5G Non-Standalone (NSA) Option-3x - UE Attach Procedures

Introduction

In 5G Non-Standalone (NSA), 5G NR (New Radio) is deployed alongside existing 4G LTE infrastructure. The 4G LTE network acts as the anchor, handling control plane signaling.

5G NR mainly boosts user data throughput.

Option 3x is one of the most widely deployed NSA architectures.

• Control Plane (Signaling) is only through LTE eNB (master node).

• User Plane (Data) can be through both LTE eNB and 5G gNB (secondary node).

• Bearers involved:

  • Master Cell Group (MCG) bearer → only LTE eNB

  • Secondary Cell Group (SCG) bearer → only 5G gNB

  • Split bearer → both LTE and NR together (Option 3x-specific)

Type	Path	Data Handling
MCG Bearer	LTE only	Legacy LTE bearers
SCG Bearer	5G NR only	Standalone NR bearer
Split Bearer	LTE + NR	Data split dynamically

Bearer Splitting happens at the Master Node (MeNB) — which is the LTE eNB.

Specifically:

• At the PDCP (Packet Data Convergence Protocol) Layer in the eNB.

• The eNB decides, splits, and forwards the user plane packets toward LTE radio or gNB (NR radio).

Below are detailed steps how bearer splitting happens,

Step 1: Data arrives from the SGW to the eNB

• SGW sends GTP-U encapsulated user-plane data to the eNB.

• Each flow/bearer is identified by a TEID (Tunnel Endpoint Identifier).

• SGW does NOT know about 5G at this point — it only knows the eNB.

Step 2: eNB PDCP layer processes incoming packets

At the eNB:

• PDCP Layer takes the incoming data (packets).

• It looks at splitting rules based on:

  • QoS requirements

  • Radio link quality (CQI reports from UE)

  • Buffer load

  • Scheduling policies

Step 3: eNB decides packet distribution

• Some packets are sent directly down to LTE RLC/MAC/PHY layers → transmitted over LTE.

• Other packets are forwarded over the Xn interface (via GTP-U) to the gNB (Secondary Node).

• gNB will then transmit them via the NR radio.

In simple words, eNB "chooses" per-packet whether to transmit over LTE itself, or to hand it over to gNB for NR transmission.

Step 4: Forwarding to gNB (Secondary Node)

• For packets to gNB:

  • eNB encapsulates them in a GTP-U tunnel over the X2 interface toward the gNB.

  • gNB receives them and sends them over 5G radio to the UE.

5G NSA UE Attach Procedures

Procedure	NAS/NGAP/EPC Message Examples
Initial Access	RRCConnectionRequest → RRCConnectionSetup → RRCConnectionSetupComplete (Attach Request)
Authentication	AuthenticationRequest ↔ AuthenticationResponse; SecurityModeCommand ↔ SecurityModeComplete
Attach Accept & Bearer Setup	AttachAccept → ActivateDefaultEPSBearerContextRequest; E-RAB Setup
EN-DC Setup	SgNB Addition Request ↔ SgNB Addition Ack
Detach	DetachRequest → UEContextReleaseCommand

1. Initial Access

This starts when UE powers on and tries to connect to 5G NR cell (with LTE as anchor).

The synchronization signal identifies the cell with the PCI (Physical layer Cell Identity). The PCI of the 4G cell is calculated from two values: NID(1), NID(2)

The number Ncell_ID (PCI) = 3*NID(1)+NID(2) 

Where NID(1) is ranging from 0-167 from SSS, NID(2) is {0,1,2} from PSS signal.  

Key Steps:

tep	Action	UE Logs	NGAP/Core Logs
1	Cell Search and Synchronization: UE synchronizes to LTE eNB (detects PSS and SSS)	DL-SCH decode PSS/SSS synchronization	-
2	System Information Reading: UE reads MIB/SIB1/SIB2 for network info	RRC: SystemInformationBlockType1/2	-
3	RACH Procedure (Random Access)
3.1	UE sends PRACH Preamble randomly selected (Msg1)	PRACH: Random Access Preamble transmission	-
3.2	eNB responds with Random Access Response (RAR) (Msg2)	RAR: TimingAdvanceCommand, Temporary C-RNTI	eNB Logs: "RAR Sent"
3.3	UE sends RRC Connection Request (Msg3) using Temporary C-RNTI	RRCConnectionRequest: establishmentCause=mo-Signalling	eNB Logs: "Received RRC Connection Request"
3.4	eNB sends RRC Connection Setup (Msg4)	RRCConnectionSetup: radioBearerConfig
4	UE sends RRC Connection Setup Complete (with NAS Attach Request inside)	RRCConnectionSetupComplete: nasMessage=AttachRequest	eNB sends Initial UE Message to MME

Notes:

• Attach Request: Contains IMSI/TMSI, UE capabilities, NAS key set identifier.

