diff --git a/src/context_map.c b/src/context_map.c
index 052133c..0960cb9 100644
--- a/src/context_map.c
+++ b/src/context_map.c
@@ -58,6 +58,7 @@
 /* Map from a HNB + ContextID to the SCCP-side Connection ID */
 struct hnbgw_context_map *
 context_map_alloc_by_hnb(struct hnb_context *hnb, uint32_t rua_ctx_id,
+			 bool is_ps,
 			 struct hnbgw_cnlink *cn_if_new)
 {
 	struct hnbgw_context_map *map;
@@ -69,7 +70,8 @@
 		if (map->cn_link != cn_if_new) {
 			continue;
 		}
-		if (map->rua_ctx_id == rua_ctx_id) {
+		if (map->rua_ctx_id == rua_ctx_id
+		    && map->is_ps == is_ps) {
 			return map;
 		}
 	}
@@ -88,6 +90,7 @@
 	map->cn_link = cn_if_new;
 	map->hnb_ctx = hnb;
 	map->rua_ctx_id = rua_ctx_id;
+	map->is_ps = is_ps;
 	map->scu_conn_id = new_scu_conn_id;
 
 	/* put it into both lists */
@@ -134,31 +137,27 @@
 static void context_map_tmr_cb(void *data)
 {
 	struct hnb_gw *gw = data;
-	struct hnbgw_cnlink *cn;
+	struct hnbgw_cnlink *cn = gw->sccp.cnlink;
+	struct hnbgw_context_map *map;
 
 	DEBUGP(DMAIN, "Running context mapper garbage collection\n");
-	/* iterate over list of core network (links) */
-	llist_for_each_entry(cn, &gw->cn_list, list) {
-		struct hnbgw_context_map *map;
-
-		llist_for_each_entry(map, &cn->map_list, cn_list) {
-			switch (map->state) {
-			case MAP_S_RESERVED1:
-				/* first time we see this reserved
-				 * entry: mark it for stage 2 */
-				map->state = MAP_S_RESERVED2;
-				break;
-			case MAP_S_RESERVED2:
-				/* first time we see this reserved
-				 * entry: remove it */
-				map->state = MAP_S_NULL;
-				llist_del(&map->cn_list);
-				llist_del(&map->hnb_list);
-				talloc_free(map);
-				break;
-			default:
-				break;
-			}
+	llist_for_each_entry(map, &cn->map_list, cn_list) {
+		switch (map->state) {
+		case MAP_S_RESERVED1:
+			/* first time we see this reserved
+			 * entry: mark it for stage 2 */
+			map->state = MAP_S_RESERVED2;
+			break;
+		case MAP_S_RESERVED2:
+			/* first time we see this reserved
+			 * entry: remove it */
+			map->state = MAP_S_NULL;
+			llist_del(&map->cn_list);
+			llist_del(&map->hnb_list);
+			talloc_free(map);
+			break;
+		default:
+			break;
 		}
 	}
 	/* re-schedule this timer */
diff --git a/src/hnbgw.c b/src/hnbgw.c
index 9984927..5d9f87b 100644
--- a/src/hnbgw.c
+++ b/src/hnbgw.c
@@ -47,8 +47,7 @@
 
 #include <osmocom/netif/stream.h>
 
-#include <osmocom/sigtran/sua.h>
-#include <osmocom/sigtran/protocol/sua.h>
+#include <osmocom/sigtran/protocol/m3ua.h>
 #include <osmocom/sigtran/sccp_sap.h>
 
 #include <osmocom/iuh/hnbgw.h>
@@ -82,16 +81,15 @@
 
 	gw->config.iucs_remote_ip = talloc_strdup(gw,
 						HNBGW_IUCS_REMOTE_IP_DEFAULT);
-	gw->config.iucs_remote_port = SUA_PORT;
+	gw->config.iucs_remote_port = M3UA_PORT;
 
 	gw->config.iups_remote_ip = talloc_strdup(gw,
 						HNBGW_IUPS_REMOTE_IP_DEFAULT);
-	gw->config.iups_remote_port = SUA_PORT;
+	gw->config.iups_remote_port = M3UA_PORT;
 
 	gw->next_ue_ctx_id = 23;
 	INIT_LLIST_HEAD(&gw->hnb_list);
 	INIT_LLIST_HEAD(&gw->ue_list);
-	INIT_LLIST_HEAD(&gw->cn_list);
 
 	context_map_init(gw);
 
