diff --git a/src/mme/emm_build.c b/src/mme/emm_build.c
index 361575653d..19a27c485c 100644
--- a/src/mme/emm_build.c
+++ b/src/mme/emm_build.c
@@ -11,6 +11,7 @@
 status_t emm_build_attach_accept(
         pkbuf_t **emmbuf, mme_ue_t *mme_ue, pkbuf_t *esmbuf)
 {
+    status_t rv;
     nas_message_t message;
     nas_attach_accept_t *attach_accept = &message.emm.attach_accept;
     nas_eps_attach_result_t *eps_attach_result = 
@@ -71,8 +72,8 @@ status_t emm_build_attach_accept(
     eps_network_feature_support->epc_lcs = 1;
     eps_network_feature_support->ims_vops = 1;
 
-    d_assert(nas_security_encode(emmbuf, mme_ue, &message) == CORE_OK && 
-            *emmbuf,,);
+    rv = nas_security_encode(emmbuf, mme_ue, &message);
+    d_assert(rv == CORE_OK && *emmbuf,, "nas_security_encode error");
     pkbuf_free(esmbuf);
 
     return CORE_OK;
@@ -81,6 +82,7 @@ status_t emm_build_attach_accept(
 status_t emm_build_attach_reject(
         pkbuf_t **emmbuf, nas_emm_cause_t emm_cause, pkbuf_t *esmbuf)
 {
+    status_t rv;
     nas_message_t message;
     nas_attach_reject_t *attach_reject = &message.emm.attach_reject;
 
@@ -98,19 +100,21 @@ status_t emm_build_attach_reject(
         attach_reject->esm_message_container.length = esmbuf->len;
     }
 
-    d_assert(nas_plain_encode(emmbuf, &message) == CORE_OK && *emmbuf,,);
+    rv = nas_plain_encode(emmbuf, &message);
+    d_assert(rv == CORE_OK && *emmbuf,, "nas_plain_encode error");
 
     if (esmbuf)
     {
         pkbuf_free(esmbuf);
     }
 
-    return CORE_OK;
+    return rv;
 }
 
 status_t emm_build_identity_request(
         pkbuf_t **emmbuf, mme_ue_t *mme_ue)
 {
+    status_t rv;
     nas_message_t message;
     nas_identity_request_t *identity_request = 
         &message.emm.identity_request;
@@ -124,9 +128,53 @@ status_t emm_build_identity_request(
     /* Request IMSI */
     identity_request->identity_type.type = NAS_IDENTITY_TYPE_2_IMSI;
 
-    d_assert(nas_plain_encode(emmbuf, &message) == CORE_OK && *emmbuf,,);
+    rv = nas_plain_encode(emmbuf, &message);
+    d_assert(rv == CORE_OK && *emmbuf,, "nas_plain_encode error");
 
-    return CORE_OK;
+    return rv;
+}
+
+status_t emm_build_authentication_request(
+        pkbuf_t **emmbuf, e_utran_vector_t *e_utran_vector)
+{
+    status_t rv;
+    nas_message_t message;
+    nas_authentication_request_t *authentication_request = 
+        &message.emm.authentication_request;
+
+    d_assert(e_utran_vector, return CORE_ERROR, "Null param");
+
+    memset(&message, 0, sizeof(message));
+    message.emm.h.protocol_discriminator = NAS_PROTOCOL_DISCRIMINATOR_EMM;
+    message.emm.h.message_type = NAS_AUTHENTICATION_REQUEST;
+
+    memcpy(authentication_request->authentication_parameter_rand.rand,
+            e_utran_vector->rand, RAND_LEN);
+    memcpy(authentication_request->authentication_parameter_autn.autn,
+            e_utran_vector->autn, AUTN_LEN);
+    authentication_request->authentication_parameter_autn.length = 
+            AUTN_LEN;
+
+    rv = nas_plain_encode(emmbuf, &message);
+    d_assert(rv == CORE_OK && *emmbuf, , "nas encode error");
+
+    return rv;
+}
+
+status_t emm_build_authentication_reject(pkbuf_t **emmbuf)
+{
+    status_t rv;
+    nas_message_t message;
+
+    memset(&message, 0, sizeof(message));
+
+    message.emm.h.protocol_discriminator = NAS_PROTOCOL_DISCRIMINATOR_EMM;
+    message.emm.h.message_type = NAS_AUTHENTICATION_REJECT;
+
+    rv = nas_plain_encode(emmbuf, &message);
+    d_assert(rv == CORE_OK && *emmbuf,, "nas_plain_encode error");
+
+    return rv;
 }
 
 status_t emm_build_security_mode_command(
diff --git a/src/mme/emm_build.h b/src/mme/emm_build.h
index fc84d11ee0..dfcc1b0698 100644
--- a/src/mme/emm_build.h
+++ b/src/mme/emm_build.h
@@ -17,6 +17,10 @@ CORE_DECLARE(status_t) emm_build_identity_request(
 CORE_DECLARE(status_t) emm_build_security_mode_command(
         pkbuf_t **emmbuf, mme_ue_t *mme_ue);
 
+CORE_DECLARE(status_t) emm_build_authentication_request(
+        pkbuf_t **emmbuf, e_utran_vector_t *e_utran_vector);
+CORE_DECLARE(status_t) emm_build_authentication_reject(pkbuf_t **emmbuf);
+
 CORE_DECLARE(status_t) emm_build_detach_accept(
         pkbuf_t **emmbuf, mme_ue_t *mme_ue);
 
diff --git a/src/mme/emm_handler.c b/src/mme/emm_handler.c
index fc06542b97..90a075783d 100644
--- a/src/mme/emm_handler.c
+++ b/src/mme/emm_handler.c
@@ -319,12 +319,18 @@ void emm_handle_authentication_response(mme_ue_t *mme_ue,
         memcmp(authentication_response_parameter->res,
             mme_ue->xres, mme_ue->xres_len) != 0)
     {
-        d_error("authentication failed");
-        return;
-    }
+        status_t rv;
 
