Secure MAP Roaming with SS7 Firewalls: Filtering Operations by Client
Mobile roaming depends on MAP messages travelling between home and visited networks through SS7 or SIGTRAN infrastructure. That connectivity supports location updates, authentication, SMS delivery, call forwarding and subscriber data exchange, yet an overly broad trust model can expose sensitive operations to fraud, surveillance and signalling abuse.
Secure MAP roaming with SS7 firewalls works best when policy is tied to the client using the network, rather than applied as a single rule set for every partner. A domestic carrier, international roaming hub, MVNO or enterprise signalling customer may require different permissions, traffic volumes and inspection depth.
| Client type | Typical MAP needs | Useful firewall controls |
|---|---|---|
| Domestic mobile operator | Authentication, location update, SMS and call services | Allowlisted GTs, roaming agreements and rate limits |
| International roaming partner | Agreed subscriber and mobility procedures | Operation-level filtering and SCCP screening |
| MVNO | Restricted access through a host network | Narrow MAP scope and strict volume thresholds |
| Signalling hub | Transit between multiple carriers | Per-client isolation, route validation and anomaly detection |
| Test or training environment | Simulated MAP and TCAP traffic | Synthetic identities and deny-by-default rules |
Why Client-Aware Filtering Matters
MAP is carried within TCAP and SCCP, so a firewall can inspect several layers before deciding whether to pass a transaction. Looking only at IP addresses or SCTP associations is insufficient. A legitimate peer may still send an unexpected operation, use an unauthorised global title or request data outside its roaming relationship.
Client-aware filtering associates each signalling session with a known customer, route, agreement and service profile. For example, an Australian MVNO might need authentication and SMS procedures through its host operator but have no reason to issue unrestricted subscriber-information requests. The policy should reflect that commercial and technical boundary.
This approach also reduces blast radius. If a roaming partner is compromised, its access remains limited to approved MAP operations, destinations and transaction rates. The same principle applies to signalling hubs in Sydney or Melbourne carrying traffic for several carriers: one client’s trust should never become another client’s access.
Build Identity and Policy Context
A firewall should identify traffic using a combination of SCTP association, source signalling point code, SCCP calling and called party addresses, global title translation results, and the customer or partner record. IP allowlisting remains useful, but it should be treated as one signal rather than proof of authorisation.
Policy records should include the home network, visited network, IMSI ranges where appropriate, permitted global titles, roaming direction and expected MAP procedures. A rule can then distinguish inbound and outbound traffic, such as a foreign visitor updating location in Australia versus an Australian subscriber roaming overseas.
Global title screening deserves particular care. Unexpected translation patterns, private or reserved numbering ranges, malformed SCCP addresses and sudden changes in point-code behaviour should trigger rejection or quarantine. Documentation such as ISUP and Q.931 mapping can also help engineers understand how signalling interworking affects adjacent call-control procedures.
Permit MAP Operations Safely
A practical ruleset starts with the minimum operations needed for each service. Authentication and location management may require selected Update Location, Insert Subscriber Data, Cancel Location and Send Authentication Info procedures. SMS roaming can require Forward Short Message, while call diversion or routing services may involve different subscriber-data exchanges.
The firewall should validate operation direction, dialogue context and parameter structure. A message that is technically valid can still be inappropriate if it arrives from the wrong client or targets a subscriber range outside the agreement. Screening should cover sensitive identifiers, unexpected address types, abnormal transaction lifetimes and attempts to reuse stale dialogues.
Rate controls are equally important. Set baselines per client, operation and destination, then alert on bursts, repeated failures, unusual international patterns or a sharp increase in cancelled locations. A security team may investigate a few rejected requests, while automated controls can temporarily restrict a client that produces sustained abnormal traffic.
Account for Australian Roaming Conditions
Australian networks operate across major urban centres and vast regional and remote areas, including Western Australia, Queensland and the Northern Territory. A handset moving between coverage footprints can create legitimate location-update variation, especially where visitors use a partner network or where coverage is sparse. Rate thresholds should account for geography and planned events rather than treating every change as hostile.
The market also includes large operators such as Telstra, Optus and Vodafone, alongside MVNOs and international roaming aggregators. Each relationship may have different signalling paths and commercial limits. During a busy period in Sydney, Melbourne or the Gold Coast, traffic growth may be normal; a comparable spike from one obscure global title at three in the morning may deserve immediate review.
Emergency communications add another operational concern. Controls must be tested so that roaming-related restrictions do not interfere with lawful emergency service handling, including Triple Zero processes. Australian operators should align monitoring, retention and access practices with applicable ACMA expectations, privacy obligations and internal incident-response procedures.
Monitor, Test and Enforce
Logging should capture the client identity, timestamp, SCCP and MAP operation, transaction outcome, translated addresses and policy decision. Avoid collecting unnecessary subscriber data in routine dashboards; use masked identifiers and tightly controlled access. Correlating firewall events with roaming records, fraud systems and network performance tools makes unusual behaviour easier to confirm.
Testing should use a lab or controlled partner connection with synthetic subscribers. Verify approved location updates, authentication and SMS flows, then test malformed parameters, unauthorised operations, wrong-direction messages, replay attempts and excessive transaction rates. Do not use random third-party software or untrusted APK sources as part of a signalling test workflow; unmanaged downloads can introduce a separate security risk.
The strongest deployment uses deny-by-default policies, documented exceptions, staged enforcement and regular partner reviews. Start in detection mode, compare decisions with real roaming records, then enforce the rules in stages while keeping an audited rollback path. In practical terms, give every client only the MAP operations, routes and volume it needs, and review those permissions whenever the roaming agreement or traffic pattern changes.
