3GLTEInfo Text-based logo for the 3GLTEInfo telecom engineering reference platform. 3GLTE INFO TELECOM ENGINEERING REFERENCE
Menu
5G Troubleshooting

Initial Context Setup Failure Analysis

Initial Context Setup is the first major UE context creation point after the UE reaches the AMF and the network is ready to establish access-side context. In practice, failures at this stage can come from NGAP message content, UE security capability validation, AS security activation, RRC bearer reconfiguration, or the setup of one or more requested PDU session resources.

This page is written as a fault-isolation guide. It starts with the normal procedure baseline, then breaks failures into radio-side, NGAP-side, security-side, and session-resource-side buckets. It also includes call flows that show where the procedure usually breaks and what traces or counters should be checked first.

Where Initial Context Setup Sits in the Procedure Chain

Use the surrounding procedure context to avoid mixing a true Initial Context Setup failure with a later radio-side continuation problem.

Prior checkpoints before Initial Context Setup

  • Registration Request reached the AMF
  • Authentication and NAS security progressed far enough
  • UE context exists on the AMF side
  • The UE already has both AMF UE NGAP ID and RAN UE NGAP ID in context

Initial Context Setup itself

  • AMF sends Initial Context Setup Request
  • NG-RAN tries to establish the NG UE context
  • NG-RAN may also process requested PDU session resources
  • NG-RAN replies with Response or Failure

Post-request radio work

  • AS security activation
  • RRC bearer and cell-group configuration
  • Optional NAS delivery toward the UE
  • Possible later release if the radio-side continuation fails

Call Flows

Read these flows in order: normal completion, full failure, deterministic security rejection, radio-side continuation failure, and partial success.

Normal Initial Context Setup completion

Successful Initial Context Setup call flow Sequence from Initial Context Setup Request through SecurityModeCommand, RRCReconfiguration, and Initial Context Setup Response. UE gNB / NG-RAN AMF NAS and security preconditions already progressed 1. Initial Context Setup Request 2. SecurityModeCommand 3. SecurityModeComplete 4. RRCReconfiguration 5. RRCReconfigurationComplete 6. Initial Context Setup Response
  • the Request arrives once and matches the correct UE NGAP ID pair
  • the NG-RAN accepts the security context and UE security capabilities
  • the UE completes AS security activation and RRC bearer or cell-group configuration
  • the Response can still show failed PDU sessions separately if only some resources fail

Full Initial Context Setup failure

Full Initial Context Setup failure The gNB cannot establish the NG UE context and returns Initial Context Setup Failure with a Cause and optional failed PDU session list. UE gNB / NG-RAN AMF 1. Initial Context Setup Request 2. NG-RAN cannot establish the NG UE context 3. Initial Context Setup Failure

Use this branch when the gNB never reaches stable radio-side continuation and terminates the procedure directly with a Failure message.

Security capability mismatch before AS security activation

Initial Context Setup failure due to security capability mismatch The gNB rejects the request after checking UE Security Capabilities and allowed algorithms, before AS security activation starts. UE gNB / NG-RAN AMF 1. Initial Context Setup Request 2. Check UE Security Capabilities No allowed encryption or integrity match 3. Initial Context Setup Failure

This is an early deterministic failure branch. If it appears, do not start with later RRC bearer or PDU session troubleshooting.

Radio-side continuation fails after the Request

Initial Context Setup followed by radio-side continuation failure The Request arrives, but AS security or RRC reconfiguration fails later and the gNB sends UE Context Release Request. UE gNB / NG-RAN AMF 1. Initial Context Setup Request 2. SecurityModeCommand or RRCReconfiguration 3. SecurityModeFailure or no valid completion 4. UE Context Release Request

Treat this as a post-request radio continuation failure, not as an AMF-originating registration reject.

Partial success with failed PDU sessions

Initial Context Setup partial success The NG UE context succeeds, but one or more requested PDU sessions fail and are reported in the failed-to-setup list. UE gNB / NG-RAN AMF 1. Initial Context Setup Request 2. NG UE context succeeds but one session resource fails 3. Initial Context Setup Response

Do not misclassify this as total procedure failure. The UE context can be healthy while one or more requested PDU sessions still fail inside the same transaction.

NGAP Request Validation

Validate the request structure first. This is where you separate “cannot establish the UE context” from “context established but some resources failed.”

  • AMF UE NGAP ID
  • RAN UE NGAP ID
  • Security Context and Security Key presence
  • UE Security Capabilities relevance
  • optional NAS-PDU
  • optional PDU Session Resource Setup Request List

Why this step matters

If the NG-RAN cannot establish the NG UE context at all, it should treat the procedure as failed and send INITIAL CONTEXT SETUP FAILURE. If PDU session resource setup was also requested, unsuccessful per-session establishment can be reported in the failure message. A successful Response can still include a failed-to-setup list, so troubleshooting has to separate full UE context failure from partial session-resource failure.

Security Capability and Algorithm Mismatch Failures

Check this branch early because it can produce an immediate deterministic reject before any AS security activation reaches the UE.

If the UE Security Capabilities encryption algorithms, together with mandatory EEA0/NEA0 support, do not match any allowed encryption algorithms configured in the NG-RAN, the procedure can fail immediately. The same logic applies to integrity algorithms with mandatory EIA0/NIA0 support.

  • NGAP UE Security Capabilities as seen by the gNB
  • gNB allowed encryption algorithm list
  • gNB allowed integrity algorithm list
  • recent security-policy changes on the gNB
  • whether the failure occurs before any RRC SecurityModeCommand starts

RRC Security Activation and Bearer Configuration Failures

Even when Initial Context Setup does not fail immediately, the practical service break often shows up in AS security or bearer continuation.

