If you run a mobile network, an SMS hub, or an MVNO that connects to one, you share a signaling layer that was built when every connected operator was assumed to be honest. An SS7 firewall is the control that stops that assumption from being exploited.
This guide explains what an SS7 firewall is, how SS7 firewall signaling works message by message, which attacks it blocks, and where it falls short. You will also get a checklist for deployment and vendor evaluation.
Quick Answer
An SS7 firewall is a signaling security system placed at an operator’s SS7 interconnect. It inspects incoming and outgoing SS7 messages, checks them against rules and subscriber data, and blocks or flags those that should not be on the interconnect, such as location queries from unknown networks. It reduces SS7 attack exposure but cannot fix the protocol itself.
Key Takeaways
- An SS7 firewall inspects MAP, CAMEL and SCCP traffic, not IP packets in the usual sense. It needs to understand telecom message semantics.
- GSMA FS.11 sorts MAP messages into three categories. Category 1 is the easiest to block, Category 3 needs subscriber context and correlation.
- The most documented abuse cases are location tracking, SMS interception, call forwarding abuse and denial of service.
- A sms firewall lowers risk but does not eliminate it. SS7 has no built-in authentication between operators.
- SS7 stays in service for years in many markets because of 2G, 3G, roaming and IoT dependence, so the firewall remains relevant.
- Rule tuning, partner whitelists and monitoring matter as much as the product you choose.
What Is SS7 and Why Does the SS7 Network Still Matter?
Signaling System No. 7 (SS7) is a set of telephony signaling protocols used to set up and end calls, deliver SMS, and support subscriber mobility between networks. The SS7 network is the signaling layer that lets your HLR, MSCs and partner operators exchange this information.
The SS7 protocol stack has a few layers worth knowing:
- MTP carries messages between signaling points. Today this is often replaced by SIGTRAN, which transports SS7 over IP using SCTP and M3UA.
- SCCP handles addressing and routing, including Global Title (GT) translation.
- TCAP manages transactions between nodes.
- MAP (Mobile Application Part) carries the mobility and messaging operations, such as location updates and SMS routing.
The problem is trust. SS7 was designed for a small club of state telecom carriers. The European Union Agency for Cybersecurity (ENISA) notes that 2G and 3G networks rely on SS7, a protocol designed decades ago without security in mind. Once any party gets legitimate looking access to the interconnect, many nodes will answer its requests.
Example: In 2014, researcher Tobias Engel presented SS7 tracking and interception methods at the Chaos Communication Congress in Berlin. In 2017, O2 Telefónica in Germany confirmed to Süddeutsche Zeitung that customers had been robbed through a two stage attack. Criminals first stole banking credentials with malware, then used SS7 to redirect the SMS authorization codes. Press reports at the time said access to the signaling network could be bought for under 1,000 euros.
SS7 is not going away quickly. Analysts at ABI Research noted years ago that 2G usage stays high in markets such as Africa and Latin America, and that machine to machine networks on 2G and 3G also keep SS7 in use. If you serve those markets, as many operators and aggregators do, the exposure is current, not historical.
What Is an SS7 Firewall and How Does It Work?
An SS7 firewall is a signaling security function that screens SS7 traffic at the interconnect between your network and other operators. It reads the SCCP and MAP content of each message, applies policy and subscriber checks, and then allows, blocks, rewrites or reports the message.
In practice it sits in front of or alongside your STP and protects the nodes behind it: HLR, MSC/VLR, SMSC and others. Its job is to answer one question for every message: should this operation arrive here, from this source, for this subscriber, at this moment?
Example: A foreign network sends an Any Time Interrogation (ATI) request to your HLR asking where a subscriber is. ATI is not something a normal partner needs to send on the interconnect, so the firewall drops it and logs the source GT. Without the firewall, the HLR may simply answer with the subscriber’s cell location.
The GSMA publishes the reference for this: FS.11, the SS7 Interconnect Security Monitoring and Firewall Guidelines. It describes how to monitor SS7 traffic, what to detect, and how to set firewall policy. The GSMA first approved FS.11 in November 2015 and has updated it since. The document is for GSMA members, so most operators work from it through their vendor or their security team.
