5G UE Will Not Attach: A Layered Troubleshooting Method

[Pavel]

Short answer: Follow the attach sequence: RF synchronization, system information, random access, RRC setup, NAS authentication, security mode, registration and PDU session. The first missing transition identifies the configuration layer; changing subscriber keys cannot fix absent RF synchronization.

Before you start​

• Run private cellular experiments in an authorized, shielded or tightly conducted RF environment with sufficient attenuation between radio ports.
• Record RAN, core, UHD, firmware and operating-system versions together; a working configuration is a matched software and hardware set.

Step-by-step method​

1. Step 1: Confirm the UE sees the intended cell, correct band and sufficient clean signal in the attenuated path. Check frequency reference and sample-stream stability.
2. Step 2: Read gNB logs for PRACH detection and RAR response. If random access fails, inspect timing, RF level, TDD pattern and frequency rather than the core database.
3. Step 3: If RRC succeeds, compare PLMN, TAC, subscriber identity, authentication key, OP/OPc and sequence handling between UE and core.
4. Step 4: After registration, troubleshoot APN/DNN, slice and routing for the PDU session separately. Capture one clean log set before changing any value.

Concrete example​

A UE displaying the network name but never producing PRACH at the gNB is an RF or access-stage problem. A UE reaching authentication reject has already passed RF synchronization and RRC, so focus on subscriber/core values.

How to judge the result​

The method succeeds when logs show a complete sequence and repeated attach after restart; document the first failed message and the exact fix.

What to record​

• Troubleshoot registration in order: RF synchronization, broadcast system information, random access, RRC, authentication, security mode and PDU session.
• Monitor CPU scheduling, USB or network throughput, clock state and RAN logs during a sustained cell test.
• Use spectrum analysis and power calculation to confirm that leakage outside the controlled path remains below the lab requirement.

Common mistakes​

• Changing several hardware, software or RF variables at once, which removes the controlled comparison needed to identify the cause.
• Treating one autoscaled screenshot or one unusually good result as proof without recording the settings and repeating the test.
• Changing PLMN, keys, gain and clock together can move the failure while destroying the evidence needed to identify it.

Final check​

Cold-start the core, RAN, SDR and test UE in the documented order. A private-5G baseline is complete only when attach and traffic repeat inside the verified attenuated RF environment.