LTE Attach Procedure Call Flow
LTE attach is the EPC registration procedure that turns a reachable LTE UE into a registered subscriber with NAS security, mobility context, and a working default EPS bearer. It joins RRC access, EPS NAS registration, S1AP transport, GTPv2-C session setup, and Diameter subscriber handling into one control path.
This procedure appears when a UE powers on, re-attaches after losing stored context, returns to LTE after reset or rejection, or fails to reach normal service even though radio access looks healthy. If attach does not complete cleanly, the UE does not reach normal LTE packet service.
Introduction
The LTE attach procedure establishes EPC registration for the UE. It lets the network authenticate the subscriber, activate NAS security, create mobility context, and establish the default EPS bearer.
The procedure starts when old EPS registration is missing or no longer usable. Common triggers include power-on, re-attach after context loss, and service rebuild after reset or rejection. The main nodes are the UE, eNB, MME, SGW, PGW, and HSS. The last messages in the flow confirm whether the UE really reached registered and service-ready EPC state.
What Is LTE Attach in Simple Terms?
- What starts the procedure: The UE needs fresh EPS registration and no longer has usable attach context.
- What the UE and network want to achieve: A valid EPC registration state with security enabled and a working default PDN connection.
- What success looks like: The UE receives Attach Accept, returns Attach Complete, and completes default bearer acceptance.
- What failure means: The procedure stops on access, identity, authentication, security, subscription, or bearer setup failure, and the UE does not reach normal LTE packet service.
Why this procedure matters
Attach is the baseline LTE registration procedure. It determines whether the UE is allowed onto the network, which APN and subscription profile apply, which NAS security context becomes active, and whether the UE reaches stable packet service with a usable default bearer. It also provides one of the clearest control-plane correlation paths across RRC, NAS, S1AP, GTPv2-C, and Diameter.
Quick Fact Sheet
| Procedure name | LTE Attach Procedure |
|---|---|
| Domain | E-UTRAN + EPC access and registration |
| Main trigger | UE power-on, re-attach after context loss, or EPS registration required |
| Start state | UE has selected a cell but does not yet have usable EPS registration context |
| End state | UE is EMM-REGISTERED, ECM-CONNECTED, and has a default EPS bearer |
| Main nodes | UE, eNB, MME, SGW, PGW, HSS |
| Main protocols | RRC, NAS, S1AP, GTPv2-C, Diameter |
| Main success outcome | EPS context created, security activated, default bearer active, IP connectivity available |
| Main failure outcome | Attach reject, security/authentication stop, or bearer/context setup failure |
| Most important messages | Attach Request, Authentication Request/Response, NAS Security Mode Command, Attach Accept, Attach Complete |
| Main specs | TS 23.401, TS 24.301, TS 36.300, TS 36.331, TS 29.274, TS 29.272 |
Preconditions
The attach path starts cleanly only when the basic LTE and EPC prerequisites are already in place.
- The UE has completed cell selection and can read essential LTE system information.
- The USIM contains valid subscriber credentials and the UE has a usable PLMN selection result.
- The serving eNB has working S1 connectivity toward the target MME.
- The HSS subscription data for the UE is reachable and consistent.
- The APN or default PDN path the UE wants is allowed for the subscriber and roaming condition.
- The UE has enough radio quality to maintain RRC setup, NAS exchange, and bearer configuration without repeated access failure.