-    d_trace(3, "[NAS] Authentication response : UE[%s] --> EMM\n", 
-            mme_ue->imsi_bcd);
+        d_error("authentication failed");
+
+        rv = nas_send_authentication_reject(mme_ue);
+        d_assert(rv == CORE_OK,, "nas send error");
+        FSM_TRAN(&mme_ue->sm, &emm_state_detached);
+    }
+    else
+    {
+        FSM_TRAN(&mme_ue->sm, &emm_state_security_mode);
+    }
 }
 
 void emm_handle_detach_request(
diff --git a/src/mme/emm_sm.c b/src/mme/emm_sm.c
index b8a0c62300..36da329dbb 100644
--- a/src/mme/emm_sm.c
+++ b/src/mme/emm_sm.c
@@ -204,7 +204,6 @@ void emm_state_authentication(fsm_t *s, event_t *e)
                 {
                     emm_handle_authentication_response(
                             mme_ue, &message->emm.authentication_response);
-                    FSM_TRAN(s, &emm_state_security_mode);
                     break;
                 }
                 case NAS_EMM_STATUS:
@@ -487,22 +486,8 @@ void emm_state_attached(fsm_t *s, event_t *e)
 
 void emm_state_exception(fsm_t *s, event_t *e)
 {
-    mme_ue_t *mme_ue = NULL;
-    mme_sess_t *sess = NULL;
-    mme_bearer_t *bearer = NULL;
-
-    d_assert(s, return, "Null param");
-    d_assert(e, return, "Null param");
-
     mme_sm_trace(3, e);
 
-    bearer = mme_bearer_find(event_get_param1(e));
-    d_assert(bearer, return, "Null param");
-    sess = bearer->sess;
-    d_assert(sess, return, "Null param");
-    mme_ue = sess->mme_ue;
-    d_assert(mme_ue, return, "Null param");
-
     switch (event_get(e))
     {
         case FSM_ENTRY_SIG:
diff --git a/src/mme/esm_sm.c b/src/mme/esm_sm.c
index 1d6f2d371b..e0a0974976 100644
--- a/src/mme/esm_sm.c
+++ b/src/mme/esm_sm.c
@@ -323,6 +323,8 @@ void esm_state_disconnect(fsm_t *s, event_t *e)
 
 void esm_state_session_exception(fsm_t *s, event_t *e)
 {
+    mme_sm_trace(3, e);
+
     switch (event_get(e))
     {
         case FSM_ENTRY_SIG:
@@ -343,6 +345,8 @@ void esm_state_session_exception(fsm_t *s, event_t *e)
 
 void esm_state_bearer_exception(fsm_t *s, event_t *e)
 {
+    mme_sm_trace(3, e);
+
     switch (event_get(e))
     {
         case FSM_ENTRY_SIG:
diff --git a/src/mme/mme_s6a_handler.c b/src/mme/mme_s6a_handler.c
index b9115e4fbc..037b5f5d39 100644
--- a/src/mme/mme_s6a_handler.c
+++ b/src/mme/mme_s6a_handler.c
@@ -9,11 +9,7 @@
 
 void mme_s6a_handle_aia(mme_ue_t *mme_ue, s6a_aia_message_t *aia_message)
 {
-    pkbuf_t *emmbuf = NULL;
-
-    nas_message_t message;
-    nas_authentication_request_t *authentication_request = 
-        &message.emm.authentication_request;
+    status_t rv;
     e_utran_vector_t *e_utran_vector = NULL;
 
     d_assert(mme_ue, return, "Null param");
@@ -25,22 +21,8 @@ void mme_s6a_handle_aia(mme_ue_t *mme_ue, s6a_aia_message_t *aia_message)
     memcpy(mme_ue->xres, e_utran_vector->xres, mme_ue->xres_len);
     memcpy(mme_ue->kasme, e_utran_vector->kasme, SHA256_DIGEST_SIZE);
 
-    d_trace(3, "[NAS] Authentication request : UE[%s] <-- EMM\n",
-             mme_ue->imsi_bcd);
-
-    memset(&message, 0, sizeof(message));
-    message.emm.h.protocol_discriminator = NAS_PROTOCOL_DISCRIMINATOR_EMM;
-    message.emm.h.message_type = NAS_AUTHENTICATION_REQUEST;
-
-    memcpy(authentication_request->authentication_parameter_rand.rand,
-            e_utran_vector->rand, RAND_LEN);
-    memcpy(authentication_request->authentication_parameter_autn.autn,
-            e_utran_vector->autn, AUTN_LEN);
-    authentication_request->authentication_parameter_autn.length = 
-            AUTN_LEN;
-
-    d_assert(nas_plain_encode(&emmbuf, &message) == CORE_OK && emmbuf,,);
-    d_assert(nas_send_to_downlink_nas_transport(mme_ue, emmbuf) == CORE_OK,,);
+    rv = nas_send_authentication_request(mme_ue, e_utran_vector);
+    d_assert(rv == CORE_OK,, "nas send failed");
 }
 
 void mme_s6a_handle_ula(mme_ue_t *mme_ue, s6a_ula_message_t *ula_message)
diff --git a/src/mme/nas_path.c b/src/mme/nas_path.c
index 252cbc40ec..d93010dcaa 100644
--- a/src/mme/nas_path.c
+++ b/src/mme/nas_path.c
@@ -123,15 +123,55 @@ status_t nas_send_attach_reject(mme_ue_t *mme_ue,
     }
 
     rv = emm_build_attach_reject(&emmbuf, emm_cause, esmbuf);
-    d_assert(rv == CORE_OK && emmbuf, 
-            pkbuf_free(esmbuf); return CORE_ERROR, "emm build error");
-    d_assert(nas_send_to_downlink_nas_transport(mme_ue, emmbuf) == CORE_OK,,);
+    d_assert(rv == CORE_OK && emmbuf,
+            esmbuf ? pkbuf_free(esmbuf) : 1; return CORE_ERROR,
+            "emm build error");
+    rv = nas_send_to_downlink_nas_transport(mme_ue, emmbuf);
+    d_assert(rv == CORE_OK,
+            esmbuf ? pkbuf_free(esmbuf) : 1; return CORE_ERROR,
+            "nas send error");
 
