diff --git a/asterisk/IMS_ConnectionHandler.ttcn b/asterisk/IMS_ConnectionHandler.ttcn
index 7b26980..d396268 100644
--- a/asterisk/IMS_ConnectionHandler.ttcn
+++ b/asterisk/IMS_ConnectionHandler.ttcn
@@ -208,7 +208,7 @@
 					charstring domain,
 					charstring imsi,
 					template (omit) IMS_CallPars cp := omit) := {
-	t_guard := 30.0,
+	t_guard := 60.0,
 	realm := domain,
 	local_sip_host := local_sip_host,
 	local_sip_port := local_sip_port,
@@ -237,7 +237,7 @@
 	fn.apply(id);
 }
 
-private altstep as_SIP_fail_req(charstring exp_msg_str := "") runs on IMS_ConnHdlr
+altstep as_SIP_fail_req(charstring exp_msg_str := "") runs on IMS_ConnHdlr
 {
 	var PDU_SIP_Request sip_req;
 	[] SIP.receive(PDU_SIP_Request:?) -> value sip_req {
@@ -246,7 +246,7 @@
 	}
 }
 
-private altstep as_SIP_fail_resp(charstring exp_msg_str := "") runs on IMS_ConnHdlr
+altstep as_SIP_fail_resp(charstring exp_msg_str := "") runs on IMS_ConnHdlr
 {
 	var PDU_SIP_Response sip_resp;
 	[] SIP.receive(PDU_SIP_Response:?) -> value sip_resp {
@@ -533,8 +533,18 @@
 	return valueof(wwwAuthenticate);
 }
 
+type enumerated IMS_register_early_return {
+	IMS_REG_EARLY_RET_BEFORE_None,
+	IMS_REG_EARLY_RET_BEFORE_Initial_100Trying,
+	IMS_REG_EARLY_RET_BEFORE_Initial_401Unauthorized,
+	IMS_REG_EARLY_RET_BEFORE_Resync_401Unauthorized,
+	IMS_REG_EARLY_RET_BEFORE_Protected_100Trying,
+	IMS_REG_EARLY_RET_BEFORE_Protected_200OK
+}
+
 /* Peer is issuing 1st register, accept it: */
 altstep as_IMS_register(boolean exp_auth_resync := false,
+			IMS_register_early_return early_ret := IMS_REG_EARLY_RET_BEFORE_None,
 			boolean fail_others := true) runs on IMS_ConnHdlr
 {
 	var template (present) PDU_SIP_Request exp_req :=
@@ -562,6 +572,10 @@
 		var template (value) Supported supported := ts_Supported({"sec-agree"});
 		var integer sip_seq_nr;
 
+		if (early_ret == IMS_REG_EARLY_RET_BEFORE_Initial_100Trying) {
+			return; /* Done */
+		}
+
 		sip_call_id := g_rx_sip_req.msgHeader.callId.callid;
 		via := g_rx_sip_req.msgHeader.via;
 		via.viaBody[0].viaParams := f_sip_param_set(via.viaBody[0].viaParams, "rport", "1234"); /* TODO: set remote src port of the REGISTER */
@@ -595,6 +609,10 @@
 		f_ims_parse_register_contact(g_rx_sip_req.msgHeader.contact);
 		f_ims_parse_security_client(g_rx_sip_req.msgHeader.security_client);
 
+		if (early_ret == IMS_REG_EARLY_RET_BEFORE_Initial_401Unauthorized) {
+			return; /* Done */
+		}
+
 		if (not exp_auth_resync) {
 			/* Delay ipsec setup in ip xfrm, since there will be another
 			* 1st REGISTER with potentially new ports coming in later. */
@@ -636,6 +654,10 @@
 					authorization := authorization);
 			SIP.receive(exp_req) -> value g_rx_sip_req;
 
+			if (early_ret == IMS_REG_EARLY_RET_BEFORE_Resync_401Unauthorized) {
+				return; /* Done */
+			}
+
 			via := g_rx_sip_req.msgHeader.via;
 			from_addr := g_rx_sip_req.msgHeader.fromField;
 			to_addr := g_rx_sip_req.msgHeader.toField;
@@ -680,7 +702,7 @@
 		}
 
 		/* Now we should receive a new REGISTER over ipsec: */
-		as_IMS_2nd_register(wwwAuthenticate);
+		as_IMS_2nd_register(wwwAuthenticate, early_ret := early_ret);
 	}
 	[fail_others] as_SIP_fail_resp(sip_expect_str);
 	[fail_others] as_SIP_fail_req(sip_expect_str);
@@ -688,7 +710,9 @@
 }
 
 /* Peer is issuing 2nd register, accept it: */
-altstep as_IMS_2nd_register(WwwAuthenticate wwwAuthenticate, boolean fail_others := true) runs on IMS_ConnHdlr
+altstep as_IMS_2nd_register(WwwAuthenticate wwwAuthenticate,
+			    IMS_register_early_return early_ret := IMS_REG_EARLY_RET_BEFORE_None,
+			    boolean fail_others := true) runs on IMS_ConnHdlr
 {
 	var template (present) Authorization authorization :=
 		f_tr_Authorization_AKAv1MD5(wwwAuthenticate,
@@ -713,6 +737,10 @@
 		var template (value) Supported supported := ts_Supported({"sec-agree"});
 		var integer sip_seq_nr;
 
+		if (early_ret == IMS_REG_EARLY_RET_BEFORE_Protected_100Trying) {
+			return; /* Done */
+		}
+
 		sip_call_id := g_rx_sip_req.msgHeader.callId.callid;
 		via := g_rx_sip_req.msgHeader.via;
 		from_addr := g_rx_sip_req.msgHeader.fromField;
@@ -737,6 +765,10 @@
 		/* Validate P-Access-Network-Info: */
 		f_ims_validate_register_P_Access_Network_info(g_rx_sip_req, exp_present := true);
 
+		if (early_ret == IMS_REG_EARLY_RET_BEFORE_Protected_200OK) {
+			return; /* Done */
+		}
+
 		g_pars.subscr.p_associated_uri := valueof(ts_P_Associated_Uri({
 				ts_P_Assoc_uri_spec(ts_NameAddr(ts_SipUrl(ts_HostPort(g_pars.realm),
 									  ts_UserInfo(g_pars.subscr.msisdn),