diff --git a/mme/LTE_CryptoFunctions.ttcn b/mme/LTE_CryptoFunctions.ttcn
index 9923541..340b784 100644
--- a/mme/LTE_CryptoFunctions.ttcn
+++ b/mme/LTE_CryptoFunctions.ttcn
@@ -143,6 +143,12 @@
 	var octetstring data_with_seq := int2oct(secp_nas.sequenceNumber, 1) & secp_nas.nAS_Message;
 	var OCT4 exp_mac := f_nas_mac_calc(nus.alg_int, nus.k_nas_int, nus.rx_count, 0,
 					   f_rx_is_downlink(nus), data_with_seq);
+
+	if (nus.rx_count != secp_nas.sequenceNumber) {
+		setverdict(fail, "Received NAS SeqNr ", secp_nas.sequenceNumber,
+			   " doesn't match expected SeqNr ", nus.rx_count, ": ", secp_nas, " | nus: ", nus);
+		return false;
+	}
 	if (exp_mac != secp_nas.messageAuthenticationCode) {
 		setverdict(fail, "Received NAS MAC ", secp_nas.messageAuthenticationCode,
 			   " doesn't match expected MAC ", exp_mac, ": ", secp_nas, " | nus: ", nus);
@@ -173,12 +179,14 @@
 		return dec_PDU_NAS_EPS(secp_nas.nAS_Message);
 		}
 	case ('0001'B) { /* IP only */
+		nus.rx_count := nus.rx_count + 1;
 		if (not f_nas_check_ip(nus, secp_nas)) {
 			Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, "f_nas_check_ip() failed");
 		}
 		return dec_PDU_NAS_EPS(secp_nas.nAS_Message);
 		}
 	case ('0010'B) { /* IP + ciphered */
+		nus.rx_count := nus.rx_count + 1;
 		if (not f_nas_check_ip(nus, secp_nas)) {
 			Misc_Helpers.f_shutdown(__BFILE__, __LINE__, fail, "f_nas_check_ip() failed");
 		}