Nodes and Interfaces
Nodes involved
| Node | Role in attach |
|---|---|
| UE | Starts attach, provides identity and capability context, completes NAS authentication and security, and accepts the default bearer. |
| eNB | Provides LTE radio access, transports NAS signaling over RRC and S1AP, and applies the E-RAB resources requested by the MME. |
| MME | Owns the attach control flow, selects authentication and security handling, talks to HSS, and coordinates SGW or PGW session creation. |
| SGW | Acts as the serving user-plane anchor on the EPC side and participates in default bearer tunnel creation. |
| PGW | Allocates PDN connectivity context and policy-facing session details such as APN and IP addressing. |
| HSS | Provides subscriber profile, authentication vectors, roaming permission, and APN-related subscription data over S6a. |
Interfaces used
| Interface | Endpoints | Role |
|---|---|---|
| LTE Uu | UE <-> eNB | Carries RRC setup and the NAS payload container used to start attach. |
| S1-MME | eNB <-> MME | Carries S1AP control signaling, including the first NAS delivery toward the MME and later context setup. |
| S11 | MME <-> SGW | Carries GTPv2-C session creation for the default bearer path. |
| S5/S8 | SGW <-> PGW | Carries EPC session signaling and user-plane tunnel coordination toward the PDN side. |
| S6a | MME <-> HSS | Carries Diameter subscriber update and authentication profile retrieval. |
| S1-U | eNB <-> SGW | Carries the user-plane tunnel once the default EPS bearer is active. |
End-to-End Call Flow
UE eNB MME SGW PGW HSS
| | | | | |
|--RRC Conn Req-->| | | | |
|<-RRC Conn Setup-| | | | |
|--RRC Setup Complete + Attach Req + PDN Conn Req--->| | |
| |--Initial UE signaling------------>| | |
| | |----ULR / auth-->|--------------------------------->|
| | |<---ULA / vecs---|<---------------------------------|
|<--Identity Req--|<--------------- | | | |
|--Identity Resp->|---------------> | | | |
|<--Auth Req------|<--------------- | | | |
|--Auth Resp----->|---------------> | | | |
|<--Security Mode Command-----------| | | |
|--Security Mode Complete---------->| | | |
| | |--Create Session Req------------->|---------------->|
| | |<--Create Session Resp------------|<----------------|
| |<-Initial Context Setup Req + Attach Accept + Default Bearer Req------|
|<--RRC Reconfiguration-------------| | | |
|--RRC Reconfiguration Complete---->| | | |
|--Attach Complete + Default Bearer Accept---------->| | |
| |--uplink NAS--------------------->| | |Major Phases
1. Access and attach start
The UE first creates an RRC signaling path to the eNB and sends Attach Request, typically together with PDN Connectivity Request, so the EPC can start both mobility and session handling.
2. Identity and subscriber validation
If the old GUTI or context is not enough, the MME requests identity. In parallel or immediately after, it retrieves subscriber data and authentication vectors from the HSS.
3. Authentication
The network challenges the UE using EPS AKA. If the UE response matches, the MME continues. If not, the attach stops at authentication failure or reject handling.
4. NAS security activation
After successful authentication, the MME selects NAS ciphering and integrity algorithms and activates protected NAS signaling before sending acceptance.
5. EPC context and default bearer setup
The MME asks the SGW and PGW to create the session, allocate the PDN context, and prepare the default bearer parameters needed for service.
6. Radio and E-RAB setup
The MME sends Initial Context Setup toward the eNB with the NAS accept payload and E-RAB parameters. The eNB applies the radio bearer resources toward the UE.
7. Completion
The UE confirms Attach Accept handling by sending Attach Complete and accepts the default EPS bearer. At that point, the attach path is operational and the UE can use packet services.
Step-by-Step Breakdown
RRC access establishment
Sender -> receiver: UE -> eNB
Message(s): RRC Connection Request, RRC Connection Setup, RRC Connection Setup Complete
Purpose: Open a dedicated signaling path so the UE can deliver the first NAS message to EPC.
State or context change: UE moves from idle access attempt into an active RRC signaling state.
Note: This is where radio problems can masquerade as attach problems. Always confirm the access leg succeeded before blaming NAS.
Attach start with embedded session intent
Sender -> receiver: UE -> eNB -> MME
Message(s): Attach Request plus PDN Connectivity Request, forwarded in the first S1AP uplink UE signaling
Purpose: Start EPS registration and request PDN connectivity for the default bearer path.
State or context change: MME creates the early attach context and begins evaluating identity, security, and subscription state.
Note: The embedded ESM container is high value. Many later bearer issues are already visible here through APN or PDN type mismatch.
Optional identity procedure
Sender -> receiver: MME -> UE -> MME
Message(s): Identity Request, Identity Response
Purpose: Resolve the subscriber identity when old temporary identity or stored context is not sufficient.