• MME identifies if UE is 5G capable.

2. Authentication Procedure

Authentication is managed by the EPC Core (MME + HSS).

Step	Action	UE Logs	NGAP/Core Logs
1	MME sends Authentication Request to UE	NAS: AuthenticationRequest	MME to eNB: Downlink NAS Transport (Authentication Request)
2	UE processes challenge, sends Authentication Response	NAS: AuthenticationResponse	eNB to MME: Uplink NAS Transport (Authentication Response)
3	If successful, MME sends Security Mode Command (selects ciphering/integrity algorithms)	NAS: SecurityModeCommand	eNB to UE
4	UE responds with Security Mode Complete	NAS: SecurityModeComplete

Notes:

• KSI (Key Set Identifier) is checked.

• EPS AKA (Authentication and Key Agreement) is used (based on LTE).

3. Attach Accept and Setup of Default Bearer (PDU Session Establishment)

After authentication:

Step	Action	UE Logs	NGAP/Core Logs
1	MME sends Attach Accept and Default EPS Bearer Context	NAS: AttachAccept NAS: ActivateDefaultEPSBearerContextRequest	MME to eNB
2	UE sends Attach Complete	NAS: AttachComplete	eNB to MME
3	Default Bearer is established with SGW/PGW	-	SGW allocates IP Address; PGW provides PDU session anchoring
4	E-RAB Setup Request from MME to eNB to allocate radio resources for the bearer	RRC: RRCConnectionReconfiguration PDCP/Bearer setup

Additional Notes:

• In NSA, after LTE bearer setup, UE starts EN-DC (E-UTRA-NR Dual Connectivity) if NR is available.

• eNB acts as Master Node, and gNB acts as Secondary Node (gNB added via X2/S1 signaling).

4. Secondary Node Addition (5G NR Connection Setup)

For data over NR:

Step	Action	UE Logs	NGAP/Core Logs
1	eNB triggers Secondary Node Addition (gNB)	RRC: SCG-Configuration	SgNB Addition Request (X2AP)
2	gNB responds with success	RRC: RRCConnectionReconfigurationComplete	X2AP: SgNB Addition Request Acknowledge
3	Data now flows through LTE+NR split bearers	UE RLC/PDCP activity in LTE+NR	SGW routes data via LTE/NR

Notes:

• Bearer splitting based on policies (split bearer, MCG bearer, SCG bearer).

• NR Secondary Cell Group (SCG) configures NR radio parameters.

5. Detach Procedure

When UE wants to detach (power off or by command):

Step	Action	UE Logs	NGAP/Core Logs
1	UE sends Detach Request to eNB/MME	NAS: DetachRequest	eNB to MME
2	MME sends UE Context Release Command to eNB	NGAP: UEContextReleaseCommand
3	UE releases RRC connection	RRCConnectionRelease
4	MME releases session with SGW/PGW	S1/NAS Core Logs: Session Release messages

Notes:

• EPS Bearers are deleted.

• IP address is deallocated.

• NR Secondary Node release happens first if connected.

Brief summary of RRC/NAS messages involved during UE attach procedure

1)    RRC-MSG- RRCConnectionRequest

2)    NAS-MSG- AttachRequest

3)    NGAP-MSG- InitialUEMessage

4)    NAS-MSG- AuthenticationRequest

5)    NAS-MSG- AuthenticationResponse

6)    NAS-MSG- SecurityModeCommand

7)    NAS-MSG- SecurityModeComplete

8)    NAS-MSG- AttachAccept

9)    NAS-MSG- AttachComplete

10) RRC-MSG- RRCConnectionReconfiguration (Bearer Setup)

11) RRC-MSG- RRCConnectionReconfiguration (SCG Addition)

12) NAS-MSG- DetachRequest

13) RRC-MSG- RRCConnectionRelease

References:

1. https://www.eventhelix.com/5G/non-standalone-access-en-dc/en-dc-secondary-node-addition.pdf

2. NG-RAN and 5G-NR 5G Radio Access Network and Radio Interface, Frédéric Launay