@@ -330,11 +328,6 @@
 		.color = "",
 		.description = "Home Node B Application Part",
 	},
-	[DSUA] = {
-		.name = "DSUA", .loglevel = LOGL_DEBUG, .enabled = 1,
-		.color = "",
-		.description = "SCCP User Adaptation",
-	},
 	[DRUA] = {
 		.name = "DRUA", .loglevel = LOGL_DEBUG, .enabled = 1,
 		.color = "",
@@ -382,7 +375,7 @@
 static void print_help()
 {
 	printf("  -h --help                  This text.\n");
-	printf("  -d option --debug=DHNBAP:DSUA:DRUA:DRANAP:DMAIN  Enable debugging.\n");
+	printf("  -d option --debug=DHNBAP:DRUA:DRANAP:DMAIN  Enable debugging.\n");
 	printf("  -D --daemonize             Fork the process into a background daemon.\n");
 	printf("  -c --config-file filename  The config file to use.\n");
 	printf("  -s --disable-color\n");
@@ -451,7 +444,7 @@
 
 int main(int argc, char **argv)
 {
-	struct osmo_sccp_user *sua_user;
+	struct osmo_sccp_user *sccp_user;
 	struct osmo_sccp_link *sua_link;
 	struct osmo_stream_srv_link *srv;
 	int rc;
@@ -467,6 +460,8 @@
 	if (rc < 0)
 		exit(1);
 
+	osmo_ss7_init();
+
 	vty_info.copyright = osmo_hnbgw_copyright;
 	vty_init(&vty_info);
 
@@ -504,19 +499,25 @@
 		exit(1);
 	}
 
-	osmo_sua_set_log_area(DSUA);
 	ranap_set_log_area(DRANAP);
 
 	OSMO_ASSERT(g_hnb_gw->config.iucs_remote_ip);
-	g_hnb_gw->cnlink_cs = hnbgw_cnlink_init(g_hnb_gw,
-						g_hnb_gw->config.iucs_remote_ip,
-						g_hnb_gw->config.iucs_remote_port,
-						0);
-	OSMO_ASSERT(g_hnb_gw->config.iups_remote_ip);
-	g_hnb_gw->cnlink_ps = hnbgw_cnlink_init(g_hnb_gw,
-						g_hnb_gw->config.iups_remote_ip,
-						g_hnb_gw->config.iups_remote_port,
-						1);
+	rc = hnbgw_cnlink_init(g_hnb_gw,
+			       g_hnb_gw->config.iucs_remote_ip,
+			       g_hnb_gw->config.iucs_remote_port,
+			       "127.0.0.5" /* FIXME: configurable */,
+			       23 /* FIXME: configurable */);
+	if (rc < 0) {
+		LOGP(DMAIN, LOGL_ERROR, "Failed to initialize SCCP link to CN\n");
+		exit(1);
+	}
+
+	osmo_sccp_make_addr_pc_ssn(&g_hnb_gw->sccp.remote_addr_cs,
+				   1 /* FIXME: configurable */,
+				   OSMO_SCCP_SSN_RANAP);
+	osmo_sccp_make_addr_pc_ssn(&g_hnb_gw->sccp.remote_addr_ps,
+				   2 /* FIXME: configurable */,
+				   OSMO_SCCP_SSN_RANAP);
 
 	OSMO_ASSERT(g_hnb_gw->config.iuh_local_ip);
 	LOGP(DMAIN, LOGL_NOTICE, "Listening for Iuh at %s %d\n",
diff --git a/src/hnbgw_cn.c b/src/hnbgw_cn.c
index 4e5b2e0..2fd9d71 100644
--- a/src/hnbgw_cn.c
+++ b/src/hnbgw_cn.c
@@ -24,8 +24,7 @@
 #include <osmocom/core/utils.h>
 #include <osmocom/core/timer.h>
 
-#include <osmocom/sigtran/protocol/sua.h>
-#include <osmocom/sigtran/sua.h>
+#include <osmocom/sigtran/protocol/m3ua.h>
 #include <osmocom/sigtran/sccp_sap.h>
 #include <osmocom/sigtran/sccp_helpers.h>
 
