Diameter Firewall (DFW)

Protect your 4G and LTE core networks with the BroadForward Diameter Firewall, the FS.19 compliant defense shield for all Diameter signaling across 4G, LTE, VoLTE, and IMS. With deep AVP inspection, real time velocity tracking, and advanced threat mitigation, it protects 4G networks against possible attacks, unauthorized senders, malformed messages, overload situations, and much more.

Deployment options:

Bare metal
Virtual machine
Container
Cloud

Features:

GUI based firewall rules enablement and configuration
Follows GSMA FS.19 recommendations
Transparent mode for non-blocking trail of firewall rules
UE-tracking for cat.3 location/velocity plausibility determination
Can be combined with BroadForward DEA
Topology Hiding with dynamic obfuscation

Foundation

The BroadForward Diameter Firewall in your Network

The BroadForward Diameter Firewall (DFW) is the network’s real‑time defense and enforcement layer for all Diameter signaling across 4G, LTE, VoLTE, and IMS cores. It establishes a centralized security perimeter that continuously inspects inter‑PLMN and IPX traffic, protecting 4G networks from malicious requests, spoofing, location‑tracking exploits, roaming abuse, denial of service (DoS), and unauthorized data extraction.

The DFW is part of BroadForward’s signaling security portfolio, recognized across the industry with its GSMA GLOMO‑nominated firewall engine and Champion status in Kaleido Intelligence’s Roaming Vendor Hub 2025–2026 (ranking among the top 16 vendors out of 80). It enables operators to gain full visibility and control over Diameter security, ensuring that every inbound and outbound message adheres to strict trust, policy, and threat‑mitigation rules.

Years of BFX USC in production

Operators running BFX USC

0 +

GSMA GLOMO winner

0 x

Trusted by

Multi-tenancy

Defending 4G LTE Infrastructure

Every BroadForward product runs on the BFX USC - one engine, one operational model. Adding and working with new 2G–5G signaling functions is straightforward because all BroadForward products use the same GUI, provisioning model, workflows, and operational environment - one interface for all signaling.

Features a 100% graphical interface (CLI is also supported) with flexible templates for configuring custom security policies, AVP inspection rules, and threat mitigations without vendor coding dependency or expensive CR fees.

Built on BroadForward’s GSMA GLOMO nominated firewall engine and backed by the BroadForward’s Champion status in Kaleido Intelligence’s Roaming Vendor Hub - acknowledging BroadForward’s leadership in signaling security.

Trusted by professionals

See why leading professionals choose BroadForward.

We’re proud to have been leveraging the BroadForward platform for quite a while. The solution has played an important role in enabling connectivity with operators and providers preparing for the 5G SA era. Its flexibility, reliability, and future-ready architecture make it a standout platform in the industry.

This not only saves money, but critically speeds time to market

An elegant and innovative solution to a legacy problem of critical voice networks — fulfils an immediate market need

One of the few independent signaling experts successful in winning business from operators looking for a multi-technology signaling platform

BroadForward’s solutions have already strengthened our signaling capabilities, driving greater operational efficiency

This not only saves money, but critically speeds time to market

An elegant and innovative solution to a legacy problem of critical voice networks — fulfils an immediate market need

One of the few independent signaling experts successful in winning business from operators looking for a multi-technology signaling platform

BroadForward’s solutions have already strengthened our signaling capabilities, driving greater operational efficiency

Specifications

Everything you need to evaluate, in one place

Supported Standards & Core Features

GSMA FS.19 Diameter Security Guidelines Fully compliant with GSMA FS.19 standards, enforcing Category 0, 1, 2, and 3 screening rules for inbound and outbound Diameter traffic.
Deep AVP Inspection & Filtering Performs stateful Layer 3 through Layer 7 inspection of Diameter command codes, Application IDs, and Attribute-Value Pairs (AVPs) and source IP address information in real time.
Script-Free GUI Security Rules Engine Provides a 100% graphical environment to build, test, and activate custom security rules, AVP filters, and threat mitigations without writing code or paying vendor CR fees.
Efficient & Cloud‑Agnostic Architecture Designed for low-latency, cloud-native deployment on Kubernetes-based or Red Hat OpenShift container environments, virtual machines, or bare-metal edge nodes.
Unified Security Suite 2G/3G/4G and 5G firewall support in a single software engine running on the GSMA award winning BroadForward BFX Unified Signaling Core (USC) platform.

Extended Features

Velocity Tracking & Time-Distance Plausibility Detects implausible subscriber location jumps across international borders to stop SIM swap fraud, service/billing abuse, and mobile identity theft.
Transparent Mode Support New security rules can be introduced in transparent mode, where they are evaluated and logged but do not block traffic until fully validated.
Rate Limiting Selective Ingress Throttling Provides dynamic traffic throttling, request validation, and burst suppression to protect critical 4G core network components from signaling overloads.
Topology Hiding & Anonymization Strips internal network routing details, FQDNs, origin host/realm identifiers, and private IP addresses from outbound Diameter traffic.

Get more product information

Request the latest data sheet for the BroadForward Diameter Firewall and share it with your security team for a complete technical overview.

Full technical specifications and security feature list
Deployment topology and multi-generation firewall integration overview

FAQ

We are happy to help you with any questions.

Deployment

Freedom of Environment: Deploying Where it Makes Sense

With the BFX Unified Signaling Core (USC) at its foundation, operators are not tied to a specific hardware vendor, appliance cycle, or hyperscaler. The BroadForward Diameter Firewall can be deployed or migrated across virtual machines, containers, or bare metal, using the same configuration, without re engineering. Because the BroadForward Diameter Firewall separates the underlying execution platform from its threat inspection rules, velocity state tables, and security profiles, moving environments requires no re-engineering. All firewall inspection logic, GSMA FS.19 screening rules, velocity tracking profiles, and cross-protocol layer correlation logic built in the GUI can be exported as clean, platform-independent configuration files.