State or context change: MME upgrades from provisional UE context to a clearer subscriber identity view.
Note: Repeated identity requests usually point to stale GUTI use, database mismatch, or capture gaps across interfaces.
Authentication with HSS support
Sender -> receiver: MME <-> HSS and MME -> UE -> MME
Message(s): Diameter Update Location and authentication vector retrieval, then Authentication Request and Authentication Response
Purpose: Confirm the UE is a valid subscriber and obtain the profile data needed for attach continuation.
State or context change: Subscriber profile and authentication state become usable in the MME.
Note: If the UE returns Authentication Failure with sync cause, inspect both the NAS cause and the HSS-side vector timing, not only the air trace.
NAS security activation
Sender -> receiver: MME -> UE -> MME
Message(s): Security Mode Command, Security Mode Complete
Purpose: Activate integrity and ciphering for the rest of the NAS exchange.
State or context change: Attach continuation transitions from largely unprotected early NAS to protected NAS signaling.
Note: Capability negotiation mistakes often show up here. Verify the selected algorithms match both UE capability and network policy.
Session and default bearer creation
Sender -> receiver: MME -> SGW -> PGW -> SGW -> MME
Message(s): Create Session Request and Create Session Response on GTPv2-C
Purpose: Allocate the default EPS bearer context, PDN addressing, and the core-side user-plane tunnel identifiers.
State or context change: The EPC has a usable session template for the UE default bearer.
Note: An APN or subscription failure may surface here even though access, identity, and authentication all looked healthy.
Initial context setup and NAS acceptance delivery
Sender -> receiver: MME -> eNB -> UE
Message(s): Initial Context Setup Request toward eNB, Attach Accept, Activate Default EPS Bearer Context Request, and RRC Connection Reconfiguration on the radio side
Purpose: Apply the radio bearer resources and deliver the NAS acceptance that finalizes EPS registration and bearer activation.
State or context change: eNB receives the E-RAB template and UE receives the attach result together with default bearer parameters.
Note: If the MME sends attach acceptance but the UE never reaches service, inspect both the NAS payload and the eNB E-RAB setup result.
Completion toward EPC
Sender -> receiver: UE -> eNB -> MME
Message(s): RRC Connection Reconfiguration Complete, Attach Complete, Activate Default EPS Bearer Context Accept
Purpose: Confirm UE-side acceptance of the bearer and close the attach transaction cleanly.
State or context change: UE is fully attached with operational default EPS connectivity.
Note: In many traces Attach Complete and bearer accept travel close together. Correlate them before calling the issue a late data-path problem.
Important Messages in This Flow
| Message | Protocol | Sender -> Receiver | Purpose in this procedure | What to inspect briefly |
|---|---|---|---|---|
| RRC Connection Request | RRC | UE -> eNB | Starts radio access for attach. | Establishment cause, cell context, retry pattern. |
| RRC Connection Setup | RRC | eNB -> UE | Grants the dedicated signaling path. | Whether setup arrived and whether timing or radio quality already looks unstable. |
| RRC Connection Setup Complete | RRC | UE -> eNB | Carries the first NAS payload toward EPC. | Dedicated NAS container presence and selected PLMN or TAC context. |
| Attach Request | NAS | UE -> MME | Starts EPS attach and usually carries the PDN Connectivity Request container. | Attach type, old GUTI or IMSI use, UE network capability, ESM container. |
| PDN Connectivity Request | NAS | UE -> MME | Requests PDN service and drives default bearer creation. | APN, PDN type, request context, protocol options. |
| Identity Request | NAS | MME -> UE | Requests stronger UE identity when old context is not enough. | Identity type requested and whether the request is expected for the scenario. |
| Identity Response | NAS | UE -> MME | Returns the identity requested by the MME. | IMSI or IMEI content, consistency with subscription and test scenario. |
| Authentication Request | NAS | MME -> UE | Challenges the UE using EPS AKA. | RAND, AUTN, and whether the request follows the right HSS subscriber path. |
| Authentication Response | NAS | UE -> MME | Returns the AKA response needed for attach continuation. | RES path, timing, and whether a failure branch appears instead. |