What Are the Most Common SS7 Attacks?
The most common SS7 attack types fall into four groups: tracking, interception, fraud and denial of service. Each one abuses a legitimate MAP operation that an attacker sends from a position on the interconnect.
Location tracking: The attacker asks the network where a subscriber is. Operations such as Send Routing Info for SM, Provide Subscriber Info and Any Time Interrogation can reveal the serving MSC and cell information. The attacker needs only the phone number.
SMS interception: The attacker sends an Update Location message claiming that the victim is now roaming on the attacker’s fake MSC/VLR. The HLR updates its record, and the next incoming SMS goes to the attacker. This is the mechanism behind stolen OTP codes.
Call forwarding and call interception: By inserting subscriber data or abusing CAMEL services, attackers can change forwarding settings or redirect call setup.
Denial of service: Messages such as Cancel Location or Purge can knock a subscriber off the network or cut off their service until they re-register.
Example: The German bank thefts above combine two of these: credentials stolen by malware, then SMS interception through SS7. The firewall did not exist as a standard control at most operators at that time, and the incident pushed signaling security up many regulatory agendas.
Caution: attack tooling, surveillance vendors and leased Global Titles keep this threat alive. In April 2026, reports on a Citizen Lab investigation described surveillance campaigns that abused SS7 and Diameter through small carriers as entry points.
How Does SS7 Firewall Signaling Work, Step by Step?
SS7 firewall signaling works by intercepting each message at the interconnect, parsing its SCCP and MAP fields, scoring it against policy, and then taking an action. The sequence below is a general model. Product implementations differ.
Step 1: Receive the message
The firewall sits in the signaling path or receives a copy. Inbound traffic arrives from partner operators over SS7 links or SIGTRAN associations.
Step 2: Decode SCCP and MAP
It extracts the calling party GT, called party GT, MAP opcode, and subscriber identifiers such as IMSI or MSISDN.
Step 3: Apply Category 1 rules
Is this opcode allowed from outside at all? A Send IMSI from a foreign GT, for example, is typically blocked by default.
Step 4: Apply Category 2 rules
Does the message make sense for this partner and this subscriber? A cancel location request should come from the subscriber’s real home network, not from a random one.
Step 5: Apply Category 3 checks
Compare the message against recent history. If a subscriber’s Update Location arrives from Country B ten seconds after one from Country A, one of them is false.
Step 6: Act
The firewall allows, blocks, replies with an error, or alerts. It logs the source, opcode and decision for analysts.
Step 7: Feedback
Analysts tune rules, whitelist valid partner behavior, and update blocklists based on what the logs show.
You know the setup works when partner traffic such as legitimate roaming updates and SMS routing passes cleanly while test attack messages from unauthorized sources are rejected and logged.
The Three GSMA Message Categories
FS.11 groups MAP messages by where an operator can reasonably expect them. This is the core logic of most SS7 firewall rule sets.
| Category | Meaning | Example operations | Typical firewall action |
| Category 1 | Messages that should not arrive from outside the network unless a specific agreement exists | Send IMSI, Send Routing Info, Any Time Interrogation | Block by default, whitelist exceptions |
| Category 2 | Messages that are only valid from a subscriber’s home network, for a roaming subscriber | Cancel Location, Insert Subscriber Data, Unstructured SS | Validate that source and subscriber match |
| Category 3 | Messages that are valid from many places but can be abused through inconsistency | Update Location, Provide Roaming Number | Check against subscriber location and timing |
What this means in practice: Category 1 is cheap and effective, and operators usually start there. Category 2 needs subscriber data. Category 3 is hardest because the message itself looks legitimate, so you need correlation across messages, for example comparing the claimed location against a recent record. Vendors and operators often report that most flagged traffic sits in Category 1, but figures vary widely by network and I recommend you measure your own interconnect before setting expectations.
