Signaling Firewall
A signaling firewall is the perimeter control that inspects the mobile network's control-plane traffic, the protocols used between operators and between core network functions, and applies an allow/deny/throttle policy before the traffic reaches the core. Unlike a data firewall it does not look at user payload; it looks at SS7/SIGTRAN dialogues, Diameter sessions, GTP-C tunnels, GTP-U user-plane headers, and SMS submission. It typically sits at the STP for SS7, at the DEA (Diameter Edge Agent) for Diameter, at the roaming border for GTP, and at the SMSC front-end for SMS, and increasingly at the SEPP for 5G N32 interconnect.
The reason operators treat signaling as a firewalled boundary is straightforward: every interconnect partner is, from the home network's point of view, an untrusted source. The GSMA defines per-protocol category models that the firewall implements as rule sets: FS.11 for SS7 (Category 1/2/3 message screening), FS.19 for Diameter (per-interface and per-AVP filtering on S6a, S9, S13 and others), FS.20 for GTP roaming, and FS.21 for SMS. A modern signaling firewall does not just apply each model in isolation; it correlates state across protocols so that, for example, an SS7 SendRoutingInfo followed by a Diameter Update-Location-Request from a different visited network is recognised as a roaming-anomaly pattern, not two independent legitimate transactions.
On a 4G EPC the firewall protects the HSS, MME, S-GW and P-GW from S6a/S9/S6d abuse; on a 5G SBA core the SEPP plus a signaling firewall protect the AUSF, UDM, AMF, SMF and NRF from N32-borne attacks. In every case the firewall produces the cross-protocol audit trail needed for incident response, regulator reporting under regimes such as NIS2, and continuous validation through a telecom penetration test. See the protocol-specific guides for detail: SS7 Firewall, Diameter Firewall, GTP Firewall and SMS Firewall.
Frequently asked questions about signaling firewall
Do I need a Diameter firewall if I already have an SS7 firewall?
Yes. SS7 firewalls filter at the SCCP/MAP/CAP layer and do not see Diameter traffic, which uses a different transport (SCTP/TCP with TLS/IPsec) and different attack semantics (S6a IDR/PUR, S9, S13). GSMA FS.19 defines category 1/2/3 screening rules that a Diameter Edge Agent (DEA) must enforce independently. Operators running 4G/LTE interconnect need both firewalls; consolidated signaling firewalls implement the FS.11/FS.19/FS.20 rule sets in a single policy engine.
What does GSMA FS.20 require for GTP firewalling?
GSMA FS.20 defines category-based screening for GTP-C and GTP-U at GRX/IPX borders, structured similarly to FS.11 (SS7) and FS.19 (Diameter). It covers cross-plane filtering (GTP-U packets must not carry control-plane commands), source-address validation against IR.21-declared prefixes, TEID sanity checks, IMSI/APN allowlisting for known roaming partners, and rate limits to blunt DoS. The document is periodically revised; the current baseline is a mandatory reference for operators offering LTE roaming.
What is GSMA FS.19 for Diameter roaming security?
GSMA FS.19 is the Diameter Interconnect Security recommendations document, structurally analogous to FS.11 for SS7. It defines category-based filtering for Diameter roaming and interconnect messages (S6a, S9, S6d, S13, Rx) covering subscriber tracking, information disclosure, denial of service, and fraud/interception scenarios. Diameter firewalls at the DEA (Diameter Edge Agent) implement these categories at the LTE/4G roaming boundary.
What is a Diameter Edge Agent (DEA) and how does it enforce security?
A Diameter Edge Agent is the network element that terminates Diameter roaming and interconnect signaling at the border of an operator's network. It performs message routing, topology hiding, protocol translation, and security enforcement — validating origin realms, filtering Category 1/2/3 messages per GSMA FS.19, rate-limiting suspicious flows, and cross-checking VPLMN plausibility. In practice, most Diameter firewall functionality is deployed as a DEA feature.
What is a signaling firewall and how is it different from a network firewall?
A signaling firewall inspects and filters mobile network control-plane traffic — SS7 (MAP, CAP), Diameter, GTP-C, and SIP — at the interconnect and roaming boundaries. Unlike an IP firewall, which operates on L3/L4 headers, a signaling firewall parses telecom-specific protocol stacks and enforces category-based rules (GSMA FS.11 for SS7, FS.19 for Diameter, FS.20 for GTP) that reflect legitimate roaming and interconnect behavior. It blocks operations such as unauthorized SendRoutingInfo, cross-PLMN IDR abuse, or GTP-C tunnel injection that a generic firewall cannot see.
What is GSMA FS.11 and why does it matter for SS7 security?
GSMA FS.11 is the SS7 Interconnect Signalling Security Recommendations document. It classifies MAP operations into three categories: Category 1 (operations that should never appear across an interconnect and can be blocked outright), Category 2 (operations that are legitimate only from a subscriber's home network), and Category 3 (operations that require cross-checks such as velocity or plausibility). SS7 firewalls are typically configured against these categories, and telecom security audits verify coverage per FS.11.
What is the Security Edge Protection Proxy (SEPP) in 5G?
The SEPP is a mandatory 5G network function that sits at the operator's roaming boundary, replacing the unsecured SS7/Diameter interconnect model. It provides end-to-end message-level security (via JOSE/JWE) and transport-layer protection (TLS 1.3) for all inter-operator signaling, enforcing topology hiding and message filtering at the roaming edge.
What are the SEPP requirements for 5G roaming under 3GPP Release 16+?
Under 3GPP TS 33.501 the SEPP is mandatory for inter-PLMN N32 signaling: mutual TLS on N32-c for the negotiation of security capabilities, and either TLS or PRINS on N32-f for the actual JSON-based service traffic. When IPX providers must modify messages, PRINS is required so that sensitive IEs (SUPI, location, keys) are JWE-encrypted end-to-end while non-sensitive IEs remain modifiable under a signed patch. OAuth 2.0 tokens issued by the home NRF authorize NF-to-NF calls across the boundary.
Related glossary terms
- DEA Diameter Edge Agent
- Inter-PLMN Security
- FS.11 GSMA Vulnerability Disclosure Framework
- Interconnect Security Model
- Roaming Security Architecture
- SS7 Signaling System No. 7
- TCAP Abuse
- Threat Modeling
- Defense in Depth
- SS7 Message Categories
Related comparisons
Compliance crosswalks
Regulation by jurisdiction
- European Union ENISA + national NRAs (BNetzA, ARCEP, AGCOM, ANACOM, etc.)
- United States FCC + CISA + NIST + DOJ
- United Kingdom Ofcom + NCSC
- Germany BNetzA + BSI
- France ANSSI + ARCEP
- India DoT + TRAI + CERT-In
More on Signaling Firewall
Browse all topic hubs, the Ultimate Guide to Mobile Network Security and the TelcoSec Glossary.