| Security Mode Command | NAS | MME -> UE | Activates NAS security before attach acceptance. | Selected ciphering and integrity algorithms and capability agreement. |
| Security Mode Complete | NAS | UE -> MME | Confirms NAS security activation. | Protected delivery and any mismatch with prior capabilities. |
| Attach Accept | NAS | MME -> UE | Accepts the attach and returns mobility plus bearer-related parameters. | Assigned GUTI, TAI list, attach result, timer values, embedded bearer context. |
| Activate Default EPS Bearer Context Request | NAS | MME -> UE | Activates the default bearer associated with the initial PDN connection. | EBI, APN, PDN address, QoS, TFT or protocol config options. |
| RRC Connection Reconfiguration | RRC | eNB -> UE | Applies radio bearer and E-RAB resources that go with attach completion. | DRB or SRB changes, mobility control fields, and bearer-related timing. |
| Attach Complete | NAS | UE -> MME | Confirms the attach result was received and applied. | Whether it arrives before timer expiry and whether the bearer accept also appears. |
| Activate Default EPS Bearer Context Accept | NAS | UE -> MME | Confirms the UE accepted the default bearer. | EBI match, timing relative to Attach Complete, and any missing user-plane follow-through. |
Important Parameters to Inspect
| Item | What it is | Where it appears | Why it matters | Common issues |
|---|---|---|---|---|
| IMSI / GUTI / S-TMSI | UE identity used across attach start, identity resolution, and later paging context. | Attach Request, Identity Response, Attach Accept | Identity choice tells you whether the UE is using old context or starting clean. | Stale GUTI, wrong PLMN context, identity mismatch across interfaces. |
| TAI / TAC / ECGI | Location identifiers tying the UE to the serving LTE area and cell. | RRC setup context, S1AP first uplink delivery, Attach Accept | They explain why a given MME handled the UE and whether mobility context is plausible. | Wrong TAC configuration, mismatched visited area, unexpected tracking area list. |
| APN | The PDN service name requested for default connectivity. | PDN Connectivity Request, Create Session signaling, bearer activation | APN drives PGW selection and subscription matching. | Unknown APN, blocked APN, wrong IMS or internet APN policy. |
| PDN type / IP address | Requested and allocated packet data addressing model. | PDN Connectivity Request, Create Session Response, Activate Default EPS Bearer Context Request | Explains whether the UE got usable IPv4, IPv6, or IPv4v6 service. | Type mismatch, address allocation failure, unsupported combination. |
| EPS Bearer ID | Identifier of the default EPS bearer. | Attach Accept, Activate Default EPS Bearer Context Request, bearer accept | Needed to correlate control-plane acceptance with user-plane activation. | EBI mismatch, missing bearer accept, wrong bearer mapping in trace tools. |
| E-RAB ID | Radio-side bearer identity corresponding to EPC bearer setup. | Initial context setup and eNB radio configuration | Links NAS bearer activation to the actual radio bearer the eNB built. | E-RAB setup failure, inconsistent bearer mapping, partial eNB apply failure. |
| QoS / QCI / ARP / AMBR | Bearer performance and priority parameters. | Create Session Response, Attach Accept, Activate Default EPS Bearer Context Request | These values explain later throughput or service behavior right from attach. | Unexpected QCI, throttled AMBR, wrong policy profile. |
| MME UE S1AP ID / eNB UE S1AP ID | Control-plane correlation keys on S1-MME. | Initial uplink UE signaling, context setup, later downlink and uplink NAS transport | Critical for matching the same UE across multi-interface captures. | ID rollover confusion, trace merge mistakes, wrong node correlation. |
| NAS KSI and selected algorithms | Security context reference and protection choices. | Attach Request, Security Mode Command, Security Mode Complete | Shows whether the UE and MME agree on the same security path. | Invalid stored context, unsupported algorithms, integrity mismatch. |
| Timers such as T3412 and T3450 | Mobility and procedure supervision timers returned during or after attach. | Attach Accept and later procedural behavior | They explain UE retry timing, periodic update behavior, and completion expectations. | Unexpected retry delays, missing timer handling, incorrect periodic update behavior. |
Successful Completion
A successful attach ends with a UE that is EMM-REGISTERED, has a valid NAS security context, knows its assigned mobility identity such as GUTI, and has an active default EPS bearer with usable EPC tunnel context.