     /* FIXME : delay is needed */
     cause.present = S1ap_Cause_PR_nas;
     cause.choice.nas = s1ap_cause_nas;;
     rv = s1ap_send_ue_context_release_commmand(enb_ue, &cause);
-    d_assert(rv == CORE_OK, return CORE_ERROR, "s1ap send error");
+    d_assert(rv == CORE_OK,, "s1ap send error");
+
+    return rv;
+}
+
+status_t nas_send_authentication_request(
+        mme_ue_t *mme_ue, e_utran_vector_t *e_utran_vector)
+{
+    status_t rv;
+    pkbuf_t *emmbuf = NULL;
+
+    d_assert(mme_ue, return CORE_ERROR, "Null param");
+    d_assert(e_utran_vector, return CORE_ERROR, "Null param");
+
+    rv = emm_build_authentication_request(&emmbuf, e_utran_vector);
+    d_assert(rv == CORE_OK && emmbuf, return CORE_ERROR,
+            "nas_build_detach_accept failed"); 
+
+    rv = nas_send_to_downlink_nas_transport(mme_ue, emmbuf);
+    d_assert(rv == CORE_OK,, "nas send failed");
+
+    return rv;
+}
+
+status_t nas_send_authentication_reject(mme_ue_t *mme_ue)
+{
+    status_t rv;
+    pkbuf_t *emmbuf = NULL;
+
+    d_assert(mme_ue, return CORE_ERROR, "Null param");
+
+    rv = emm_build_authentication_reject(&emmbuf);
+    d_assert(rv == CORE_OK && emmbuf, return CORE_ERROR,
+            "nas_build_detach_accept failed"); 
+
+    rv = nas_send_to_downlink_nas_transport(mme_ue, emmbuf);
+    d_assert(rv == CORE_OK,, "nas send failed");
 
     return CORE_OK;
 }
diff --git a/src/mme/nas_path.h b/src/mme/nas_path.h
index 6ebdc846cc..204d3d14a3 100644
--- a/src/mme/nas_path.h
+++ b/src/mme/nas_path.h
@@ -19,6 +19,11 @@ CORE_DECLARE(status_t) nas_send_attach_accept(mme_ue_t *mme_ue);
 CORE_DECLARE(status_t) nas_send_attach_reject(mme_ue_t *mme_ue,
     e_S1ap_CauseNas s1ap_cause_nas, nas_emm_cause_t emm_cause,
     nas_esm_cause_t esm_cause);
+
+CORE_DECLARE(status_t) nas_send_authentication_request(
+        mme_ue_t *mme_ue, e_utran_vector_t *e_utran_vector);
+CORE_DECLARE(status_t) nas_send_authentication_reject(mme_ue_t *mme_ue);
+
 CORE_DECLARE(status_t) nas_send_detach_accept(mme_ue_t *mme_ue);
 
 CORE_DECLARE(status_t) nas_send_pdn_connectivity_reject(
diff --git a/test/Makefile.am b/test/Makefile.am
index 7eb35d1287..e89aa12b25 100644
--- a/test/Makefile.am
+++ b/test/Makefile.am
@@ -6,7 +6,7 @@ testepc_SOURCES = \
 	abts.h abts_tests.h testutil.h \
 	abts.c testutil.c testpacket.h testpacket.c \
 	base_test.c s1ap_message_test.c nas_message_test.c gtp_message_test.c \
-	security_test.c s1setup_test.c attach_test.c volte_test.c
+	security_test.c s1setup_test.c attach_test.c volte_test.c handover_test.c
 
 testepc_LDADD = \
     $(top_srcdir)/src/libepc.la
diff --git a/test/abts_tests.h b/test/abts_tests.h
index ab8a2e3715..59f8e5d678 100644
--- a/test/abts_tests.h
+++ b/test/abts_tests.h
@@ -31,6 +31,7 @@ const struct testlist {
     {test_s1setup},
     {test_attach},
     {test_volte},
+    {test_handover}
 };
 
 #endif /* APR_TEST_INCLUDES */
diff --git a/test/attach_test.c b/test/attach_test.c
index a15bb09d5d..6e56bea514 100644
--- a/test/attach_test.c
+++ b/test/attach_test.c
@@ -139,7 +139,8 @@ static void attach_test1(abts_case *tc, void *data)
     ABTS_PTR_NOTNULL(tc, sock);
 
     /* Send S1-Setup Reqeust */
-    rv = tests1ap_build_setup_req(&sendbuf, 0x54f64);
+    rv = tests1ap_build_setup_req(
+            &sendbuf, S1ap_ENB_ID_PR_macroENB_ID, 0x54f64);
     ABTS_INT_EQUAL(tc, CORE_OK, rv);
     rv = tests1ap_enb_send(sock, sendbuf);
     ABTS_INT_EQUAL(tc, CORE_OK, rv);
@@ -463,7 +464,8 @@ static void attach_test2(abts_case *tc, void *data)
     ABTS_PTR_NOTNULL(tc, sock);
 
     /* Send S1-Setup Reqeust */
-    rv = tests1ap_build_setup_req(&sendbuf, 0x002343d);
+    rv = tests1ap_build_setup_req(
+            &sendbuf, S1ap_ENB_ID_PR_macroENB_ID, 0x002343d);
     ABTS_INT_EQUAL(tc, CORE_OK, rv);
     rv = tests1ap_enb_send(sock, sendbuf);
     ABTS_INT_EQUAL(tc, CORE_OK, rv);
@@ -726,7 +728,8 @@ static void attach_test3(abts_case *tc, void *data)
     ABTS_PTR_NOTNULL(tc, sock);
 
