diff --git a/src/gb/gprs_ns2.c b/src/gb/gprs_ns2.c
index 5e5dd83..fd016e6 100644
--- a/src/gb/gprs_ns2.c
+++ b/src/gb/gprs_ns2.c
@@ -1153,6 +1153,8 @@
 	nsi->timeout[NS_TOUT_TNS_ALIVE] = 3;
 	nsi->timeout[NS_TOUT_TNS_ALIVE_RETRIES] = 10;
 	nsi->timeout[NS_TOUT_TSNS_PROV] = 3; /* 1..10 */
+	nsi->timeout[NS_TOUT_TSNS_SIZE_RETRIES] = 3;
+	nsi->timeout[NS_TOUT_TSNS_CONFIG_RETRIES] = 3;
 
 	return nsi;
 }
diff --git a/src/gb/gprs_ns2_internal.h b/src/gb/gprs_ns2_internal.h
index d12c663..9e63c70 100644
--- a/src/gb/gprs_ns2_internal.h
+++ b/src/gb/gprs_ns2_internal.h
@@ -15,10 +15,8 @@
 struct gprs_ns2_vc_driver;
 struct gprs_ns2_vc_bind;
 
-
-
-#define NS_TIMERS_COUNT 8
-#define NS_TIMERS "(tns-block|tns-block-retries|tns-reset|tns-reset-retries|tns-test|tns-alive|tns-alive-retries|tsns-prov)"
+#define NS_TIMERS_COUNT 10
+#define NS_TIMERS "(tns-block|tns-block-retries|tns-reset|tns-reset-retries|tns-test|tns-alive|tns-alive-retries|tsns-prov|tsns-prov-retries)"
 #define NS_TIMERS_HELP	\
 	"(un)blocking Timer (Tns-block) timeout\n"		\
 	"(un)blocking Timer (Tns-block) number of retries\n"	\
@@ -27,7 +25,9 @@
 	"Test Timer (Tns-test) timeout\n"			\
 	"Alive Timer (Tns-alive) timeout\n"			\
 	"Alive Timer (Tns-alive) number of retries\n"		\
-	"SNS Provision Timer (Tsns-prov) timeout\n"
+	"SNS Provision Timer (Tsns-prov) timeout\n"		\
+	"SNS Size number of retries\n"				\
+	"SNS Config number of retries\n"			\
 
 /* Educated guess - LLC user payload is 1500 bytes plus possible headers */
 #define NS_ALLOC_SIZE	3072
@@ -42,6 +42,8 @@
 	NS_TOUT_TNS_ALIVE,
 	NS_TOUT_TNS_ALIVE_RETRIES,
 	NS_TOUT_TSNS_PROV,
+	NS_TOUT_TSNS_SIZE_RETRIES,
+	NS_TOUT_TSNS_CONFIG_RETRIES,
 };
 
 enum nsvc_timer_mode {
diff --git a/src/gb/gprs_ns2_sns.c b/src/gb/gprs_ns2_sns.c
index 0676b61..f25d93a 100644
--- a/src/gb/gprs_ns2_sns.c
+++ b/src/gb/gprs_ns2_sns.c
@@ -119,6 +119,8 @@
 	struct gprs_ns2_vc *sns_nsvc;
 	/* iterate over the binds after all remote has been tested */
 	int bind_offset;
+	/* timer N */
+	int N;
 
 	/* local configuration to send to the remote end */
 	struct gprs_ns_ie_ip4_elem *ip4_local;
@@ -1304,14 +1306,22 @@
 
 static int ns2_sns_fsm_bss_timer_cb(struct osmo_fsm_inst *fi)
 {
+	struct ns2_sns_state *gss = (struct ns2_sns_state *) fi->priv;
 	struct gprs_ns2_nse *nse = nse_inst_from_fi(fi);
 	struct gprs_ns2_inst *nsi = nse->nsi;
 
+	gss->N++;
 	switch (fi->T) {
 	case 1:
+		if (gss->N >= nsi->timeout[NS_TOUT_TSNS_SIZE_RETRIES])
+			osmo_fsm_inst_dispatch(fi, GPRS_SNS_EV_SELECT_ENDPOINT, NULL);
+
 		osmo_fsm_inst_state_chg(fi, GPRS_SNS_ST_SIZE, nsi->timeout[NS_TOUT_TSNS_PROV], 1);
 		break;
 	case 2:
+		if (gss->N >= nsi->timeout[NS_TOUT_TSNS_CONFIG_RETRIES])
+			osmo_fsm_inst_dispatch(fi, GPRS_SNS_EV_SELECT_ENDPOINT, NULL);
+
 		osmo_fsm_inst_state_chg(fi, GPRS_SNS_ST_CONFIG_BSS, nsi->timeout[NS_TOUT_TSNS_PROV], 2);
 		break;
 	}