diff --git a/library/L3_Templates.ttcn b/library/L3_Templates.ttcn
index 0d1c229..396a361 100644
--- a/library/L3_Templates.ttcn
+++ b/library/L3_Templates.ttcn
@@ -1408,6 +1408,26 @@
 	}
 }
 
+template PDU_L3_SGSN_MS tr_GMM_ATTACH_REJECT(template OCT1 cause) := {
+	discriminator := '1000'B,
+	tiOrSkip := {
+		skipIndicator := '0000'B
+	},
+	msgs := {
+		gprs_mm := {
+			attachReject := {
+				messageType := '00000100'B,
+				gmmCause := {
+					causeValue := cause
+				},
+				t3302 := *,
+				t3346 := *
+			}
+		}
+	}
+}
+
+
 template (value) PDU_L3_MS_SGSN ts_GMM_ATTACH_COMPL := {
 	discriminator := '0000'B, /* overwritten */
 	tiOrSkip := {
diff --git a/sgsn/SGSN_Tests.ttcn b/sgsn/SGSN_Tests.ttcn
index a326a83..fd5a664 100644
--- a/sgsn/SGSN_Tests.ttcn
+++ b/sgsn/SGSN_Tests.ttcn
@@ -70,7 +70,6 @@
 	float t_guard
 };
 
-
 private function f_init_gb(inout GbInstance gb) runs on test_CT {
 	gb.vc_NS := NS_CT.create;
 	gb.vc_BSSGP := BSSGP_CT.create;
@@ -296,9 +295,105 @@
 	vc_conn.done;
 }
 
+/* MS never responds to ID REQ, expect ATTACH REJECT */
+private function f_TC_attach_auth_id_timeout(charstring id) runs on BSSGP_ConnHdlr {
+	var MobileIdentityLV mi;
+	var RoutingAreaIdentificationV old_ra := f_random_RAI();
+
+	if (ispresent(g_pars.p_tmsi)) {
+		mi := valueof(ts_MI_TMSI_LV(g_pars.p_tmsi));
+	} else {
+		mi := valueof(ts_MI_IMSI_LV(g_pars.imsi));
+	}
+
+	BSSGP.send(ts_GMM_ATTACH_REQ(mi, old_ra, false, false, omit, omit));
+	alt {
+	[] BSSGP.receive(tr_BD_L3(tr_GMM_ID_REQ(?))) {
+		/* don't send ID Response */
+		repeat;
+		}
+	[] BSSGP.receive(tr_BD_L3(tr_GMM_ATTACH_REJECT('09'O))) {
+		setverdict(pass);
+		}
+	[] BSSGP.receive(tr_BD_L3(tr_GMM_ATTACH_REJECT(?))) {
+		setverdict(fail, "Wrong Attach Reject Cause");
+		}
+	}
+}
+testcase TC_attach_auth_id_timeout() runs on test_CT {
+	var BSSGP_ConnHdlr vc_conn;
+	f_init();
+	vc_conn := f_start_handler(refers(f_TC_attach_auth_id_timeout), testcasename(), g_gb[0], 2, 40.0);
+	vc_conn.done;
+}
+
+/* HLR never responds to SAI REQ, expect ATTACH REJECT */
+private function f_TC_attach_auth_sai_timeout(charstring id) runs on BSSGP_ConnHdlr {
+	var MobileIdentityLV mi;
+	var RoutingAreaIdentificationV old_ra := f_random_RAI();
+
+	if (ispresent(g_pars.p_tmsi)) {
+		mi := valueof(ts_MI_TMSI_LV(g_pars.p_tmsi));
+	} else {
+		mi := valueof(ts_MI_IMSI_LV(g_pars.imsi));
+	}
+
+	BSSGP.send(ts_GMM_ATTACH_REQ(mi, old_ra, false, false, omit, omit));
+	alt {
+	[] as_mm_identity();
+	[] GSUP.receive(tr_GSUP_SAI_REQ(g_pars.imsi)); { }
+	}
+	/* don't send SAI-response from HLR */
+	BSSGP.receive(tr_BD_L3(tr_GMM_ATTACH_REJECT(?)));
+	setverdict(pass);
+}
+testcase TC_attach_auth_sai_timeout() runs on test_CT {
+	var BSSGP_ConnHdlr vc_conn;
+	f_init();
+	vc_conn := f_start_handler(refers(f_TC_attach_auth_sai_timeout), testcasename(), g_gb[0], 3);
+	vc_conn.done;
+}
+
+/* HLR never responds to UL REQ, expect ATTACH REJECT */
+private function f_TC_attach_gsup_lu_timeout(charstring id) runs on BSSGP_ConnHdlr {
+	var MobileIdentityLV mi;
+	var RoutingAreaIdentificationV old_ra := f_random_RAI();
+
+	if (ispresent(g_pars.p_tmsi)) {
+		mi := valueof(ts_MI_TMSI_LV(g_pars.p_tmsi));
+	} else {
+		mi := valueof(ts_MI_IMSI_LV(g_pars.imsi));
+	}
+
+	BSSGP.send(ts_GMM_ATTACH_REQ(mi, old_ra, false, false, omit, omit));
+	f_gmm_auth();
+	/* Expect MSC to perform LU with HLR */
+	GSUP.receive(tr_GSUP_UL_REQ(g_pars.imsi));
+	/* Never follow-up with ISD_REQ or UL_RES */
+	alt {
+	[] BSSGP.receive(tr_BD_L3(tr_GMM_ATTACH_REJECT(?))) {
+		setverdict(pass);
+		}
+	[] BSSGP.receive(tr_BD_L3(tr_GMM_ATTACH_ACCEPT(?, ?, ?))) {
+		setverdict(fail);
+		}
+	}
+}
+testcase TC_attach_gsup_lu_timeout() runs on test_CT {
+	var BSSGP_ConnHdlr vc_conn;
+	f_init();
+	f_sleep(1.0);
+	vc_conn := f_start_handler(refers(f_TC_attach_gsup_lu_timeout), testcasename(), g_gb[0], 4);
+	vc_conn.done;
+}
+
+
 
 control {
-	execute( TC_wait_ns_up() );
+	execute( TC_attach() );
+	execute( TC_attach_auth_id_timeout() );
+	execute( TC_attach_auth_sai_timeout() );
+	execute( TC_attach_gsup_lu_timeout() );
 }