimate SRI-SM and refreshed on every successful MT-ForwardSM. We expose hit rate, miss rate, and quarantine rate per partner GT so RA teams can spot a sudden cache miss spike (usually the first sign of a spoofing campaign or a partner re-keying their SMSC GT). Yes. Every decision is HMAC-signed, written to a tamper-evident store, and retained for the operator's regulatory window. We ship pre-built export templates for TRC (Jordan), CST (KSA), NCC (Nigeria), TDRA (UAE), CRA (Qatar), TRA (Oman), TRA (Bahrain), ARPT (Algeria), ANRT (Morocco), and INT-T (Tunisia). The export module also produces the FS.11 conformance manifest that several MENA regulators now ask for at licence renewal. In steady state, false positives against bona-fide roaming partners are very low. We measure the rate weekly and expose the per-partner number in the dashboard, so RA teams always see it. The mirror-mode bake-in phase exists exactly so that this envelope is agreed and signed off before enforcement goes live. Need the FS.11 conformance manifest or a working session with our signaling engineers? [Request signaling security review](https://www.broadnet.me/contact?topic=signaling-security&product=ss7-firewall) ## Related operator products [All operator products](https://www.broadnet.me/operators) [SMS firewall Application-layer SMS firewall sitting on the SMPP interface to your SMSC. Learn more](https://www.broadnet.me/operators/sms-firewall) [Signalling & CDR intelligence Vendor-agnostic capture and correlation for SS7, SIGTRAN and SIP — the companion intelligence layer. Learn more](https://www.broadnet.me/platforms/signaling-cdr) [SMSC gateway Hosted SMSC with multi-routing, multi-language and unified billing. Learn more](https://www.broadnet.me/operators/smsc-gateway) [Performance system Real-time observability across firewall, SMSC, signaling and routes. Learn more](https://www.broadnet.me/platforms/performance-system) Signaling protection · operator-grade ## Protect signaling. Stop grey routes. Schedule an operator briefing. We'll walk the FS.11 categorization, the SRI-SM cache, the A2P monetization model, and the deployment plan for your network — backed by 24/7 BroadNet NOC support. [Request signaling security review](https://www.broadnet.me/contact?topic=signaling-security&product=ss7-firewall) [Discuss network protection](https://www.broadnet.me/contact?topic=network-protection&product=ss7-firewall) $ ss7fw --policy fs11 --mode inline --audit signed Resources SS7 Firewall datasheet [Download datasheet· PDF, 100 kB](https://www.broadnet.me/resources/datasheets/broadnet-ss7-firewall-datasheet.pdf) [Product datasheets](https://www.broadnet.me/resources) Related guides & answers Go deeper on the concepts behind this product. [What is SS7 Read](https://www.broadnet.me/answers/what-is-ss7) [How does SS7 and Diameter signaling security work Read](https://www.broadnet.me/answers/ss7-signaling-security) [How does Diameter signaling security work Read](https://www.broadnet.me/answers/diameter-signaling-security) [How does telecom fraud prevention work Read](https://www.broadnet.me/answers/telecom-fraud-prevention)