In practical traces, success is confirmed by the delivery of Attach Accept, the UE returning Attach Complete, and the bearer side closing with Activate Default EPS Bearer Context Accept.
After that, the UE can use packet data, respond to paging correctly later, and continue into higher-layer services such as IMS registration if the APN and service profile allow it.
Common Failures and Troubleshooting
UE never reaches Attach Request
Likely cause: Radio access problem, barring, weak RF, or RRC setup failure.
Where to inspect: RRC Connection Request and Setup path, radio measurements, cell barring state.
Relevant message(s): RRC Connection Request, RRC Connection Reject
Relevant interface(s): LTE Uu
Likely next step: Treat it as an access problem first, not an EPC problem.
MME asks for identity repeatedly or attach stalls after identity
Likely cause: Old context is stale, identity is inconsistent, or subscriber data lookup is not completing cleanly.
Where to inspect: Attach Request identity fields, Identity Request or Response, HSS correlation.
Relevant message(s): Attach Request, Identity Request, Identity Response
Relevant interface(s): NAS, S6a
Likely next step: Compare the temporary identity with subscriber database expectations and confirm HSS reachability.
Authentication failure or Authentication Reject
Likely cause: AKA vector mismatch, sync problem, wrong key material, or subscription issue.
Where to inspect: Authentication Request or Response, Authentication Failure cause, HSS vector history.
Relevant message(s): Authentication Request, Authentication Response, Authentication Failure, Authentication Reject
Relevant interface(s): NAS, S6a
Likely next step: Decide whether this is sync recovery or hard reject before moving to UE blame.
Security Mode Command does not complete
Likely cause: Capability mismatch, integrity protection issue, or stale NAS context.
Where to inspect: UE security capability in Attach Request, selected algorithms, protected NAS continuity.
Relevant message(s): Security Mode Command, Security Mode Complete, Security Mode Reject
Relevant interface(s): NAS
Likely next step: Re-check KSI use and chosen algorithms against UE support.
Attach Accept sent but no usable data service after attach
Likely cause: Create Session or bearer parameters are wrong, APN is blocked, or E-RAB setup partly failed.
Where to inspect: Create Session responses, Attach Accept embedded bearer context, eNB E-RAB result, default bearer accept.
Relevant message(s): Attach Accept, Activate Default EPS Bearer Context Request, Activate Default EPS Bearer Context Accept
Relevant interface(s): NAS, S11, S5/S8, S1-MME, S1-U
Likely next step: Correlate bearer identifiers across EPC and eNB before declaring a pure user-plane issue.
Attach ends with Attach Reject
Likely cause: Subscription restriction, roaming denial, congestion control, or policy rejection.
Where to inspect: EMM cause, returned timers, attach type, APN or roaming policy.
Relevant message(s): Attach Reject
Relevant interface(s): NAS, S6a
Likely next step: Use the reject cause and any backoff timer to determine whether retry, reconfiguration, or subscriber correction is needed.
Attach Complete missing at the MME
Likely cause: UE did not apply the accept, the eNB did not relay the uplink NAS correctly, or the procedure timed out.
Where to inspect: RRC Reconfiguration Complete, uplink NAS transport, MME timer behavior.
Relevant message(s): Attach Accept, Attach Complete, Activate Default EPS Bearer Context Accept
Relevant interface(s): LTE Uu, S1-MME
Likely next step: Check whether the UE completed the radio leg but the NAS completion was lost in transport.
What to Check in Logs and Traces
- Confirm the UE had healthy LTE access first: cell, RRC establishment cause, setup success, and timing.
