diff --git a/srsgnb/hdr/stack/rrc/rrc_nr_ue.h b/srsgnb/hdr/stack/rrc/rrc_nr_ue.h
index 1b3a588d2..57dfd8400 100644
--- a/srsgnb/hdr/stack/rrc/rrc_nr_ue.h
+++ b/srsgnb/hdr/stack/rrc/rrc_nr_ue.h
@@ -62,9 +62,15 @@ public:
   /* TS 38.331 - 5.3.5 RRC reconfiguration */
   void handle_rrc_reconfiguration_complete(const asn1::rrc_nr::rrc_recfg_complete_s& msg);
 
+  /* TS 38.331 - 5.7.1 DL information transfer */
+  void send_dl_information_transfer(srsran::unique_byte_buffer_t sdu);
+
   /* TS 38.331 - 5.7.2 UL information transfer */
   void handle_ul_information_transfer(const asn1::rrc_nr::ul_info_transfer_s& msg);
 
+  // NGAP interface
+  void establish_eps_bearer(uint32_t pdu_session_id, srsran::const_byte_span nas_pdu, uint32_t lcid);
+
 private:
   void send_dl_ccch(const asn1::rrc_nr::dl_ccch_msg_s& dl_ccch_msg);
   void send_dl_dcch(srsran::nr_srb srb, const asn1::rrc_nr::dl_dcch_msg_s& dl_dcch_msg);
diff --git a/srsgnb/src/stack/rrc/rrc_nr.cc b/srsgnb/src/stack/rrc/rrc_nr.cc
index 9fc2bf6ad..58f4c0b5e 100644
--- a/srsgnb/src/stack/rrc/rrc_nr.cc
+++ b/srsgnb/src/stack/rrc/rrc_nr.cc
@@ -558,6 +558,12 @@ int rrc_nr::start_security_mode_procedure(uint16_t rnti)
 }
 int rrc_nr::establish_rrc_bearer(uint16_t rnti, uint16_t pdu_session_id, srsran::const_byte_span nas_pdu, uint32_t lcid)
 {
+  if (not users.contains(rnti)) {
+    logger.error("Establishing RRC bearers for inexistent rnti=0x%x", rnti);
+    return SRSRAN_ERROR;
+  }
+
+  users[rnti]->establish_eps_bearer(pdu_session_id, nas_pdu, lcid);
   return SRSRAN_SUCCESS;
 }
 
@@ -571,7 +577,18 @@ int rrc_nr::allocate_lcid(uint16_t rnti)
   return SRSRAN_SUCCESS;
 }
 
-void rrc_nr::write_dl_info(uint16_t rnti, srsran::unique_byte_buffer_t sdu) {}
+void rrc_nr::write_dl_info(uint16_t rnti, srsran::unique_byte_buffer_t sdu)
+{
+  if (not users.contains(rnti)) {
+    logger.error("Received DL information transfer for inexistent rnti=0x%x", rnti);
+    return;
+  }
+  if (sdu == nullptr or sdu->size() == 0) {
+    logger.error("Received empty DL information transfer for rnti=0x%x", rnti);
+    return;
+  }
+  users[rnti]->send_dl_information_transfer(std::move(sdu));
+}
 
 /*******************************************************************************
   Interface for EUTRA RRC
diff --git a/srsgnb/src/stack/rrc/rrc_nr_ue.cc b/srsgnb/src/stack/rrc/rrc_nr_ue.cc
index f7c03e1c3..349425c89 100644
--- a/srsgnb/src/stack/rrc/rrc_nr_ue.cc
+++ b/srsgnb/src/stack/rrc/rrc_nr_ue.cc
@@ -891,10 +891,15 @@ void rrc_nr::ue::send_rrc_setup()
   srb_to_add_mod_s& srb1 = setup_ies.radio_bearer_cfg.srb_to_add_mod_list[0];
   srb1.srb_id            = 1;
 
+  asn1::rrc_nr::cell_group_cfg_s master_cell_group = *parent->cell_ctxt->master_cell_group;
+
+  // Derive master cell group config bearers
+  fill_cellgroup_with_radio_bearer_cfg(parent->cfg, setup_ies.radio_bearer_cfg, master_cell_group);
+
   {
     srsran::unique_byte_buffer_t pdu = srsran::make_byte_buffer();
     asn1::bit_ref                bref{pdu->data(), pdu->get_tailroom()};
-    if (parent->cell_ctxt->master_cell_group->pack(bref) != SRSRAN_SUCCESS) {
+    if (master_cell_group.pack(bref) != SRSRAN_SUCCESS) {
       logger.error("Failed to pack master cell group");
       send_rrc_reject(max_wait_time_secs);
       return;
@@ -917,11 +922,11 @@ void rrc_nr::ue::send_rrc_setup()
 void rrc_nr::ue::handle_rrc_setup_complete(const asn1::rrc_nr::rrc_setup_complete_s& msg)
 {
   // TODO: handle RRCSetupComplete
+
+  // Create UE context in NGAP
   using ngap_cause_t = asn1::ngap_nr::rrcestablishment_cause_opts::options;
   auto ngap_cause    = (ngap_cause_t)ctxt.connection_cause.value; // NGAP and RRC causes seem to have a 1-1 mapping
   parent->ngap->initial_ue(rnti, uecfg.carriers[0].cc, ngap_cause, {}, ctxt.setup_ue_id);
-
-  send_security_mode_command();
 }
 
 /// TS 38.331, SecurityModeCommand
@@ -967,11 +972,27 @@ void rrc_nr::ue::handle_rrc_reconfiguration_complete(const asn1::rrc_nr::rrc_rec
   // TODO: handle RRCReconfComplete
 }
 
+void rrc_nr::ue::send_dl_information_transfer(srsran::unique_byte_buffer_t sdu)
+{
+  dl_dcch_msg_s dl_dcch_msg;
+  dl_dcch_msg.msg.set_c1().set_dl_info_transfer().rrc_transaction_id = (uint8_t)((transaction_id++) % 4);
+  dl_info_transfer_ies_s& ies = dl_dcch_msg.msg.c1().dl_info_transfer().crit_exts.set_dl_info_transfer();
+
+  ies.ded_nas_msg_present = true;
+  ies.ded_nas_msg.resize(sdu->N_bytes);
+  memcpy(ies.ded_nas_msg.data(), sdu->data(), ies.ded_nas_msg.size());
+
+  send_dl_dcch(srsran::nr_srb::srb1, dl_dcch_msg);
+}
+
 void rrc_nr::ue::handle_ul_information_transfer(const asn1::rrc_nr::ul_info_transfer_s& msg)
 {
-  // TODO: handle UL information transfer
+  // Forward dedicatedNAS-Message to NGAP
+  parent->ngap->write_pdu(rnti, msg.crit_exts.ul_info_transfer().ded_nas_msg);
 }
 
+void rrc_nr::ue::establish_eps_bearer(uint32_t pdu_session_id, srsran::const_byte_span nas_pdu, uint32_t lcid) {}
+
 bool rrc_nr::ue::init_pucch()
 {
   // TODO: Allocate PUCCH resources