@@ -41,34 +40,32 @@
 
 int hnbgw_cnlink_change_state(struct hnbgw_cnlink *cnlink, enum hnbgw_cnlink_state state);
 
-static int transmit_rst(struct hnbgw_cnlink *cnlink)
+static int transmit_rst(struct hnb_gw *gw, RANAP_CN_DomainIndicator_t domain,
+			struct osmo_sccp_addr *remote_addr)
 {
 	struct msgb *msg;
 	struct msgb *msgprim;
-	RANAP_CN_DomainIndicator_t domain;
 	RANAP_Cause_t cause = {
 		.present = RANAP_Cause_PR_transmissionNetwork,
 		.choice. transmissionNetwork = RANAP_CauseTransmissionNetwork_signalling_transport_resource_failure,
 	};
 
-	if (cnlink->is_ps)
-		domain = RANAP_CN_DomainIndicator_ps_domain;
-	else
-		domain = RANAP_CN_DomainIndicator_cs_domain;
-
 	msg = ranap_new_msg_reset(domain, &cause);
 
-	return osmo_sccp_tx_unitdata_msg(cnlink->sua_link, &cnlink->local_addr,
-					 &cnlink->remote_addr, msg);
+	return osmo_sccp_tx_unitdata_msg(gw->sccp.cnlink->sccp_user,
+					 &gw->sccp.local_addr,
+					 remote_addr,
+					 msg);
 }
 
 /* Timer callback once T_RafC expires */
 static void cnlink_trafc_cb(void *data)
 {
-	struct hnbgw_cnlink *cnlink = data;
+	struct hnb_gw *gw = data;
 
-	transmit_rst(cnlink);
-	hnbgw_cnlink_change_state(cnlink, CNLINK_S_EST_RST_TX_WAIT_ACK);
+	transmit_rst(gw, RANAP_CN_DomainIndicator_cs_domain, &gw->sccp.remote_addr_cs);
+	transmit_rst(gw, RANAP_CN_DomainIndicator_ps_domain, &gw->sccp.remote_addr_ps);
+	hnbgw_cnlink_change_state(gw->sccp.cnlink, CNLINK_S_EST_RST_TX_WAIT_ACK);
 	/* The spec states that we should abandon after a configurable
 	 * number of times.  We decide to simply continue trying */
 }
@@ -81,7 +78,7 @@
 	case CNLINK_S_EST_PEND:
 		break;
 	case CNLINK_S_EST_CONF:
-		cnlink_trafc_cb(cnlink);
+		cnlink_trafc_cb(cnlink->gw);
 		break;
 	case CNLINK_S_EST_RST_TX_WAIT_ACK:
 		osmo_timer_schedule(&cnlink->T_RafC, 5, 0);
@@ -293,7 +290,7 @@
 		return 0;
 	}
 
-	return rua_tx_dt(map->hnb_ctx, map->cn_link->is_ps, map->rua_ctx_id,
+	return rua_tx_dt(map->hnb_ctx, map->is_ps, map->rua_ctx_id,
 			 msgb_l2(oph->msg), msgb_l2len(oph->msg));
 }
 
@@ -322,15 +319,15 @@
 		return 0;
 	}
 
-	return rua_tx_disc(map->hnb_ctx, map->cn_link->is_ps, map->rua_ctx_id,
+	return rua_tx_disc(map->hnb_ctx, map->is_ps, map->rua_ctx_id,
 			   &rua_cause, msgb_l2(oph->msg), msgb_l2len(oph->msg));
 }
 
 /* Entry point for primitives coming up from SCCP User SAP */
 static int sccp_sap_up(struct osmo_prim_hdr *oph, void *ctx)
 {
-	struct osmo_sccp_link *slink = ctx;
-	struct hnbgw_cnlink *cnlink = osmo_sccp_link_get_user_priv(slink);
+	struct osmo_sccp_user *scu = ctx;
+	struct hnbgw_cnlink *cnlink = osmo_sccp_user_get_priv(scu);
 	struct osmo_scu_prim *prim = (struct osmo_scu_prim *) oph;
 	int rc;
 
