RRCSetup & RRCSetupRequest
The RRC connection establishment procedure transitions a UE from Idle to Connected state. It begins with RRCSetupRequest, continues with RRCSetup, and completes with RRCSetupComplete carrying the first NAS message.
Key Facts. RRC Connection Establishment
- Procedure
- RRC Connection Establishment (Idle → Connected)
- Messages
- RRCSetupRequest → RRCSetup → RRCSetupComplete
- Channels
- UL-CCCH (request), DL-CCCH (setup), UL-DCCH (complete)
- Guard timer
- T300 (started at RRCSetupRequest, stopped at RRCSetup reception)
- 3GPP specification
- TS 38.331 Section 5.3.3 (NR), TS 36.331 Section 5.3.3 (LTE)
- LTE equivalent
- RRCConnectionRequest / RRCConnectionSetup / RRCConnectionSetupComplete
Connection establishment procedure
When a UE in RRC_IDLE state needs to establish a signaling connection, for example, to initiate a call, send data, respond to paging or perform a registration update, it triggers the RRC connection establishment procedure. This is the fundamental entry point to the connected state in both LTE and 5G NR.
The procedure begins with the UE performing the Random Access procedure (RACH) to obtain uplink timing synchronization and a temporary C-RNTI. Once RACH succeeds, the UE sends RRCSetupRequest on the UL-CCCH logical channel. This message is small, it carries only the UE identity and the reason for the connection (establishment cause).
The gNB evaluates the request and, if resources are available, responds with RRCSetup on DL-CCCH. This message contains the initial master cell group configuration (masterCellGroup), which establishes SRB1 (Signaling Radio Bearer 1), the first dedicated signaling channel between the UE and the gNB. If the gNB cannot serve the request, it sends RRCReject with a waitTime, after which the UE may retry.
Upon receiving RRCSetup, the UE applies the configuration, transitions to RRC_CONNECTED and sends RRCSetupComplete on the newly configured UL-DCCH (SRB1). This message carries the first NAS message (dedicatedNAS-Message), typically a Registration Request in 5G or Attach Request in LTE, and the selected PLMN identity.
Message flow, step by step
UE → gNB: RRCSetupRequest (UL-CCCH)
The UE sends its initial identity (random value or 5G-S-TMSI / resumeMAC-I for resume) and the establishment cause. The UE starts timer T300.
gNB → UE: RRCSetup (DL-CCCH)
The gNB provides the masterCellGroup configuration establishing SRB1. This includes RLC, MAC, and physical layer parameters needed for dedicated signaling. UE stops T300.
UE → gNB: RRCSetupComplete (UL-DCCH / SRB1)
The UE confirms the connection, includes the selected PLMN identity and carries the first NAS message (e.g., Registration Request, Service Request) in dedicatedNAS-Message. The UE is now in RRC_CONNECTED.
Key Information Elements
| Message | IE name | Description |
|---|---|---|
| RRCSetupRequest | ue-Identity (InitialUE-Identity) | Either a 39-bit random value (ng-5G-S-TMSI-Part1) or the full 5G-S-TMSI when the UE has been previously registered. |
| RRCSetupRequest | establishmentCause | Reason for connection: emergency, highPriorityAccess, mt-Access, mo-Signalling, mo-Data, mo-VoiceCall, mo-VideoCall, mo-SMS, mps-PriorityAccess, mcs-PriorityAccess. |
| RRCSetup | masterCellGroup | Encoded CellGroupConfig containing initial SRB1 configuration: RLC bearer config, MAC-CellGroupConfig, PhysicalCellGroupConfig and SpCellConfig. |
| RRCSetupComplete | selectedPLMN-Identity | Index into the PLMN identity list broadcast in SIB1, indicating which PLMN the UE selected for registration. |
| RRCSetupComplete | dedicatedNAS-Message | The first NAS PDU sent to the core network, typically Registration Request (5G) or Attach Request (LTE). This is forwarded by the gNB to the AMF/MME. |
| RRCSetupComplete | registeredAMF | If the UE was previously registered, it includes the registered AMF information (GUAMI) to assist the gNB in routing the NAS message. |
Common failure scenarios
T300 timer expiry
The UE sent RRCSetupRequest but did not receive RRCSetup before T300 expired. This typically indicates poor radio conditions, network congestion, or RACH failure. The UE returns to RRC_IDLE and may reattempt.
