The subscriber failed authentication (User authentication failed) — almost always a credentials/security-key mismatch between the UE and the network.
In the Cause IE of a GTPv2-C response (Create Session, Modify Bearer, Delete Session…) on S11, S5 or S8.
Got a trace with GTPv2 cause 92 User authentication failed? Drop it in the analyzer: it finds the step that really failed first, which node sent the code and what to ask the other side. Captures, test-system PDFs and vendor exports. 5 free analyses a month, no sign-up.
Analyze a trace free