     /* Send S1-Setup Reqeust */
-    rv = tests1ap_build_setup_req(&sendbuf, 0x54f64);
+    rv = tests1ap_build_setup_req(
+            &sendbuf, S1ap_ENB_ID_PR_macroENB_ID, 0x54f64);
     ABTS_INT_EQUAL(tc, CORE_OK, rv);
     rv = tests1ap_enb_send(sock, sendbuf);
     ABTS_INT_EQUAL(tc, CORE_OK, rv);
diff --git a/test/handover_test.c b/test/handover_test.c
new file mode 100644
index 0000000000..f669af9cf4
--- /dev/null
+++ b/test/handover_test.c
@@ -0,0 +1,276 @@
+
+#include "core_debug.h"
+#include "core_pkbuf.h"
+#include "core_lib.h"
+#include <mongoc.h>
+
+#include "context.h"
+#include "mme_context.h"
+#include "s1ap_message.h"
+
+#include "testutil.h"
+#include "testpacket.h"
+
+static void handover_test1(abts_case *tc, void *data)
+{
+    status_t rv;
+    net_sock_t *sock1, *sock2;
+    pkbuf_t *sendbuf;
+    pkbuf_t *recvbuf;
+    s1ap_message_t message;
+    int rc;
+    int i;
+    int msgindex = 9;
+
+    mongoc_collection_t *collection = NULL;
+    bson_t *doc = NULL;
+    c_int64_t count = 0;
+    bson_error_t error;
+    const char *json =
+    "{"
+      "\"_id\" : { \"$oid\" : \"599eb929c850caabcbfdcd2b\" }," 
+      "\"imsi\" : \"001010123456801\","
+      "\"pdn\" : ["
+      "{ \"apn\" : \"internet.ng2.mnet\","
+        "\"_id\" : { \"$oid\" : \"599eb929c850caabcbfdcd32\" },"
+        "\"qos\" : {"
+          "\"qci\" : 9,"
+          "\"arp\" : {"
+            "\"priority_level\" : 8,"
+            "\"pre_emption_vulnerability\" : 1,"
+            "\"pre_emption_capability\" : 1 } },"
+        "\"type\" : 0 },"
+      "{ \"apn\" : \"internet\","
+        "\"_id\" : { \"$oid\" : \"599eb929c850caabcbfdcd2c\" },"
+        "\"pcc_rule\" : ["
+        "{ \"_id\" : { \"$oid\" : \"599eb929c850caabcbfdcd2d\" },"
+          "\"qos\" : {"
+            "\"qci\" : 1,"
+            "\"gbr\" : {"
+              "\"downlink\" : { \"$numberLong\" : \"64\" },"
+              "\"uplink\" : { \"$numberLong\" : \"44\" } },"
+            "\"mbr\" : {"
+              "\"downlink\" : { \"$numberLong\" : \"64\" },"
+              "\"uplink\" : { \"$numberLong\" : \"44\" } },"
+            "\"arp\" : {"
+              "\"priority_level\" : 3,"
+              "\"pre_emption_vulnerability\" : 0,"
+              "\"pre_emption_capability\" : 0 } },"
+          "\"flow\" : ["
+          "{ \"direction\" : 2,"
+            "\"description\" : \"permit out udp from any 1-65535 to 10.200.136.98/32 23454\","
+            "\"_id\" : { \"$oid\" : \"599eb929c850caabcbfdcd31\" } },"
+          "{ \"direction\" : 1,"
+            "\"description\" : \"permit out udp from any 50020 to 10.200.136.98/32 1-65535\","
+            "\"_id\" : { \"$oid\" : \"599eb929c850caabcbfdcd30\" } },"
+          "{ \"direction\" : 2,"
+            "\"description\" : \"permit out udp from any 1-65535 to 10.200.136.98/32 23455\","
+            "\"_id\" : { \"$oid\" : \"599eb929c850caabcbfdcd2f\" } },"
+          "{ \"direction\" : 1,"
+            "\"description\" : \"permit out udp from any 50021 to 10.200.136.98/32 1-65535\","
+            "\"_id\" : { \"$oid\" : \"599eb929c850caabcbfdcd2e\" } } ]"
+        "} ],"
+        "\"ambr\" : {"
+          "\"downlink\" : { \"$numberLong\" : \"35840\" },"
+          "\"uplink\" : { \"$numberLong\" : \"15360\" } },"
+        "\"qos\" : {"
+          "\"qci\" : 6,"
+          "\"arp\" : {"
+            "\"priority_level\" : 6,"
+            "\"pre_emption_vulnerability\" : 1,"
+            "\"pre_emption_capability\" : 1 } },"
+        "\"type\" : 0 }"
+      "],"
+      "\"ambr\" : {"
+        "\"downlink\" : { \"$numberLong\" : \"1024000\" },"
+        "\"uplink\" : { \"$numberLong\" : \"1024000\" } },"
+      "\"subscribed_rau_tau_timer\" : 12,"
+      "\"network_access_mode\" : 2,"
+      "\"subscriber_status\" : 0,"
+      "\"access_restriction_data\" : 32,"
+      "\"security\" : {"
+          "\"k\" : \"465B5CE8 B199B49F AA5F0A2E E238A6BC\","
+          "\"op\" : \"5F1D289C 5D354D0A 140C2548 F5F3E3BA\","
+          "\"amf\" : \"8000\","
+          "\"sqn\" : { \"$numberLong\" : \"32\" }, "
+          "\"rand\" : \"0a303a1e 63603f61 404c1241 30320f39\" }, "
+      "\"__v\" : 0"
+    "}";
+
+    /* Two eNB connects to MME */
+    sock1 = tests1ap_enb_connect();
+    ABTS_PTR_NOTNULL(tc, sock1);
+
+    sock2 = tests1ap_enb_connect();
+    ABTS_PTR_NOTNULL(tc, sock2);
+
+    /* S1-Setup Reqeust/Response for Source eNB */
+    rv = tests1ap_build_setup_req(
+            &sendbuf, S1ap_ENB_ID_PR_macroENB_ID, 0x54f64);
+    ABTS_INT_EQUAL(tc, CORE_OK, rv);
+    rv = tests1ap_enb_send(sock1, sendbuf);
+    ABTS_INT_EQUAL(tc, CORE_OK, rv);
+
+    recvbuf = pkbuf_alloc(0, MAX_SDU_LEN);
+    rc = tests1ap_enb_read(sock1, recvbuf);
+    ABTS_INT_NEQUAL(tc, 0, rc);
+    pkbuf_free(recvbuf);
+
+    /* S1-Setup Reqeust/Response for Target eNB */
+    rv = tests1ap_build_setup_req(
+            &sendbuf, S1ap_ENB_ID_PR_macroENB_ID, 0x54f65);
+    ABTS_INT_EQUAL(tc, CORE_OK, rv);
+    rv = tests1ap_enb_send(sock2, sendbuf);
+    ABTS_INT_EQUAL(tc, CORE_OK, rv);
+
+    recvbuf = pkbuf_alloc(0, MAX_SDU_LEN);
+    rc = tests1ap_enb_read(sock2, recvbuf);
+    ABTS_INT_NEQUAL(tc, 0, rc);
+    pkbuf_free(recvbuf);
+
+    collection = mongoc_client_get_collection(
+        context_self()->db_client,