- Decode Attach Request early and inspect attach type, identity form, UE capability, and embedded PDN Connectivity Request.
- Correlate the NAS branch with identity, authentication, and NAS security rather than jumping directly to Attach Accept.
- Match the same UE across LTE Uu and S1-MME using UE identities and S1AP correlation IDs.
- Inspect S6a subscriber update and authentication vector retrieval when authentication timing or roaming behavior looks abnormal.
- Check S11 and S5/S8 Create Session outcomes when attach succeeds on NAS but the bearer or IP service is unusable.
- Verify that eNB radio bearer setup and EPC bearer identifiers line up before declaring a pure core or pure radio fault.
- Confirm the UE returns Attach Complete and Activate Default EPS Bearer Context Accept within the expected timer window.
- Use returned timer and cause fields from accept or reject messages to explain later UE retry behavior.
Related Pages
Related sub-procedures
- LTE NAS overview for the wider EMM and ESM context around attach, TAU, and service restoration.
- LTE Tracking Area Update for mobility update behavior when a fresh attach is not required.
- LTE RRC overview for the radio control side that carries and protects the attach path.
Related message reference pages
- Attach Request
- PDN Connectivity Request
- Identity Request
- Authentication Request
- Security Mode Command
- Attach Accept
- Attach Complete
- Activate Default EPS Bearer Context Request
- Activate Default EPS Bearer Context Accept
- RRC Connection Setup Complete
Related troubleshooting pages
- LTE EMM cause reference for reject and failure interpretation.
- LTE NAS timers and constants for retry and completion timing behavior.
- 3GPP Decoder for field-level message inspection across RRC and NAS.
Notes
Attach is how an LTE UE becomes a known, authenticated, secure, and service-ready EPC subscriber. The UE starts with RRC access, sends Attach Request, the network checks identity and subscription, then security and the default bearer are created before packet data service becomes available.
- The highest-value attach read often comes from correlating the early NAS container with the later bearer result, not from reading accept messages in isolation.
- Attach problems that look like radio failures can actually be caused by missing EPC continuation and vice versa, so always correlate LTE Uu and S1-MME captures.
- APN and PDN type mismatches commonly survive deep into the procedure and only become obvious at GTP Create Session or default bearer activation time.
- Use identity selection behavior to distinguish fresh context creation, stale-context reuse, and test-environment database inconsistencies.
- Timer-driven behavior after Attach Reject or incomplete completion is often the clue that explains why the UE does not retry the way a tester expects.
FAQ
What is the LTE attach procedure?
It is the EPC registration workflow that lets the UE create EPS mobility context, authenticate, activate security, and establish the default bearer for packet service.
What usually triggers attach?
Typical triggers are power-on, loss of old EPS context, SIM reinsertion, or any case where the UE must rebuild EPC registration instead of using Service Request or TAU.
Which message starts attach?
The main NAS start message is Attach Request, usually carried inside RRC Connection Setup Complete during the first LTE access leg.
Is PDN Connectivity Request part of attach?
In most practical initial attach traces, yes. It is commonly embedded inside Attach Request so the default EPS bearer can be created as part of the same workflow.
Why does the MME send Identity Request during attach?
Because the temporary identity or stored context was not enough, so the network needs a stronger subscriber identity before continuing.
What is the difference between attach and service request?
Attach creates or rebuilds EPS registration context. Service Request assumes valid EPS context already exists and only restores active service.
What confirms attach success?
Attach Accept from the network followed by Attach Complete from the UE, together with successful default EPS bearer activation, is the practical success pattern.
Does attach always include authentication?
In normal fresh attach analysis, yes, authentication is expected unless an already valid context and optimization path changes the signaling sequence.
What should I inspect first in a failed attach?
Start with the first failing transition: radio access, Attach Request content, identity branch, authentication branch, security branch, or default bearer setup.
Which specs matter most for attach?
TS 23.401 gives the EPC procedure model, TS 24.301 defines EPS NAS signaling, TS 36.300 and TS 36.331 cover LTE access behavior, and TS 29.274 or TS 29.272 cover core-side tunnel and subscriber interfaces.