5G NAS - Authentication Reject

Message Fact Sheet

Protocol	nas	Network	5g
Spec	3GPP TS 24.501	Spec Section	8.2.5
Direction	AMF to UE	Message Type	5GMM signaling

Full message name	5G NAS - Authentication Reject
Protocol	NAS
Technology	5G
Direction	AMF to UE
Interface	N1
Signaling bearer / channel	NAS signaling / Dedicated NAS message, commonly via DL Information Transfer
Typical trigger	Sent when the network decides that authentication cannot be accepted.
Main purpose	Explicitly terminates the current authentication procedure from the network side.
Main specification	3GPP TS 24.501, 8.2.5
Release added	Release 15
Procedures where used	5G Initial Registration, 5G Authentication Procedure
Related timers	T3560

What is Authentication Reject in simple terms?

Authentication Reject is the NAS message the network sends when the UE's authentication attempt is not accepted and the current 5GMM path must stop.

Explicitly terminates the current authentication procedure from the network side.

Why this message matters

Authentication Reject means the network refused to continue the authentication procedure.

Where this message appears in the call flow

5G Authentication Procedure

Call flow position: Negative network outcome that stops the authentication branch.

Typical state: UE is still unauthenticated for the current procedure.

Preconditions:

The network determined that authentication cannot continue successfully.

Next likely message: Procedure stop or later fresh registration

Call flow position

Previous message(s): Authentication Request, Authentication Response

Next message(s): Procedure termination, Fresh registration attempt

Message direction and transport

Sender and receiver: AMF to UE

Interface: N1

Domain: Core-side mobility management rejection signaling

Signaling bearer: NAS signaling

Logical channel: Dedicated NAS message, commonly via DL Information Transfer

Transport / encapsulation: NAS 5GS message carried end-to-end between AMF and UE

Security context: Usually tied to an authentication failure path rather than a successful security context.

Message Structure Overview

Authentication Reject is intentionally minimal. Its value is procedural rather than field-rich.

ASN.1 Message Syntax for 5G NAS - Authentication Reject

This message is not typically analyzed as ASN.1 on the wire. It is usually read as a NAS or protocol field structure instead.

Authentication Reject is a NAS 24.501 message, not an ASN.1 message.

5G NAS - Authentication Reject - Example Dump

Authentication Reject
  Extended Protocol Discriminator: 5G Mobility Management
  Security Header Type: Plain NAS
  Message Type: Authentication Reject

How to read this dump

This message is usually interpreted together with the preceding challenge and response exchange.

What to check in logs and traces

Confirm whether the UE answered the challenge before the reject was sent.
Check earlier authentication values and any AMF-side decision context.
Correlate later UE behavior with procedure termination or fresh retry.

Common Issues and Troubleshooting

Registration stops after authentication without a detailed NAS cause.

Likely cause: The network explicitly rejected the authentication branch.

What to inspect: Check Authentication Request, Authentication Response, and subscriber-side authentication context.

Next step: Shift analysis to earlier authentication challenge validation and subscription data.

FAQ

What does Authentication Reject mean in 5G?

It means the network did not accept the authentication procedure and stopped the current registration path.

Related message pages

Related Procedures

Related Tools

Use This Reference in Practice

Decode this message with the 3GPP Decoder, inspect the related message database, or open the matching call flow to see where this signaling step fits in the full procedure.