@@ -361,53 +358,48 @@
 	return 0;
 }
 
-
-/* Set up a link towards the core network for the circuit switched (is_ps == 0)
- * or packet switched (is_ps != 0) domain. */
-struct hnbgw_cnlink *hnbgw_cnlink_init(struct hnb_gw *gw, const char *host, uint16_t port, int is_ps)
+int hnbgw_cnlink_init(struct hnb_gw *gw, const char *stp_host, uint16_t stp_port,
+		      const char *local_ip, uint32_t local_pc)
 {
-	struct hnbgw_cnlink *cnlink = talloc_zero(gw, struct hnbgw_cnlink);
+	struct hnbgw_cnlink *cnlink;
 	int rc;
 
+	OSMO_ASSERT(!gw->sccp.instance);
+	OSMO_ASSERT(!gw->sccp.cnlink);
+
+	gw->sccp.instance = osmo_sccp_simple_client(gw, "OsmoHNBGW", local_pc,
+						    OSMO_SS7_ASP_PROT_M3UA, 0, local_ip,
+						    stp_port, stp_host);
+	if (!gw->sccp.instance) {
+		LOGP(DMAIN, LOGL_ERROR, "Failed to init SCCP Instance\n");
+		return -1;
+	}
+
+	LOGP(DRUA, LOGL_DEBUG, "SCCP uplink to STP: %s %u\n", stp_host, stp_port);
+
+	osmo_sccp_make_addr_pc_ssn(&gw->sccp.local_addr, local_pc,
+				   OSMO_SCCP_SSN_RANAP);
+
+	cnlink = talloc_zero(gw, struct hnbgw_cnlink);
 	cnlink->gw = gw;
 	INIT_LLIST_HEAD(&cnlink->map_list);
 	cnlink->T_RafC.cb = cnlink_trafc_cb;
-	cnlink->T_RafC.data = cnlink;
+	cnlink->T_RafC.data = gw;
 	cnlink->next_conn_id = 1000;
-	cnlink->is_ps = is_ps;
-	osmo_sccp_make_addr_pc_ssn(&cnlink->local_addr, 2,
-				   OSMO_SCCP_SSN_RANAP);
-	osmo_sccp_make_addr_pc_ssn(&cnlink->remote_addr, 1,
-				   OSMO_SCCP_SSN_RANAP);
 
-	LOGP(DRUA, LOGL_DEBUG, "New hnbgw_cnlink %p (gw %p): %s %d %s\n",
-	     cnlink, cnlink->gw, host, port, is_ps? "PS" : "CS");
-
-	cnlink->sua_user = osmo_sua_user_create(cnlink, sccp_sap_up, cnlink);
-	if (!cnlink->sua_user) {
-		LOGP(DMAIN, LOGL_ERROR, "Failed to init SUA\n");
-		goto out_free;
-	}
-	rc = osmo_sua_client_connect(cnlink->sua_user, host, port);
-	if (rc < 0) {
-		LOGP(DMAIN, LOGL_ERROR, "Failed to connect SUA\n");
-		goto out_user;
-	}
-	cnlink->sua_link = osmo_sua_client_get_link(cnlink->sua_user);
-	if (!cnlink->sua_link) {
-		LOGP(DMAIN, LOGL_ERROR, "Failed to get SUA link\n");
-		goto out_disconnect;
+	cnlink->sccp_user = osmo_sccp_user_bind_pc(gw->sccp.instance,
+						   "OsmoHNBGW",
+						   sccp_sap_up, OSMO_SCCP_SSN_RANAP,
+						   gw->sccp.local_addr.pc);
+	if (!cnlink->sccp_user) {
+		LOGP(DMAIN, LOGL_ERROR, "Failed to init SCCP User\n");
+		return -1;
 	}
 
-	llist_add_tail(&cnlink->list, &gw->cn_list);
+	/* In sccp_sap_up() we expect the cnlink in the user's priv. */
+	osmo_sccp_user_set_priv(cnlink->sccp_user, cnlink);
 
-	return cnlink;
+	gw->sccp.cnlink = cnlink;
 
-out_disconnect:
-	/* FIXME */
-out_user:
-	osmo_sua_user_destroy(cnlink->sua_user);
-out_free:
-	talloc_free(cnlink);
-	return NULL;
+	return 0;
 }
diff --git a/src/hnbgw_rua.c b/src/hnbgw_rua.c
index 6190fd0..329f990 100644
--- a/src/hnbgw_rua.c
+++ b/src/hnbgw_rua.c
@@ -24,7 +24,6 @@
 #include <osmocom/netif/stream.h>
 