SS7 Firewall vs a Regular Network Firewall
An SS7 firewall differs from a regular network firewall because it understands telecom signaling semantics, not just addresses and ports. A standard firewall can tell you that an SCTP connection exists between two peers. It cannot tell you that the message inside is a location query for a subscriber who is currently in your home network.
| Feature | Regular network firewall | SS7 firewall |
| Inspects | IP addresses, ports, protocols | SCCP addresses, TCAP, MAP opcodes, subscriber IDs |
| Decision basis | Rules on packet headers and sessions | Opcode, source GT, subscriber state, timing |
| Needs subscriber data | No | Often yes (HLR or location data) |
| Knows about roaming | No | Yes |
| Typical location | Network perimeter | STP or interconnect signaling path |
| Stops | Port scans, malware traffic | Tracking, interception, spoofed signaling |
You usually need both. The IP firewall protects the SIGTRAN transport. The SS7 firewall protects what travels on it.
Deployment Options: Inline vs Monitoring
Operators generally deploy signaling security in one of two ways, and many use a mix.
| Approach | How it works | Strength | Trade off |
| Inline (active) | Traffic passes through the firewall, which can block it | Can stop attacks in real time | Becomes a critical node, so redundancy and latency testing matter |
| Monitoring (passive) | A probe or copy of traffic is analyzed, with alerts only | Low risk to live traffic, good for baselining | Cannot block, only detect |
A common path is to start with monitoring for several weeks, learn what normal partner traffic looks like, then move to blocking Category 1 and 2 with a tested rollback plan. Skipping that learning phase is how legitimate roaming traffic gets dropped.
Hypothetical scenario (illustrative, not a real customer case): An operator turns on blocking for Send Routing Info on day one. A partner’s legitimate service sends that operation under a bilateral agreement. Without a whitelist, the partner’s service fails and the support desk finds out before the security team does.
Can SS7 Vulnerabilities Be Fully Eliminated?
No. An SS7 firewall reduces exposure but does not remove the weakness in the protocol. SS7 has no native mechanism for one operator to cryptographically prove its identity to another. Trust is based on being connected.
Specific limits to plan for:
- Valid looking access: An attacker who rents a legitimate GT or compromises a smaller carrier appears as a real partner. Category 3 correlation helps but is not perfect.
- Your own coverage only: The firewall protects your network. Your subscribers remain exposed when roaming on poorly protected networks.
- False positives and false negatives: Tight rules break services, loose rules let attacks pass.
- Downgrade and radio side attacks: Attacks using fake base stations can push devices to 2G, which sits outside what an SS7 firewall controls.
- SMS as a security factor: Even with a good firewall, SMS OTP remains weaker than app based or hardware authentication for high value actions.
The industry direction is also worth knowing. Diameter replaced SS7 in 4G and has its own signaling weaknesses, which is why Diameter firewalls follow the same logic. In 5G standalone networks, the 3GPP defined Security Edge Protection Proxy (SEPP) adds protection at the roaming edge. Most real networks still run a mix of generations, so SS7 protection continues alongside these.
SS7 Attack Prevention for MVNOs and Aggregators
MVNOs and SMS aggregators face a different version of this problem than a full MNO. Many do not own an HLR or an STP, so they rely on a host operator or a signaling provider for SS7 access. The firewall then belongs partly to someone else.
If you are an MVNO, ask your host MNO three things: which GSMA FS.11 categories they enforce, whether SMS home routing is active for your subscribers, and what visibility you get into blocked events. You cannot protect what you cannot see.
If you are an SMS aggregator, your exposure shows up differently. SS7 connectivity for SMS termination, HLR lookups and routing sits in your supply chain. Fake or grey signaling sources can also damage your reputation with upstream partners. In that case, SS7 screening works together with controls at the messaging layer: SMS home routing, sender validation, grey route detection and anti spoofing checks at your SMS gateway.
Best Practices for SS7 Network Security
- Baseline first: Run monitoring mode and map normal traffic per partner before you block anything.
- Block Category 1 early: It gives the largest risk reduction for the least rule complexity.
