diff --git a/srsue/hdr/stack/upper/nas.h b/srsue/hdr/stack/upper/nas.h
index 3951ff3b2..86bc9099a 100644
--- a/srsue/hdr/stack/upper/nas.h
+++ b/srsue/hdr/stack/upper/nas.h
@@ -121,6 +121,9 @@ private:
   nas_sec_ctxt ctxt         = {};
   bool         auth_request = false;
 
+  const uint32_t max_attach_attempts    = 5; // Sec. 5.5.1.2.6
+  uint32_t       attach_attempt_counter = 0;
+
   uint32_t ip_addr       = 0;
   uint8_t  ipv6_if_id[8] = {};
 
@@ -138,7 +141,7 @@ private:
   // Values according to TS 24.301 Sec 10.2
   const uint32_t t3410_duration_ms          = 15 * 1000; // 15s
   const uint32_t t3411_duration_ms          = 10 * 1000; // 10s
-  const uint32_t t3421_duration_ms          = 1 * 1000;  // 15s (here 1s to allow quick reattach)
+  const uint32_t t3421_duration_ms          = 15 * 1000; // 15s
   const uint32_t reattach_timer_duration_ms = 2 * 1000;  // 2s (arbitrarily chosen to delay re-attach)
 
   // TS 23.003 Sec. 6.2.2 IMEISV's last two octets are Software Version Number (SVN)
diff --git a/srsue/src/stack/upper/nas.cc b/srsue/src/stack/upper/nas.cc
index e1d5cda2a..437bb6977 100644
--- a/srsue/src/stack/upper/nas.cc
+++ b/srsue/src/stack/upper/nas.cc
@@ -334,8 +334,19 @@ void nas::run_tti()
 void nas::timer_expired(uint32_t timeout_id)
 {
   if (timeout_id == t3410.id()) {
-    nas_log->info("Timer T3410 expired: starting T3411\n");
-    t3411.run();
+    // Section 5.5.1.2.6 case c)
+    attach_attempt_counter++;
+
+    nas_log->info("Timer T3410 expired: starting T3411 (attempt %d/%d)\n", attach_attempt_counter, max_attach_attempts);
+
+    if (attach_attempt_counter < max_attach_attempts) {
+      // start T3411, ToDo: EMM-DEREGISTERED.ATTEMPTING-TO-ATTACH isn't fully implemented yet
+      t3411.run();
+    } else {
+      // maximum attach attempts reached, cleanup current state and try again
+      enter_emm_deregistered();
+      start_attach_request(nullptr, srslte::establishment_cause_t::mo_sig);
+    }
   } else if (timeout_id == t3411.id()) {
     nas_log->info("Timer T3411 expired: trying to attach again\n");
     start_attach_request(nullptr, srslte::establishment_cause_t::mo_sig);
@@ -467,8 +478,9 @@ void nas::enter_emm_deregistered()
 
   eps_bearer.clear();
 
-  plmn_is_selected = false;
-  state            = EMM_STATE_DEREGISTERED;
+  plmn_is_selected       = false;
+  attach_attempt_counter = 0;
+  state                  = EMM_STATE_DEREGISTERED;
 }
 
 void nas::left_rrc_connected() {}
@@ -513,7 +525,6 @@ bool nas::connection_request_completed(bool outcome)
 
 void nas::select_plmn()
 {
-
   plmn_is_selected = false;
 
   // First find if Home PLMN is available