SS7 Firewall

An SS7 firewall is a screening function placed in front of the mobile core to filter Signalling System No. 7 traffic that arrives from interconnect and roaming partners over SIGTRAN. It inspects messages at the SCCP layer (calling/called global title, point codes, subsystem numbers) and at the TCAP/MAP/CAP application layer (operation code, parameters, dialogue state) and enforces a policy of allow, deny, throttle, or quarantine before the message reaches the HLR, MSC/VLR, SMSC, or service nodes. In practice the firewall is co-located with, or terminates on, the operator's Signal Transfer Point (STP), so it sees every inbound and outbound SS7 dialogue.

The classification almost every operator follows is GSMA FS.11. Category 1 messages should never be received from outside the home network (for example MAP AnyTimeInterrogation, ProvideSubscriberInfo, SendIMSI): the firewall drops them at the perimeter. Category 2 messages are legitimate only from the visited network where the subscriber is actually roaming (for example UpdateLocation, CancelLocation, InsertSubscriberData): the firewall correlates them with current VLR/MME state and rejects ones that do not match. Category 3 messages are legitimate from any network (for example SendRoutingInfoForSM) but are abused at scale for location disclosure and silent SMS reconnaissance: the firewall applies plausibility, velocity, and SMS home-routing controls to neutralise the abuse without breaking legitimate roaming.

A correctly deployed SS7 firewall covers more than message-level filtering. It enforces SCCP calling-party screening so spoofed global titles cannot impersonate trusted partners, it cross-checks dialogue state across legs of a roaming procedure to defeat protocol-state attacks, it applies anti-IMSI-disclosure policy on every response that would otherwise leak IMSI to an outsider, and it produces the signaling audit trail an operator needs for incident response and regulatory reporting. See also the related SS7 Security hub for the underlying attack classes, the Signaling Firewall overview that places SS7, Diameter, GTP and SMS firewalls in one framework, and the Telecom Penetration Testing guide for how a firewall ruleset should be validated under real attacker traffic.