diff --git a/src/smf/gsm-sm.c b/src/smf/gsm-sm.c
index 2fe32f80e..7bfba8698 100644
--- a/src/smf/gsm-sm.c
+++ b/src/smf/gsm-sm.c
@@ -629,6 +629,9 @@ void smf_gsm_state_wait_pfcp_establishment(ogs_fsm_t *s, smf_event_t *e)
     ogs_assert(sess);
 
     switch (e->h.id) {
+    case OGS_FSM_ENTRY_SIG:
+        break;
+
     case SMF_EVT_N4_MESSAGE:
         pfcp_xact = e->pfcp_xact;
         ogs_assert(pfcp_xact);
@@ -717,6 +720,24 @@ void smf_gsm_state_wait_pfcp_establishment(ogs_fsm_t *s, smf_event_t *e)
             ogs_error("cannot handle PFCP message type[%d]",
                     pfcp_message->h.type);
         }
+        break;
+
+    case SMF_EVT_N4_TIMER:
+        switch (e->h.timer_id) {
+        case SMF_TIMER_PFCP_NO_ESTABLISHMENT_RESPONSE:
+            OGS_FSM_TRAN(s, smf_gsm_state_5gc_n1_n2_reject);
+            break;
+        default:
+            ogs_error("Unknown timer[%s:%d]",
+                    ogs_timer_get_name(e->h.timer_id), e->h.timer_id);
+        }
+        break;
+
+    case OGS_FSM_EXIT_SIG:
+        break;
+
+    default:
+        ogs_error("Unknown event [%s]", smf_event_get_name(e));
     }
 }
 
@@ -1191,6 +1212,17 @@ void smf_gsm_state_operational(ogs_fsm_t *s, smf_event_t *e)
         }
         break;
 
+        case SMF_EVT_N4_TIMER:
+            switch (e->h.timer_id) {
+            case SMF_TIMER_PFCP_NO_ESTABLISHMENT_RESPONSE:
+                OGS_FSM_TRAN(s, smf_gsm_state_5gc_n1_n2_reject);
+                break;
+            default:
+                ogs_error("Unknown timer[%s:%d]",
+                        ogs_timer_get_name(e->h.timer_id), e->h.timer_id);
+            }
+            break;
+
     default:
         ogs_error("Unknown event [%s]", smf_event_get_name(e));
     }
diff --git a/src/smf/pfcp-path.c b/src/smf/pfcp-path.c
index e146ce2f6..ff00025b6 100644
--- a/src/smf/pfcp-path.c
+++ b/src/smf/pfcp-path.c
@@ -211,6 +211,8 @@ static void sess_5gc_timeout(ogs_pfcp_xact_t *xact, void *data)
     uint8_t type;
     int trigger;
     char *strerror = NULL;
+    smf_event_t *e = NULL;
+    int rv;
 
     ogs_assert(xact);
     ogs_assert(data);
@@ -225,7 +227,19 @@ static void sess_5gc_timeout(ogs_pfcp_xact_t *xact, void *data)
 
     switch (type) {
     case OGS_PFCP_SESSION_ESTABLISHMENT_REQUEST_TYPE:
-        ogs_error("No PFCP session establishment response");
+        ogs_warn("No PFCP session establishment response");
+
+        e = smf_event_new(SMF_EVT_N4_TIMER);
+        ogs_assert(e);
+        e->sess = sess;
+        e->h.timer_id = SMF_TIMER_PFCP_NO_ESTABLISHMENT_RESPONSE;
+        e->pfcp_node = sess->pfcp_node;
+
+        rv = ogs_queue_push(ogs_app()->queue, e);
+        if (rv != OGS_OK) {
+            ogs_error("ogs_queue_push() failed:%d", (int)rv);
+            ogs_event_free(e);
+        }
         break;
     case OGS_PFCP_SESSION_MODIFICATION_REQUEST_TYPE:
         strerror = ogs_msprintf("[%s:%d] No PFCP session modification response",
diff --git a/src/smf/pfcp-sm.c b/src/smf/pfcp-sm.c
index 5b637dd08..ab4f81100 100644
--- a/src/smf/pfcp-sm.c
+++ b/src/smf/pfcp-sm.c
@@ -73,6 +73,7 @@ void smf_pfcp_state_will_associate(ogs_fsm_t *s, smf_event_t *e)
     ogs_pfcp_message_t *message = NULL;
 
     ogs_sockaddr_t *addr = NULL;
+    smf_sess_t *sess;
 
     ogs_assert(s);
     ogs_assert(e);
@@ -115,6 +116,15 @@ void smf_pfcp_state_will_associate(ogs_fsm_t *s, smf_event_t *e)
 
             ogs_pfcp_cp_send_association_setup_request(node, node_timeout);
             break;
+        case SMF_TIMER_PFCP_NO_ESTABLISHMENT_RESPONSE:
+            sess = e->sess;
+            sess = smf_sess_cycle(sess);
+            if (!sess) {
+                ogs_warn("Session has already been removed");
+                break;
+            }
+            ogs_fsm_dispatch(&sess->sm, e);
+            break;
         default:
             ogs_error("Unknown timer[%s:%d]",
                     smf_timer_get_name(e->h.timer_id), e->h.timer_id);
@@ -373,6 +383,15 @@ void smf_pfcp_state_associated(ogs_fsm_t *s, smf_event_t *e)
             ogs_assert(OGS_OK ==
                 ogs_pfcp_send_heartbeat_request(node, node_timeout));
             break;
+        case SMF_TIMER_PFCP_NO_ESTABLISHMENT_RESPONSE:
+            sess = e->sess;
+            sess = smf_sess_cycle(sess);
+            if (!sess) {
+                ogs_warn("Session has already been removed");
+                break;
+            }
+            ogs_fsm_dispatch(&sess->sm, e);
+            break;
         default:
             ogs_error("Unknown timer[%s:%d]",
                     smf_timer_get_name(e->h.timer_id), e->h.timer_id);
diff --git a/src/smf/timer.c b/src/smf/timer.c
index 9fb991ae5..fa2882d75 100644
--- a/src/smf/timer.c
+++ b/src/smf/timer.c
@@ -40,6 +40,8 @@ const char *smf_timer_get_name(int timer_id)
         return "SMF_TIMER_PFCP_ASSOCIATION";
     case SMF_TIMER_PFCP_NO_HEARTBEAT:
         return "SMF_TIMER_PFCP_NO_HEARTBEAT";
+    case SMF_TIMER_PFCP_NO_ESTABLISHMENT_RESPONSE:
+        return "SMF_TIMER_PFCP_NO_ESTABLISHMENT_RESPONSE";
     default: 
        break;
     }
diff --git a/src/smf/timer.h b/src/smf/timer.h
index 3eae8e3f6..9a30701c7 100644
--- a/src/smf/timer.h
+++ b/src/smf/timer.h
@@ -32,6 +32,7 @@ typedef enum {
 
     SMF_TIMER_PFCP_ASSOCIATION,
     SMF_TIMER_PFCP_NO_HEARTBEAT,
+    SMF_TIMER_PFCP_NO_ESTABLISHMENT_RESPONSE,
 
     MAX_NUM_OF_SMF_TIMER,