To assist with SS7 network security, certain MAP messages need to be rejected based on a combination of the SCCP Calling Digits Party Addresses (refer to Allowed SCCP Calling Digits Party Addresses), TCAP Operation Codes (refer to Allowed TCAP Operation Codes), and MAP IMSI value as recommended in GSMA IR.82 Security SS7 Implementation. 

Caution

The Allowed MAP IMSI records cannot be provisioned in the table until all slots are properly upgraded to release 17.0.0 or above.

The Allowed MAP IMSIs table is the next step after the Allowed TCAP Op Codes table to screen specific MAP messages with certain IMSI prefixes. The screening table's digits prefix can also represent a MSISDN or an IMEI based on the TCAP operation code.

The MAP UnstructuredSSNotify and UnstructuredSSRequest messages have a MSISDN instead of an IMSI for MAP Category 2 screening, which is also covered by the Allowed MAP IMSIs screening table. The Allowed MAP IMSIs screening table also supports EIR screening through the IMEI in the MAP Check-IMEI message.

Note

For a complete list of all supported MAP messages, login to the Web UI and view the help text for the Digital Prefix attribute under the Allowed MAP IMSI Configuration screen.

Note

The Allowed TCAP Op Codes screening table TCAP Variant attribute must be set to ITU to link in the Allowed MAP IMSIs table.

The Allowed MAP IMSIs screening table increases the filtering criteria to determine if an incoming MSU to the DSC platform must be discarded or redirected. 

This screening table is filtered with the following attributes:

  • EPR
  • EPR and Digital Prefix

To obtain all Allowed MAP IMSI records, set EPR to ANY or zero (0).

By default, the next screening step is a successful STOP EPR.