+        context_self()->db_name, "subscribers");
+    ABTS_PTR_NOTNULL(tc, collection);
+
+    doc = bson_new_from_json((const uint8_t *)json, -1, &error);;
+    ABTS_PTR_NOTNULL(tc, doc);
+    ABTS_TRUE(tc, mongoc_collection_insert(collection, 
+                MONGOC_INSERT_NONE, doc, NULL, &error));
+    bson_destroy(doc);
+
+    doc = BCON_NEW("imsi", BCON_UTF8("001010123456801"));
+    ABTS_PTR_NOTNULL(tc, doc);
+    do
+    {
+        count = mongoc_collection_count (
+            collection, MONGOC_QUERY_NONE, doc, 0, 0, NULL, &error);
+    } while (count == 0);
+    bson_destroy(doc);
+
+    /***********************************************************************
+     * Attach Request : Known IMSI, Integrity Protected, No Security Context
+     * Send Initial-UE Message + Attach Request + PDN Connectivity        */
+    rv = tests1ap_build_initial_ue_msg(&sendbuf, msgindex);
+    ABTS_INT_EQUAL(tc, CORE_OK, rv);
+    rv = tests1ap_enb_send(sock1, sendbuf);
+    ABTS_INT_EQUAL(tc, CORE_OK, rv);
+
+    /* Receive Authentication Request */
+    recvbuf = pkbuf_alloc(0, MAX_SDU_LEN);
+    rc = tests1ap_enb_read(sock1, recvbuf);
+    ABTS_INT_NEQUAL(tc, 0, rc);
+    pkbuf_free(recvbuf);
+
+    /* Send Authentication Response */
+    rv = tests1ap_build_authentication_response(&sendbuf, msgindex);
+    ABTS_INT_EQUAL(tc, CORE_OK, rv);
+    rv = tests1ap_enb_send(sock1, sendbuf);
+    ABTS_INT_EQUAL(tc, CORE_OK, rv);
+
+    /* Receive Security mode Command */
+    recvbuf = pkbuf_alloc(0, MAX_SDU_LEN);
+    rc = tests1ap_enb_read(sock1, recvbuf);
+    ABTS_INT_NEQUAL(tc, 0, rc);
+    pkbuf_free(recvbuf);
+
+    /* Send Security mode Complete */
+    rv = tests1ap_build_security_mode_complete(&sendbuf, msgindex);
+    ABTS_INT_EQUAL(tc, CORE_OK, rv);
+    rv = tests1ap_enb_send(sock1, sendbuf);
+    ABTS_INT_EQUAL(tc, CORE_OK, rv);
+
+    /* Receive ESM Information Request */
+    recvbuf = pkbuf_alloc(0, MAX_SDU_LEN);
+    rc = tests1ap_enb_read(sock1, recvbuf);
+    ABTS_INT_NEQUAL(tc, 0, rc);
+    pkbuf_free(recvbuf);
+
+    /* Send ESM Information Response */
+    rv = tests1ap_build_esm_information_response(&sendbuf, msgindex);
+    ABTS_INT_EQUAL(tc, CORE_OK, rv);
+    rv = tests1ap_enb_send(sock1, sendbuf);
+    ABTS_INT_EQUAL(tc, CORE_OK, rv);
+
+    /* Receive Initial Context Setup Request + 
+     * Attach Accept + 
+     * Activate Default Bearer Context Request */
+    recvbuf = pkbuf_alloc(0, MAX_SDU_LEN);
+    rc = tests1ap_enb_read(sock1, recvbuf);
+    ABTS_INT_NEQUAL(tc, 0, rc);
+    pkbuf_free(recvbuf);
+
+    /* Send UE Capability Info Indication */
+    rv = tests1ap_build_ue_capability_info_indication(&sendbuf, msgindex);
+    ABTS_INT_EQUAL(tc, CORE_OK, rv);
+    rv = tests1ap_enb_send(sock1, sendbuf);
+    ABTS_INT_EQUAL(tc, CORE_OK, rv);
+
+    core_sleep(time_from_msec(300));
+
+    /* Send Initial Context Setup Response */
+    rv = tests1ap_build_initial_context_setup_response(&sendbuf, msgindex);
+    ABTS_INT_EQUAL(tc, CORE_OK, rv);
+    rv = tests1ap_enb_send(sock1, sendbuf);
+    ABTS_INT_EQUAL(tc, CORE_OK, rv);
+
+    /* Send Attach Complete + Activate default EPS bearer cotext accept */
+    rv = tests1ap_build_attach_complete(&sendbuf, msgindex);
+    ABTS_INT_EQUAL(tc, CORE_OK, rv);
+    rv = tests1ap_enb_send(sock1, sendbuf);
+    ABTS_INT_EQUAL(tc, CORE_OK, rv);
+
+    /* Receive EMM information */
+    recvbuf = pkbuf_alloc(0, MAX_SDU_LEN);
+    rc = tests1ap_enb_read(sock1, recvbuf);
+    ABTS_INT_NEQUAL(tc, 0, rc);
+    pkbuf_free(recvbuf);
+
+    /* Receive E-RAB Setup Request + 
+     * Activate dedicated EPS bearer context request */
+    recvbuf = pkbuf_alloc(0, MAX_SDU_LEN);
+    rc = tests1ap_enb_read(sock1, recvbuf);
+    ABTS_INT_NEQUAL(tc, 0, rc);
+    pkbuf_free(recvbuf);
+
+    /* Send E-RAB Setup Response */
+    rv = tests1ap_build_e_rab_setup_response(&sendbuf, msgindex);
+    ABTS_INT_EQUAL(tc, CORE_OK, rv);
+    rv = tests1ap_enb_send(sock1, sendbuf);
+    ABTS_INT_EQUAL(tc, CORE_OK, rv);
+
+    core_sleep(time_from_msec(300));
+
+    /* Send Activate dedicated EPS bearer context accept */
+    rv = tests1ap_build_activate_dedicated_bearer_accept(&sendbuf, msgindex);
+    ABTS_INT_EQUAL(tc, CORE_OK, rv);
+    rv = tests1ap_enb_send(sock1, sendbuf);
+    ABTS_INT_EQUAL(tc, CORE_OK, rv);
+
+    /********** Remove Subscriber in Database */
+    doc = BCON_NEW("imsi", BCON_UTF8("001010123456801"));
+    ABTS_PTR_NOTNULL(tc, doc);
+    ABTS_TRUE(tc, mongoc_collection_remove(collection, 
+            MONGOC_REMOVE_SINGLE_REMOVE, doc, NULL, &error)) 
+    bson_destroy(doc);
+
+    mongoc_collection_destroy(collection);
+
+    /* Two eNB disonncect from MME */
+    rv = tests1ap_enb_close(sock1);
+    ABTS_INT_EQUAL(tc, CORE_OK, rv);
+
+    rv = tests1ap_enb_close(sock2);
+    ABTS_INT_EQUAL(tc, CORE_OK, rv);
+
+    core_sleep(time_from_msec(300));
+}
+
+abts_suite *test_handover(abts_suite *suite)
+{
+    suite = ADD_SUITE(suite)
+
+    abts_run_test(suite, handover_test1, NULL);
+
+    return suite;
+}
diff --git a/test/s1ap_message_test.c b/test/s1ap_message_test.c
index 8d8c9a0ee5..8006b40e07 100644
--- a/test/s1ap_message_test.c
+++ b/test/s1ap_message_test.c
@@ -122,7 +122,7 @@ static void s1ap_message_test5(abts_case *tc, void *data)
     pkbuf_t *pkbuf;
     int result;
 
