PDU Session Establishment Reject is the 5GSM failure response the network sends when the requested PDU session cannot be created and the UE needs the rejection reason.
Message Fact Sheet
Protocol
nas
Network
5g
Spec
3GPP TS 24.501
Spec Section
8.3.3
Direction
SMF to UE via AMF
Message Type
5GSM signaling
Full message name
5G NAS - PDU Session Establishment Reject
Protocol
NAS
Technology
5G
Direction
SMF to UE via AMF
Interface
N1
Signaling bearer / channel
NAS signaling / Usually carried inside DL NAS Transport on the access side
Typical trigger
The requested DNN, slice, PDU session type, SSC mode, subscription, or policy context does not allow the network to create the requested session.
Main purpose
Stops the current session-establishment attempt and returns the cause, retry guidance, and optional session-context details that explain why the request was not accepted.
Main specification
3GPP TS 24.501, 8.3.3
Release added
Release 15
Procedures where used
5G PDU Session Establishment, VoNR Registration, Enterprise or slice-specific service denial analysis
Related timers
T3580
Related cause values
5GSM cause
What is PDU Session Establishment Reject in simple terms?
PDU Session Establishment Reject is the 5GSM failure response the network sends when the requested PDU session cannot be created and the UE needs the rejection reason.
Stops the current session-establishment attempt and returns the cause, retry guidance, and optional session-context details that explain why the request was not accepted.
Why this message matters
PDU Session Establishment Reject is the network telling the UE that the requested data session cannot be created, along with the reason why.
Where this message appears in the call flow
5G PDU Session Establishment
Call flow position: Negative 5GSM response when the requested session cannot be created.
Typical state: UE is registered but the requested session-establishment path is being refused.
Preconditions:
The UE already attempted session establishment.
The network evaluated the request and determined it cannot accept the requested session as sent.
Next likely message: Retry, wait, or remain without the requested session depending on cause and back-off guidance
VoNR Registration
Call flow position: May appear when the IMS session request is rejected even though registration itself succeeded.
Typical state: UE is registered but cannot obtain the IMS or service-specific session it needs.
Preconditions:
Registration completed successfully.
The IMS-related DNN, slice, or policy path failed during session creation.
Next likely message: Retry with corrected context or fail service bring-up
Domain: Core-side session management rejection with access-side NAS delivery dependency
Signaling bearer: NAS signaling
Logical channel: Usually carried inside DL NAS Transport on the access side
Transport / encapsulation: 5GSM NAS message transported end-to-end from the SMF to the UE through AMF mediation
Security context: Normally delivered after NAS security is already active, so engineers usually expect protected downlink NAS handling.
Message Structure Overview
PDU Session Establishment Reject is a 5GSM failure response, so engineers read it as a TS 24.501 information-element structure rather than ASN.1.
The central troubleshooting field is the 5GSM cause, with back-off guidance and allowed SSC mode often explaining the operational behavior that follows.
In traces, the fastest root-cause path usually comes from correlating the reject with the original request's DNN, S-NSSAI, PDU session type, and policy assumptions.
ASN.1 Message Syntax for 5G NAS - PDU Session Establishment Reject
This message is not typically analyzed as ASN.1 on the wire. It is usually read as a NAS or protocol field structure instead.
This is a NAS 5GSM message defined by TS 24.501 information elements rather than ASN.1 syntax.
5G NAS - PDU Session Establishment Reject - Example Dump
Start with PDU Session ID and PTI so you correlate the failure with the correct request.
Read 5GSM Cause next because it defines the troubleshooting path much more than the message name itself.
Back-off Timer Value is operationally important because a silent UE after reject may simply be respecting retry rules.
Allowed SSC Mode can explain why a request failed even when the DNN and slice looked valid.
If EPCO is present, check whether the returned values are empty or indicate that the session never got far enough to receive configuration.
Important Information Elements
IE
Required
Description
PDU Session ID
Yes
Identifies which requested session was rejected and is the first field used to correlate the failure with the original request.
PTI
Yes
Matches the reject to the original 5GSM transaction so engineers do not confuse it with another overlapping session attempt.
5GSM cause
Yes
Primary failure reason explaining why the session could not be created.
Back-off timer value
Optional
Tells the UE how long it should wait before retrying, which can dramatically change observed behavior after failure.
Allowed SSC mode
Optional
Shows which SSC mode would have been acceptable when the requested continuity model was not allowed.
Re-attempt indicator
Optional
Guides retry expectations and helps explain whether the UE should attempt the procedure again.
EAP message
Optional
Carries a negative external-DN authentication result when session authentication is part of the path.
Extended protocol configuration options
Optional
May carry additional context relevant to the failed request and is useful in advanced service troubleshooting.
Detailed field explanation
PDU Session ID
Identifies which requested session was rejected and is the first field used to correlate the failure with the original request.
