SS7 Over LTE: Gateway and MME Interworking
LTE replaces much of the traditional mobile core with an all-IP architecture, yet operators still depend on SS7 for legacy voice, roaming, SMS, lawful interception, and connections to older service platforms. This creates an interworking problem: circuit-switched network elements speak SS7, while LTE control-plane nodes generally use Diameter, GTP, and SIP.
The term SGW can cause confusion in this environment. In LTE specifications, SGW usually means Serving Gateway, a user-plane node that carries IP traffic between eNodeBs and the packet core. A Signalling Gateway, often abbreviated as SG or SIGTRAN gateway, performs a different role by transporting or adapting SS7 signalling over IP.
The MME is the key LTE control-plane element in this discussion. It manages mobility and bearer control, communicates with the HSS over Diameter on the S6a interface, and may coordinate legacy services through interfaces such as SGs. It does not directly replace every SS7 function performed by an MSC, STP, or service control point.
For engineers working across Australian mobile networks, this distinction matters during 3G retirement, enterprise migration, and roaming integration. A design that works in central Sydney may need different resilience, timing, and backhaul assumptions for regional Queensland, Western Australia, or remote Northern Territory sites.
Separating The Two SGW Meanings
The LTE Serving Gateway is part of the Evolved Packet Core. It anchors user-plane sessions as a handset moves between eNodeBs and forwards packets towards the PDN Gateway. Its protocols include GTP-U for traffic and GTP-C for control signalling, rather than MTP3, SCCP, or ISUP.
A Signalling Gateway connects SS7 domains to IP-based transport, commonly using SIGTRAN protocols such as SCTP, M2PA, M3UA, and SUA. It can provide an IP endpoint for an SS7 network while preserving upper-layer messages such as SCCP and TCAP. In some deployments, the gateway also supports protocol conversion or routing between legacy and modern signalling domains.
The two functions may exist in the same broad core architecture, but they solve separate problems. Calling a Serving Gateway a signalling gateway can lead to incorrect firewall rules, capacity planning, and fault-isolation procedures.
How The MME Fits The Interworking Path
The MME uses Diameter to authenticate and authorise LTE subscribers through the HSS. On S6a, it exchanges messages such as Update Location and Authentication Information, with routing commonly handled by Diameter agents. This is separate from the SS7 signalling path used by legacy mobile application parts and circuit-switched services.
For SMS over SGs, the MME communicates with an MSC or VLR using an SGs interface. The MSC remains involved in mobile-originated and mobile-terminated SMS, while the MME coordinates the LTE subscriber’s reachability and mobility state. A signalling gateway may carry the MSC’s SS7 traffic towards an IP-based backbone, but it does not turn the MME into an SS7 node.
Interworking therefore involves several logical boundaries: LTE radio access to the MME, Diameter to the HSS, SGs towards the legacy core, and SIGTRAN or SS7 transport towards an STP or service platform. Each boundary needs its own routing, timers, security policy, and observability.
Protocol Translation And Routing Behaviour
A gateway carrying SS7 over IP may encapsulate MTP3-user traffic using M3UA. SCTP supplies multihoming and association management, while the gateway uses routing keys and signalling point information to select the correct destination. Point codes, network indicators, global titles, and subsystem numbers must remain consistent across the design.
Diameter interworking is a separate translation task. A mediation platform may map subscriber identity, location, or service-state information between Diameter and legacy MAP or CAP environments. The mapping is not a simple packet conversion because the protocols have different transaction models, error codes, security assumptions, and timeout behaviour. The LTE signalling guide provides useful background for analysing these protocol boundaries.
Timers deserve particular attention. An MME may retry a Diameter transaction according to one set of rules, while an SS7 application uses TCAP or MAP timers with different expiry values. Poorly aligned timers can create duplicate requests, delayed SMS, phantom subscriber states, or unnecessary signalling storms during congestion.
| Function | Typical Protocols | Main Responsibility | Common Failure Symptom |
|---|---|---|---|
| MME | S1AP, Diameter, SGs | Mobility, authentication coordination, LTE control | Attach rejection or lost paging |
| Serving Gateway | GTP-C, GTP-U | User-plane anchoring and forwarding | Bearer interruption or packet loss |
| Signalling Gateway | SCTP, M3UA, SUA | SS7 transport across IP | SCCP or ISUP transactions unavailable |
| HSS | Diameter | Subscriber data and authentication vectors | Authentication timeout |
| MSC/VLR | SS7, MAP, SGs | Legacy mobility, voice, and SMS functions | SMS or circuit-service failure |
Resilience For Australian Networks
Australian operators commonly engineer for large distances between population centres and core locations. A gateway pair in Sydney or Melbourne may serve national traffic, while regional transport depends on long-haul fibre, microwave, or leased capacity. SIGTRAN SCTP multihoming can protect associations, but only if paths terminate on genuinely separate transport infrastructure.
Roaming adds another layer of complexity. Visitors moving through Melbourne, Perth, Brisbane, or airports such as Sydney Kingsford Smith may use international signalling routes with different point-code plans and security controls. Diameter routing agents, SS7 firewalls, and signalling gateways need clear ownership of roaming traffic so that an incident can be traced across domestic and international boundaries.
The 3G shutdown also changes the risk profile. Legacy dependencies may remain in SMS platforms, prepaid charging, emergency-service arrangements, private mobile networks, and enterprise gateways even after most consumer traffic has moved to LTE or newer radio access. Inventory work should identify every SS7 application before a gateway or MSC is decommissioned.
Security And Operations
SIGTRAN over SCTP should be protected with network segmentation, strict association filtering, signalling firewalls, and controlled access to management interfaces. IP reachability alone must not imply permission to originate MAP, CAP, ISUP, or SCCP traffic. Screening rules should consider global titles, point codes, subsystem numbers, message types, and expected roaming relationships.
The MME and Diameter edge require equivalent attention. Diameter peers should be authenticated where supported, restricted by transport policy, and monitored for unusual result codes, replay patterns, and sudden transaction growth. A fault in a Diameter routing agent can look like an LTE attach problem even when the radio network is operating normally.
Operational dashboards should correlate MME attach events, S6a transactions, SGs messages, SCTP association state, M3UA routing, and downstream SS7 responses. Packet captures are valuable, but message-level counters and transaction identifiers usually reveal whether a fault began in LTE control signalling, IP transport, or the legacy service layer.
A Practical Interworking Workflow
Start with a call-flow inventory covering LTE attach, authentication, location update, SMS over SGs, mobile-terminated paging, and any voice fallback procedure still in use. Mark every node and interface, including the HSS, MME, MSC/VLR, STP, signalling gateway, Diameter agent, and security controls.
Then document identity translation. IMSI, temporary identities, MSISDN, point codes, global titles, Diameter realms, and routing keys should each have an authoritative source. Testing should include normal transactions, unreachable peers, delayed responses, duplicate messages, SCTP path failure, and a controlled gateway restart.
Training resources and structured protocol references can support this work; the SS7 training catalogue includes material relevant to SS7, SIGTRAN, timers, routing, and telecom architecture. The immediate next step is to draw one verified SMS-over-SGs call flow for the production network and label every protocol transition from the handset-facing MME to the final SS7 service node.