-    rv = tests1ap_build_setup_req(&pkbuf, 0x54f64);
+    rv = tests1ap_build_setup_req(&pkbuf, S1ap_ENB_ID_PR_macroENB_ID, 0x54f64);
 
     ABTS_INT_EQUAL(tc, CORE_OK, rv);
     ABTS_PTR_NOTNULL(tc, pkbuf);
diff --git a/test/s1setup_test.c b/test/s1setup_test.c
index d0d7e39e52..32c7737a2c 100644
--- a/test/s1setup_test.c
+++ b/test/s1setup_test.c
@@ -29,7 +29,8 @@ static void s1setup_test1(abts_case *tc, void *data)
 
     for (i = 0; i < NUM_OF_TEST_DUPLICATED_ENB; i++)
     {
-        rv = tests1ap_build_setup_req(&sendbuf, 0x54f64);
+        rv = tests1ap_build_setup_req(
+                &sendbuf, S1ap_ENB_ID_PR_macroENB_ID, 0x54f64);
         ABTS_INT_EQUAL(tc, CORE_OK, rv);
 
         rv = tests1ap_enb_send(sock[i], sendbuf);
@@ -75,7 +76,8 @@ static void s1setup_test2(abts_case *tc, void *data)
 
     for (i = 0; i < NUM_OF_TEST_ENB; i++)
     {
-        rv = tests1ap_build_setup_req(&sendbuf, 0x54f64+i);
+        rv = tests1ap_build_setup_req(
+                &sendbuf, S1ap_ENB_ID_PR_macroENB_ID, 0x54f64+i);
         ABTS_INT_EQUAL(tc, CORE_OK, rv);
 
         rv = tests1ap_enb_send(sock[i], sendbuf);
diff --git a/test/testpacket.c b/test/testpacket.c
index b7fdf0866d..028a2ce601 100644
--- a/test/testpacket.c
+++ b/test/testpacket.c
@@ -65,7 +65,8 @@ int tests1ap_enb_read(net_sock_t *sock, pkbuf_t *recvbuf)
 }
 
 
-status_t tests1ap_build_setup_req(pkbuf_t **pkbuf, c_uint32_t enb_id)
+status_t tests1ap_build_setup_req(
+        pkbuf_t **pkbuf, S1ap_ENB_ID_PR present, c_uint32_t enb_id)
 {
     int erval = -1;
 
@@ -78,8 +79,7 @@ status_t tests1ap_build_setup_req(pkbuf_t **pkbuf, c_uint32_t enb_id)
 
     ies = &message.s1ap_S1SetupRequestIEs;
 
-    s1ap_uint32_to_ENB_ID(S1ap_ENB_ID_PR_macroENB_ID, enb_id, 
-        &ies->global_ENB_ID.eNB_ID);
+    s1ap_uint32_to_ENB_ID(present, enb_id, &ies->global_ENB_ID.eNB_ID);
     s1ap_buffer_to_OCTET_STRING(&mme_self()->served_tai[0].plmn_id,
             PLMN_ID_LEN, &ies->global_ENB_ID.pLMNidentity);
 
@@ -135,6 +135,7 @@ status_t tests1ap_build_initial_ue_msg(pkbuf_t **pkbuf, int i)
         "11035758a6200b60 1404ef65233b8878 d290400804026004 00021f025d0107e0"
         "004300060055f501 1022006440080055 f5010019d0100086 400130",
 
+        
         "000c406800000500 080002001f001a00 403f074172080910 10103254866202e0"
         "600021023cd011d1 271a808021100100 0010810600000000 830600000000000d"
         "00000a005c0a0090 11034f18a6f15d01 00004300060000f1 1030390064400800"
@@ -148,13 +149,20 @@ status_t tests1ap_build_initial_ue_msg(pkbuf_t **pkbuf, int i)
         "103254866205f0f0 000000000e023cd0 11d1270780000a00 000d00c100430006"
         "0000f1102b670064 40080000f1109d67 aa500086400130",
 
+
         "000c"
         "404c000005000800 020002001a002423 0741710809101010 3254767905f0f000"
         "0000000e0201d011 d1270780000a0000 0d00c10043000600 00f1102b67006440"
         "080000f11054f640 100086400130",
+        "",
+        "",
 
-        "",
-        "",
+
+        "000c"
+        "4068000005000800 020001001a00403f 0741720809101010 3254861002e06000"
+        "210207d011d1271a 8080211001000010 8106000000008306 00000000000d0000"
+        "0a005c0a00901103 4f18a6f15d010000 4300060000f1105b a0006440080000f1"
+        "1004615380008640 0130",
     };
     c_uint16_t len[TESTS1AP_MAX_MESSAGE] = {
         92,
@@ -168,6 +176,8 @@ status_t tests1ap_build_initial_ue_msg(pkbuf_t **pkbuf, int i)
         80,
         0,
         0,
+
+        108,
     };
     char hexbuf[MAX_SDU_LEN];
     
