In the world of mobile messaging, there is a dangerous misconception: many Mobile Network Operators (MNOs) believe that simply “having” a firewall means their A2P traffic is secure and monetized.
The reality is more costly. If your firewall is poorly oriented or incorrectly integrated, it isn’t a shield, it’s a sieve. Traffic that bypasses the firewall is “dark” traffic: it consumes network resources, poses a security risk, and, most importantly, represents a direct hit to your bottom line. Every bypassed message is lost termination revenue – in times where every cent of monetized traffic counts.
To achieve maximum monetization, MNOs must look beyond the software and focus on Firewall Orientation and Optimization. This guide covers the best practices for ensuring every single message is accounted for, inspected, and billed.
1. Strategic Orientation: Placement at the Network Edge
The location of your firewall within the network architecture is the first line of defense against revenue leakage.
To secure all SMS messages, the firewall must be located at the absolute edge of the network. The logic is simple: the further “out” the firewall sits, the higher the probability of capturing messages before they find an internal route to bypass the system. A firewall buried deep within the core is easily circumvented by sophisticated gray route providers who exploit internal signaling paths.
2. Deep Integration: Connecting the Allied Nodes
A firewall is only as smart as the data it sees. This is why, to ensure no message stays “invisible,” the firewall must be integrated with all allied nodes. This isn’t just about the SMSC; it’s about a holistic signaling handshake.
- Key Integrations: The FW should be connected with all STPs (Signaling Transfer Points) and SMSCs. In networks without an STP, a direct connection to all MSCs and HLRs is mandatory.
- Protocol Coverage: Integration must span across MO-FSM, MT-FSM, SRI, SMPP, and SIP. If even one of these protocols is left unmonitored, you have created a sanctioned bypass for gray route traffic.
3. Mapping the Flow: Eliminating Technical Bypasses
To prevent “technical leakage,” vendors and MNOs must align on the exact routing mechanisms deployed. Whether messages are forwarded based on Point Code, Subsystem Number (SSN), Global Title (GT), or IMSI, the firewall must be configured to intercept them.
Operators should specifically audit these six traffic flows to ensure they are being diverted to the FW:
- MO Traffic: Originating messages.
- MT Traffic: Terminating messages from local, national, and international sources.
- SRI for SM: The “Send Routing Info” queries that often precede an attack or bypass.
- Inbound Roaming: Often overlooked, and more complex than you would expect.
- Outbound Roaming: Both SRI and MT flows.
- SMPP: Direct binds from both local and international aggregators.
4. Proactive Security: Moving Beyond Passive Filters
Sophisticated intruders don’t just send messages; they manipulate the firewall itself. By sending abnormal SRIs, they attempt to “trick” the system into normal operations.
Best Practice: Implement a mechanism where the firewall validates the legitimacy of the message before processing. By discarding “fake” signaling at the first point of contact, you preserve system resources and prevent sophisticated bypass techniques from succeeding.
5. The “Source of Truth” Audit: Validation Checklist
In many networks, firewalls are active, but technical issues or oversights mean 5–10% of traffic is still bypassing the system unnoticed. Before going live—and periodically thereafter—MNOs must perform a data reconciliation audit:
- NTP Synchronization: Ensure the FW and all Network Elements (NE) use the same time source so reports can be compared accurately.
- The 1:1 Comparison: * Compare SRI counts between the FW and the HLR.
- Compare MT/MO counts between the FW and the MSC.
- Compare SMPP binds/submits between the FW and the SMSC.
- Compare messages received in Network Penetration Tests with counts in the firewall
- The Visibility Goal: If the counts match 100%, you have achieved total network visibility. Only then can the firewall effectively do its job: stop the bad, and monetize the good.
How GTC Can Help
Optimizing a firewall is a complex, ongoing process. At Global Telco Consult (GTC), we specialize in bridging the gap between “installing” a firewall and “mastering” it.
- Network Penetration Testing (NPT): Our specialized testing identifies “smelly” traffic—the messages that reach the handset but never appear on your firewall reports.
- Firewall Managed Services: We provide expert guidance during setup, vendor selection, and ongoing service management to ensure your configuration remains leakage-proof.
Is your network truly 100% protected? Contact GTC today to schedule an NPT audit and turn your hidden traffic into realized revenue.