RRCReject received
The gNB explicitly rejects the connection attempt, usually due to overload. The RRCReject includes a waitTime value (in seconds). The UE must wait before retrying and may select a different cell.
RACH failure
The Random Access procedure fails before RRCSetupRequest can be sent. Causes include preamble collision, insufficient power ramping, timing issues, or very poor SINR on PRACH resources.
Access barring
The cell broadcasts access barring parameters in SIB1. If the UE's access category is barred, it cannot initiate RRC connection establishment. This is used for network congestion control.
LTE vs 5G NR connection establishment
| Aspect | LTE (TS 36.331) | 5G NR (TS 38.331) |
|---|---|---|
| Request message | RRCConnectionRequest | RRCSetupRequest |
| Setup message | RRCConnectionSetup | RRCSetup |
| Complete message | RRCConnectionSetupComplete | RRCSetupComplete |
| UE identity | s-TMSI or randomValue | ng-5G-S-TMSI-Part1 or randomValue |
| First NAS message | Attach Request / Service Request | Registration Request / Service Request |
How to decode RRCSetup messages online
Select the channel
Choose UL-CCCH for RRCSetupRequest, DL-CCCH for RRCSetup, or UL-DCCH for RRCSetupComplete.
Paste hex frame
Paste the hexadecimal frame from your log capture tool (QCAT, Wireshark, XCAL, TEMS).
Decode and inspect
Click Decode. Check establishment cause, masterCellGroup config, and the embedded NAS message in SetupComplete.
Frequently Asked Questions
What is the RRC connection establishment procedure?
The RRC connection establishment procedure transitions a UE from RRC_IDLE to RRC_CONNECTED. The UE initiates the procedure by sending an RRCSetupRequest on the UL-CCCH logical channel via the RACH (Random Access Channel). The gNB responds with an RRCSetup message on the DL-CCCH, which provides the initial SRB1 configuration. The UE completes the procedure by sending RRCSetupComplete on the newly established SRB1 (UL-DCCH), which carries the first NAS message (e.g., Registration Request or Service Request) to the core network.
What is the difference between RRCSetupRequest and RRCSetup?
RRCSetupRequest is sent by the UE (uplink) to initiate RRC connection establishment. It contains the InitialUE-Identity (either a random value or the UE's 5G-S-TMSI) and the establishmentCause (e.g., mo-Signalling, mo-Data, mt-Access, emergency). RRCSetup is the network response (downlink) that provides the master cell group configuration (masterCellGroup) needed to establish SRB1 and transition the UE to RRC_CONNECTED state.
What causes RRC connection setup failure?
Common failure causes include: (1) RRCReject, the gNB rejects the request due to overload and provides a wait timer. (2) T300 timer expiry, the UE did not receive RRCSetup before the timer expired, indicating radio link issues or network congestion. (3) RACH failure, the UE cannot complete the random access preamble exchange due to poor coverage or interference. (4) Cell barring, the SIB1 indicates the cell is barred or reserved. (5) Access class barring, the UE's access class is restricted by the network. The UE may retry on the same cell or perform cell reselection.
What is RRCSetupComplete used for?
RRCSetupComplete is the third and final message in the RRC connection establishment procedure. Sent by the UE on UL-DCCH (SRB1), it confirms that the UE has successfully applied the configuration from RRCSetup. Critically, it carries the dedicatedNAS-Message, the first NAS message the UE sends to the core network, such as a Registration Request (5G) or Attach Request (LTE). It also includes the selectedPLMN-Identity, indicating which PLMN the UE selected from the SIB1 broadcast.
Related resources
L3 Protocol Decoder
Online RRC and NAS decoder for 2G/3G/4G/5G. Free, no signup.
What is RRC Protocol?
Complete guide to the Radio Resource Control protocol in LTE and 5G NR.
RRC & NAS Message Glossary
Reference table of all RRC and NAS message types across 2Gโ5G.
RRCReconfiguration Message
The reconfiguration message sent after connection establishment to modify the radio config.