RRC continuation checkpoints

  • SecurityModeCommand sent or not sent
  • SecurityModeComplete received or SecurityModeFailure returned
  • RRCReconfiguration carries expected radioBearerConfig
  • masterCellGroup or other cell-group data is present and valid
  • optional dedicatedNAS-MessageList handling is correct
  • UE returns RRCReconfigurationComplete or fails to apply the config

Why this matters

SecurityModeCommand is the checkpoint for AS security activation, and RRCReconfiguration is the checkpoint for radio bearer setup and cell-group application. If the Request arrived but the UE never reaches stable completion here, the root cause is often radio continuation rather than the original AMF request itself.

PDU Session Resource Setup Failures Inside Initial Context Setup

Initial Context Setup is often overloaded in traces because it can carry requested PDU session resource setup in the same transaction.

  • whether the UE context itself succeeded
  • which PDU Session IDs failed
  • whether the failure is due to user-plane, security, or QoS constraints
  • whether the AMF propagates unsuccessful session transfer toward the corresponding SMF

Practical meaning

TS 38.413 allows INITIAL CONTEXT SETUP RESPONSE with successful setup plus a failed-to-setup list. That makes partial success a normal troubleshooting branch, not an edge case.

UE Context Release After Failed or Incomplete Setup

When the Request arrived and the gNB later gives up, the next high-value checkpoint is often UE Context Release Request.

  • AS security could not be activated
  • RRC reconfiguration could not be completed
  • bearer setup could not be stabilized
  • requested user-plane or session resources were not supportable in the final radio context

Trace-First Troubleshooting Workflow

Ground the analysis in the exact branch first, then correlate the same attempt across NGAP, RRC, and session setup.

1. Confirm the exact branch

  • no Initial Context Setup Request seen
  • Request seen, immediate Failure returned
  • Request seen, Response returned with failed session list
  • Request seen, then later UE Context Release Request

2. Validate request content

  • UE NGAP ID pair
  • Security Context and Security Key presence
  • UE Security Capabilities handling
  • NAS-PDU presence if expected
  • PDU Session Resource Setup Request List presence if expected

3. Correlate with RRC

  • SecurityModeCommand, Complete, or Failure
  • RRCReconfiguration and Complete
  • any visible UE inability to comply with configuration
  • timing gaps between NGAP Request and radio responses

4. Separate total failure from partial success

  • Initial Context Setup Failure means NG UE context was not established
  • Initial Context Setup Response with failed list means the UE context exists but some resources failed

5. Escalate to the right team

  • NGAP request content or AMF mapping problem points to core signaling
  • algorithm mismatch or allowed-list issue points to security or RAN config
  • SecurityModeFailure or RRC reconfiguration issue points to RAN or UE
  • failed PDU session items point to SMF, user plane, QoS, or transport

Trace Checklist

Capture both NGAP and radio checkpoints from the same attempt before deciding whether this is total failure, partial success, or late continuation loss.

Minimum NGAP evidence

  • Initial Context Setup Request
  • Initial Context Setup Response or Failure
  • UE Context Release Request if present
  • any failed PDU session list and unsuccessful transfer content

Minimum RRC evidence

  • SecurityModeCommand, Complete, or Failure
  • RRCReconfiguration and Complete
  • any visible UE non-compliance or timeout
  • relevant cell-group or bearer configuration snapshot

Evidence Checklist for Escalation

Escalation should make it obvious whether the break was full NG UE context failure, partial session failure, or later radio continuation collapse.

Minimum context identifiers

  • AMF UE NGAP ID
  • RAN UE NGAP ID
  • cell, gNB, and AMF identity
  • affected PDU Session IDs
  • timestamp alignment between UE, gNB, and core traces

Minimum fault summary

  • exact branch: immediate Failure, partial Response, or later Release Request
  • first failing message or first missing completion
  • Cause value if present
  • whether the issue affects one UE, one cell, or a broader area

Specification Map

  • TS 38.413: Initial Context Setup Request, Response, Failure, and UE Context Release Request
  • TS 38.331: SecurityModeCommand, SecurityModeFailure, and RRCReconfiguration
  • TS 23.502: surrounding access and core procedure context

FAQ

What is the difference between Initial Context Setup Failure and Initial Context Setup Response with failed PDU sessions?

Initial Context Setup Failure means the NG-RAN could not establish the NG UE context at all. Initial Context Setup Response with a failed-to-setup list means the UE context itself succeeded, but one or more requested PDU session resources still failed inside the same transaction.

Which failures happen before any RRC security activation starts?

The highest-value early branch is NGAP request rejection caused by invalid or unsupported security capabilities and allowed algorithm mismatch. In that case the gNB can reject the procedure before any UE-side AS security activation progresses.

How do I identify a security algorithm mismatch case?

Check the UE Security Capabilities sent toward the gNB and compare them with the allowed encryption and integrity algorithm lists configured in the NG-RAN. If no valid match exists, Initial Context Setup can fail immediately and deterministically.

What should I check if the Request arrives but the UE never completes RRC security or reconfiguration?

Correlate the NGAP Request with SecurityModeCommand, SecurityModeComplete or Failure, RRCReconfiguration, and any missing completion or timeout. That usually tells you whether the break is radio security activation, bearer setup, or UE inability to apply the configuration.

When should I look for UE Context Release Request after Initial Context Setup?

Look for it when the Request arrived and the gNB started radio-side continuation, but the setup never stabilized. It is often the next strong signal that the NG-RAN gave up after AS security, bearer, or RRC continuation failed.

Can Initial Context Setup succeed while one or more PDU sessions still fail?

Yes. TS 38.413 allows Initial Context Setup Response to carry both successful setup items and a failed-to-setup list, so partial success is a valid and important troubleshooting branch.

Related Pages