@@ -231,23 +241,23 @@ status_t tests1ap_build_authentication_response(pkbuf_t **pkbuf, int i)
         "000d403e00000500 000005c00100009d 000800020001001a 001211177c0bca9d"
         "030753086a91970e 838fd07900644008 0000f1101079baf0 004340060000f110"
         "5ba0",
-
         "",
         "",
 
-
         "000d403500000500 0000020001000800 02001f001a000c0b 07530831c964f076"
         "1378760064400800 00f110002343d000 4340060000f11030 39",
-
         "",
         "",
 
         "000d"
         "4038000005000000 05c0020000c80008 00020002001a000c 0b0753087dc78e7c"
         "421f9eb900644008 0000f11054f64010 004340060000f110 2b67",
+        "",
+        "",
 
-        "",
-        "",
+        "000d"
+        "4038000005000000 05c0010001da0008 00020001001a000c 0b0753084ce11ef1"
+        "24b1854500644008 0000f11004615380 004340060000f110 5ba0",
     };
 
     c_uint16_t len[TESTS1AP_MAX_MESSAGE] = {
@@ -262,6 +272,8 @@ status_t tests1ap_build_authentication_response(pkbuf_t **pkbuf, int i)
         60,
         0,
         0,
+
+        60,
     };
     char hexbuf[MAX_SDU_LEN];
     
@@ -280,22 +292,23 @@ status_t tests1ap_build_security_mode_complete(pkbuf_t **pkbuf, int i)
     char *payload[TESTS1AP_MAX_MESSAGE] = {
         "000d403500000500 000005c00100009d 000800020001001a 000908476b8f5f64"
         "00075e0064400800 00f1101079baf000 4340060000f1105b a0",
-
         "",
         "",
 
         "000d403200000500 0000020001000800 02001f001a000908 473c0c819e00075e"
         "006440080000f110 002343d000434006 0000f1103039",
-
         "",
         "",
 
         "000d"
         "4035000005000000 05c0020000c80008 00020002001a0009 0847c0eb1eb80007"
         "5e006440080000f1 1054f64010004340 060000f1102b67",
+        "",
+        "",
 
-        "",
-        "",
+        "000d"
+        "4035000005000000 05c0010001da0008 00020001001a0009 0847d3b0ef030007"
+        "5e006440080000f1 1004615380004340 060000f1105ba0",
 
     };
     c_uint16_t len[TESTS1AP_MAX_MESSAGE] = {
@@ -310,6 +323,8 @@ status_t tests1ap_build_security_mode_complete(pkbuf_t **pkbuf, int i)
         57,
         0,
         0,
+
+        57,
     };
     char hexbuf[MAX_SDU_LEN];
     
@@ -331,24 +346,26 @@ status_t tests1ap_build_esm_information_response(pkbuf_t **pkbuf, int i)
         "9a2626c09a2626c0 9a2626c223150200 0015103d3dda5c72 4cc497354ae64653"
         "45a8088021100100 0010810600000000 830600000000000d 00000a0000644008"
         "0000f1101079baf0 004340060000f110 5ba0",
-
         "",
         "",
 
         "000d403e00000500 0000020001000800 02001f001a001514 27505a0b5301023c"
         "da280908696e7465 726e657400644008 0000f110002343d0 004340060000f110"
         "3039",
-
         "",
         "",
 
         "000d"
         "4041000005000000 05c0020000c80008 00020002001a0015 142793b2bedc0102"
         "01da280908696e74 65726e6574006440 080000f11054f640 10004340060000f1"
-        "102b67"
+        "102b67",
+        "",
+        "",
 
-        "",
-        "",
+        "000d"
+        "4041000005000000 05c0010001da0008 00020001001a0015 14279a2476c80102"
+        "07da280908696e74 65726e6574006440 080000f110046153 80004340060000f1"
+        "105ba0",
     };
     c_uint16_t len[TESTS1AP_MAX_MESSAGE] = {
         146,
@@ -362,6 +379,8 @@ status_t tests1ap_build_esm_information_response(pkbuf_t **pkbuf, int i)
         69,
         0,
         0,
+
+        69,
     };
     char hexbuf[MAX_SDU_LEN];
     
@@ -384,13 +403,11 @@ status_t tests1ap_build_ue_capability_info_indication(pkbuf_t **pkbuf, int i)
         "fc7ff8ffe3ffc7ff 1ffdfd3ffa7a2060 090e194e9525c8c2 fd80000000e03fe7"
         "ff5f60000000384f e9ffd3d800000002 1033035758a66014 042f6513b8800d2f"
         "0831c1a53432b259 ef989007000cdd9c 6331200e0019a332 c662401c003200",
-
         "",
         "",
 
         "0016402d00000300 0000020001000800 02001f004a401a19 00b801014c598080"
         "9c000bf06ec4d001 40302c0000000000 000000",
-
         "",
         "",
 
@@ -405,6 +422,11 @@ status_t tests1ap_build_ue_capability_info_indication(pkbuf_t **pkbuf, int i)
         "00",
 
         "",
+
+
+        "0016"
+        "4030000003000000 05c0010001da0008 00020001004a401a 1900b801014c5980"
+        "809c000bf06ec4d0 0140302c00000000 0000",
     };
     c_uint16_t len[TESTS1AP_MAX_MESSAGE] = {
         161,
@@ -418,6 +440,8 @@ status_t tests1ap_build_ue_capability_info_indication(pkbuf_t **pkbuf, int i)
         67,
         67,
         0,
+
+        52,
     };
     char hexbuf[MAX_SDU_LEN];
     
@@ -437,13 +461,11 @@ status_t tests1ap_build_initial_context_setup_response(pkbuf_t **pkbuf, int i)
         "2009"
         "0025000003000040 05c00100009d0008 400200010033400f 000032400a0a1f0a"
         "012d2801000008",
-
         "",
         "",
 
         "2009002200000300 0040020001000840 02001f0033400f00 0032400a0a1f0a01"
         "23c501000508",
-
         "",
         "",
 