Presence: Required
In practice: In practice, compare this field with the original request and with any later release-dependent optional fields so you can see whether the network accepted the same service model the UE asked for.
PTI
Matches the reject to the original 5GSM transaction so engineers do not confuse it with another overlapping session attempt.
Presence: Required
In practice: In practice, compare this field with the original request and with any later release-dependent optional fields so you can see whether the network accepted the same service model the UE asked for.
5GSM cause
Primary failure reason explaining why the session could not be created.
Presence: Required
In practice: When this appears in an accept, it often means the network normalized a requested value rather than failing the session outright. Check it together with the selected session type, not in isolation.
Back-off timer value
Tells the UE how long it should wait before retrying, which can dramatically change observed behavior after failure.
Presence: Optional
In practice: In practice, compare this field with the original request and with any later release-dependent optional fields so you can see whether the network accepted the same service model the UE asked for.
Allowed SSC mode
Shows which SSC mode would have been acceptable when the requested continuity model was not allowed.
Presence: Optional
In practice: This matters for mobility and service continuity. If the accepted SSC mode is different from what the UE or service expected, later handover or anchor behavior can look inconsistent even though the session itself was accepted.
Re-attempt indicator
Guides retry expectations and helps explain whether the UE should attempt the procedure again.
Presence: Optional
In practice: In practice, compare this field with the original request and with any later release-dependent optional fields so you can see whether the network accepted the same service model the UE asked for.
EAP message
Carries a negative external-DN authentication result when session authentication is part of the path.
Presence: Optional
In practice: If present, it reflects the external DN authentication result. It is worth checking when the session succeeds on NAS but service access still depends on an external authentication flow.
Extended protocol configuration options
May carry additional context relevant to the failed request and is useful in advanced service troubleshooting.
Presence: Optional
In practice: This is where DNS and other operational configuration can hide. When the session is accepted but applications still fail, EPCO is often one of the first optional fields worth validating.
What to check in logs and traces
Confirm the reject matches the expected request transaction using PDU Session ID and PTI.
Inspect the 5GSM cause before analyzing later service symptoms.
Check whether the requested DNN, S-NSSAI, PDU session type, and SSC mode were actually allowed for the subscriber and area.
Verify whether a Back-off Timer Value or retry-related indicator is present.
Correlate the reject with registration-time Allowed NSSAI and any slice-selection behavior.
If the session was for IMS or enterprise service, compare the failure against the intended service policy and DNN mapping.
Correlate the NAS reject with core-side SMF policy and subscription traces before assuming a radio issue.
Common Issues and Troubleshooting
The session request is rejected immediately.
Likely cause: The requested DNN, slice, subscription, or session type does not match what the network allows.
What to inspect: Check 5GSM cause, DNN, S-NSSAI, PDU session type, and request type in the original request.
Next step: Troubleshoot by the returned cause rather than retrying blindly.
The UE does not retry after the reject.
Likely cause: A back-off timer or retry restriction is present and the UE is correctly waiting.
What to inspect: Check Back-off Timer Value and any retry or re-attempt guidance.
Next step: Validate timer-driven behavior before treating it as a separate access failure.
Registration succeeds but IMS or enterprise service still cannot start.
Likely cause: The session-establishment path, not the registration path, is failing due to DNN, slice, or policy mismatch.
What to inspect: Compare this reject against the original request and registration-time Allowed NSSAI or service context.
Next step: Shift troubleshooting from 5GMM success to 5GSM denial cause.
The reject appears but the cause seems too generic to explain the problem.
Likely cause: The visible cause may be only the surface symptom while the real reason sits in subscription, policy, or DNN normalization.
What to inspect: Check the SMF decision path, subscriber policy, and whether the request was normalized before rejection.
Next step: Correlate the reject with the core network policy result and slice selection outcome.
FAQ
What is PDU Session Establishment Reject in 5G?
It is the 5GSM failure response that tells the UE the requested session could not be created and provides the reason.
What should engineers inspect first?
Start with PDU Session ID, PTI, and especially the 5GSM cause, then inspect any back-off or SSC-mode guidance.
Does this always mean the radio path failed?
No. It usually points to session-management, DNN, slice, subscription, or policy issues rather than radio decode failure.
Why is the back-off timer important?
Because it changes retry behavior and can make the UE appear idle when it is actually following network retry instructions.
What comes after PDU Session Establishment Reject?
That depends on the cause and any retry guidance. The UE may wait, retry with changed context, or remain without the requested service.
Can the reject still include useful configuration information?
Yes. Some deployments include optional context such as a back-off timer, allowed SSC mode, or EAP information.
Decode this message with the 3GPP Decoder, inspect the related message database, or open the matching call flow to see where this signaling step fits in the full procedure.