- Whitelist deliberately: Document every exception, its business reason, and its owner.
- Add SMS home routing: It hides IMSI and serving node details from SMS routing queries, which removes a common tracking path.
- Build Category 2 and 3 with subscriber data: Integrate with HLR and location records so checks use real state.
- Plan for failure: If the firewall is inline, design redundancy and a bypass procedure, and test both.
- Review logs on a schedule: Blocked events show which GTs are probing you. Share intelligence with trusted partners.
- Check the whole signaling family: Add Diameter and GTP screening where you run 4G, and align with the GSMA documents FS.07, FS.19 and FS.20 where relevant.
- Protect the business layer too: Move high value authentication away from SMS OTP where you can.
Common Mistakes to Avoid
- Buying the product and stopping: A firewall with default rules and no tuning gives a false sense of safety.
- Turning on blocking without a learning phase: This breaks legitimate roaming and partner services.
- Ignoring outbound and transit traffic: Your network can be used as a stepping stone or abused for spoofing.
- Treating SS7 as a 2G problem only: Interworking between 4G, 5G and legacy networks keeps SS7 reachable.
- No owner: Signaling security touches core, roaming, fraud and security teams. Without one accountable owner, alerts go unread.
- Measuring only blocked counts: A high block count can mean good protection or heavy probing. Track false positive rate and partner complaints too.
Conclusion
An SS7 firewall is the practical answer to a protocol that trusts every connected party. It screens the SS7 network at the interconnect, blocks operations that should not be there, and gives you the logs to see who is probing you. It does not make SS7 secure by itself, so the strongest setups combine GSMA FS.11 rules, SMS home routing, monitoring and better authentication than SMS codes.
If you are building or reviewing your SS7 firewall strategy, start with a traffic baseline and a Category 1 policy. The rest follows from what the data shows.
Next step: The messaging layer is where many operators and aggregators close the remaining gaps. TeleOSS builds SMS Gateway Software and an SMS Wholesale Solution that handle SMS routing and delivery control. If you want to review how your SMS routing sits alongside your signaling security, contact the TeleOSS team for a technical discussion of your setup.
FAQs
What is an SS7 firewall and how does it work?
An SS7 firewall inspects signaling messages at the operator interconnect and applies rules based on the message type, the sender’s Global Title and the subscriber involved. It blocks messages that should not appear, such as location queries from unknown networks, and flags suspicious but valid looking messages for analysis.
What are the most common SS7 attacks?
The most common SS7 attacks are subscriber location tracking, SMS interception through fake Update Location requests, call forwarding manipulation and denial of service using messages like Cancel Location. SMS interception has been used to steal banking authorization codes, as confirmed in the 2017 O2 Telefónica Germany case.
Is SS7 still used in modern telecom networks?
Yes. SS7 remains the signaling base for 2G and 3G, international roaming interworking, and SMS delivery in many networks. 2G and 3G are still significant in several regions, and 4G and 5G networks often interwork with SS7 through gateways. Regional sunset timelines differ, so exposure persists.
How does an SS7 firewall differ from a regular network firewall?
A regular firewall filters IP traffic by address, port and protocol. An SS7 firewall reads telecom signaling content, including SCCP addresses and MAP operations, and checks them against subscriber and roaming context. One protects the transport, the other protects the signaling logic that runs on it.
Can SS7 vulnerabilities be fully eliminated?
No. The weakness is in the protocol’s trust model, so a firewall can lower risk but cannot remove it. Attackers with valid looking network access are the hardest case. Layers help: firewall rules, SMS home routing, monitoring, partner agreements and stronger authentication than SMS OTP.
Do MVNOs need their own SS7 firewall?
Usually the host MNO or signaling provider operates the firewall. An MVNO should confirm which protections cover its subscribers, request visibility into blocked events, and write signaling security expectations into the wholesale agreement.
How long does it take to deploy an SS7 firewall?
It depends on architecture, vendor and how many partners you have. The planning and baselining phase is often the longest part, because rules need real traffic data. Avoid fixed timelines from vendors without a review of your own signaling topology.