@@ -457,6 +479,10 @@ status_t tests1ap_build_initial_context_setup_response(pkbuf_t **pkbuf, int i)
 
         "",
 
+
+        "2009"
+        "0025000003000040 05c0010001da0008 400200010033400f 000032400a0a1f0a"
+        "012d8301000008",
     };
     c_uint16_t len[TESTS1AP_MAX_MESSAGE] = {
         41,
@@ -470,6 +496,8 @@ status_t tests1ap_build_initial_context_setup_response(pkbuf_t **pkbuf, int i)
         41,
         41,
         0,
+
+        41,
     };
     char hexbuf[MAX_SDU_LEN];
     
@@ -496,6 +524,7 @@ status_t tests1ap_build_attach_complete(pkbuf_t **pkbuf, int i)
 
         "",
 
+
         "",
         "000d"
         "403a000005000000 05c0010000020008 00020011001a000e 0d27225d92bb0207"
@@ -505,9 +534,13 @@ status_t tests1ap_build_attach_complete(pkbuf_t **pkbuf, int i)
         "000d"
         "403a000005000000 05c0020000c80008 00020002001a000e 0d27f190fc2b0207"
         "4300035200c20064 40080000f11054f6 4010004340060000 f1102b67",
+        "",
+        "",
+
+        "000d"
+        "403a000005000000 05c0010001da0008 00020001001a000e 0d272e3456f70207"
+        "4300035200c20064 40080000f1100461 5380004340060000 f1105ba0",
 
-        "",
-        "",
     };
     c_uint16_t len[TESTS1AP_MAX_MESSAGE] = {
         62,
@@ -521,6 +554,8 @@ status_t tests1ap_build_attach_complete(pkbuf_t **pkbuf, int i)
         62,
         0,
         0,
+
+        62,
     };
     char hexbuf[MAX_SDU_LEN];
     
@@ -767,6 +802,8 @@ status_t tests1ap_build_e_rab_setup_response(pkbuf_t **pkbuf, int i)
         "",
         "",
 
+        "2005002600000300 004005c00200003c 0008400300010000 1c400f000027400a"
+        "0c1f0a012da50100 b410",
     };
     c_uint16_t len[TESTS1AP_MAX_MESSAGE] = {
         42,
@@ -780,6 +817,8 @@ status_t tests1ap_build_e_rab_setup_response(pkbuf_t **pkbuf, int i)
         0,
         0,
         0,
+
+        42,
     };
     char hexbuf[MAX_SDU_LEN];
     
@@ -899,6 +938,9 @@ status_t tests1ap_build_activate_dedicated_bearer_accept(
         "",
         "",
 
+        "000d403700000500"
+        "000005c00200003c 0008000300010000 1a000a0927a27f49 d6036200c6006440"
+        "080000f1109d67aa 50004340060000f1 102b67",
     };
     c_uint16_t len[TESTS1AP_MAX_MESSAGE] = {
         59,
@@ -909,9 +951,11 @@ status_t tests1ap_build_activate_dedicated_bearer_accept(
         0,
         0,
 
+        0,
+        0,
+        0,
+
         59,
-        0,
-        0,
     };
     char hexbuf[MAX_SDU_LEN];
     
diff --git a/test/testpacket.h b/test/testpacket.h
index 60902656eb..41de432f47 100644
--- a/test/testpacket.h
+++ b/test/testpacket.h
@@ -13,7 +13,7 @@ CORE_DECLARE(int) tests1ap_enb_send(net_sock_t *sock, pkbuf_t *sendbuf);
 CORE_DECLARE(int) tests1ap_enb_read(net_sock_t *sock, pkbuf_t *recvbuf);
 
 CORE_DECLARE(status_t) tests1ap_build_setup_req(
-        pkbuf_t **pkbuf, c_uint32_t enb_id);
+        pkbuf_t **pkbuf, S1ap_ENB_ID_PR present, c_uint32_t enb_id);
 CORE_DECLARE(status_t) tests1ap_build_initial_ue_msg(pkbuf_t **pkbuf, int i);
 CORE_DECLARE(status_t) tests1ap_build_identity_response(pkbuf_t **pkbuf, int i);
 CORE_DECLARE(status_t) tests1ap_build_authentication_response(
diff --git a/test/testutil.h b/test/testutil.h
index c99b524b7f..881f0e86f4 100644
--- a/test/testutil.h
+++ b/test/testutil.h
@@ -65,5 +65,6 @@ abts_suite *test_security(abts_suite *suite);
 abts_suite *test_s1setup(abts_suite *suite);
 abts_suite *test_attach(abts_suite *suite);
 abts_suite *test_volte(abts_suite *suite);
+abts_suite *test_handover(abts_suite *suite);
 
 #endif /* __TESTUTIL_H__ */
diff --git a/test/volte_test.c b/test/volte_test.c
index 2d3934cb0d..34665460e8 100644
--- a/test/volte_test.c
+++ b/test/volte_test.c
@@ -102,7 +102,8 @@ static void volte_test1(abts_case *tc, void *data)
     ABTS_PTR_NOTNULL(tc, sock);
 
     /* Send S1-Setup Reqeust */
-    rv = tests1ap_build_setup_req(&sendbuf, 0x54f64);
+    rv = tests1ap_build_setup_req(
+            &sendbuf, S1ap_ENB_ID_PR_macroENB_ID, 0x54f64);
     ABTS_INT_EQUAL(tc, CORE_OK, rv);
     rv = tests1ap_enb_send(sock, sendbuf);
     ABTS_INT_EQUAL(tc, CORE_OK, rv);
@@ -412,7 +413,8 @@ static void volte_test2(abts_case *tc, void *data)
     ABTS_PTR_NOTNULL(tc, sock);
 
     /* Send S1-Setup Reqeust */
-    rv = tests1ap_build_setup_req(&sendbuf, 0x54f64);
+    rv = tests1ap_build_setup_req(
+            &sendbuf, S1ap_ENB_ID_PR_macroENB_ID, 0x54f64);
     ABTS_INT_EQUAL(tc, CORE_OK, rv);
     rv = tests1ap_enb_send(sock, sendbuf);
     ABTS_INT_EQUAL(tc, CORE_OK, rv);