5G NAS - Authentication Reject Explained

Authentication Reject is the network’s negative authentication outcome message. It tells the UE that the current authentication attempt is not accepted and that the current 5GMM path cannot continue.

For beginners, the simple meaning is: the network rejected the UE during authentication.
For engineers, this message is important because it ends the authentication branch and forces investigation back into the earlier challenge-response exchange.

What is Authentication Reject in simple terms?

The UE and network started authentication. The network then decided not to accept that attempt and sent Authentication Reject.

Why Authentication Reject matters

This message matters because it proves the problem is no longer just “authentication is taking time.” The network made a negative decision and stopped the path.

That means the useful troubleshooting focus is usually on:

  • the earlier Authentication Request
  • the UE’s Authentication Response
  • subscriber or core-side authentication context

Where Authentication Reject appears in the call flow

UE                              gNB / AMF
|<-- Authentication Request -----|
|--- Authentication Response ---->|
|<-- Authentication Reject ------|

Transport characteristics

  • Direction: AMF to UE
  • Interface: N1
  • Transport on access side: commonly via DL Information Transfer
  • Security expectation: tied to the authentication-failure branch rather than a successfully secured NAS context

What Authentication Reject means operationally

Operationally, this message ends the current authentication procedure. Unlike Authentication Failure, which is sent by the UE when it cannot validate the network challenge, Authentication Reject is the network telling the UE that the current attempt is not accepted from the core side.

Example message dump

Authentication Reject
  Extended Protocol Discriminator: 5G Mobility Management
  Security Header Type: Plain NAS
  Message Type: Authentication Reject

How to read this dump

  • Do not over-focus on the message itself because it is intentionally short.
  • Instead, correlate it with the full earlier challenge-response exchange.
  • Then inspect what the UE does next: stop, retry, or restart registration.

What to check in logs

  • verify whether the UE had already sent Authentication Response
  • inspect the earlier challenge values and subscriber context
  • correlate the reject with later procedure stop or re-registration
  • avoid treating this as a radio-only failure

FAQ

What does Authentication Reject mean in 5G?

It means the network did not accept the authentication procedure and stopped the current registration path.

Summary

Authentication Reject is the NAS message the network sends when the UE's authentication attempt is not accepted and the current 5GMM path must stop.