 #include <osmocom/sigtran/sccp_sap.h>
-#include <osmocom/sigtran/sua.h>
 
 #include <unistd.h>
 #include <errno.h>
@@ -170,15 +169,19 @@
 	struct msgb *msg;
 	struct osmo_scu_prim *prim;
 	struct hnbgw_context_map *map;
-	struct hnbgw_cnlink *cn;
+	struct hnbgw_cnlink *cn = hnb->gw->sccp.cnlink;
+	struct osmo_sccp_addr *remote_addr;
+	bool is_ps;
 	int rc;
 
 	switch (cN_DomainIndicator) {
 	case RUA_CN_DomainIndicator_cs_domain:
-		cn = hnb->gw->cnlink_cs;
+		remote_addr = &hnb->gw->sccp.remote_addr_cs;
+		is_ps = false;
 		break;
 	case RUA_CN_DomainIndicator_ps_domain:
-		cn = hnb->gw->cnlink_ps;
+		remote_addr = &hnb->gw->sccp.remote_addr_ps;
+		is_ps = true;
 		break;
 	default:
 		LOGP(DRUA, LOGL_ERROR, "Unsupported Domain %u\n",
@@ -191,16 +194,19 @@
 		return 0;
 	}
 
+	msg = msgb_alloc(1500, "rua_to_sccp");
+
 	prim = (struct osmo_scu_prim *) msgb_put(msg, sizeof(*prim));
 	osmo_prim_init(&prim->oph, SCCP_SAP_USER, type, PRIM_OP_REQUEST, msg);
 
-	map = context_map_alloc_by_hnb(hnb, context_id, cn);
+	map = context_map_alloc_by_hnb(hnb, context_id, is_ps, cn);
+	OSMO_ASSERT(map);
 
 	/* add primitive header */
 	switch (type) {
 	case OSMO_SCU_PRIM_N_CONNECT:
-		prim->u.connect.called_addr;
-		prim->u.connect.calling_addr;
+		prim->u.connect.called_addr = *remote_addr;
+		prim->u.connect.calling_addr = cn->gw->sccp.local_addr;
 		prim->u.connect.sccp_class = 2;
 		prim->u.connect.conn_id = map->scu_conn_id;
 		break;
@@ -212,8 +218,8 @@
 		prim->u.disconnect.cause = cause;
 		break;
 	case OSMO_SCU_PRIM_N_UNITDATA:
-		prim->u.unitdata.called_addr;
-		prim->u.unitdata.calling_addr;
+		prim->u.unitdata.called_addr = *remote_addr;
+		prim->u.unitdata.calling_addr = cn->gw->sccp.local_addr;
 		break;
 	default:
 		return -EINVAL;
@@ -225,7 +231,7 @@
 		memcpy(msg->l2h, data, len);
 	}
 
-	rc = osmo_sua_user_link_down(cn->sua_link, &prim->oph);
+	rc = osmo_sccp_user_sap_down(cn->sccp_user, &prim->oph);
 
 	return rc;
 }
diff --git a/src/tests/Makefile.am b/src/tests/Makefile.am
index e2bea07..28ad56c 100644
--- a/src/tests/Makefile.am
+++ b/src/tests/Makefile.am
@@ -5,7 +5,7 @@
 
 COMMON_LIBS = $(OSMOVTY_LIBS) $(OSMOCORE_LIBS) $(OSMOGSM_LIBS) $(ASN1C_LIBS) $(OSMOSIGTRAN_LIBS) -lsctp
 
-check_PROGRAMS = test-ranap test-helpers test-hnbap hnb-test dummy-cn
+check_PROGRAMS = test-ranap test-helpers test-hnbap hnb-test #dummy-cn
 
 noinst_HEADERS = test_common.h hnb-test.h hnb-test-layers.h
 
@@ -24,8 +24,9 @@
 test_ranap_SOURCES = $(RANAP_FILES) test-ranap.c test_common.c
 test_ranap_LDADD = $(COMMON_LIBS) $(top_builddir)/src/libosmo-ranap.la
 
-dummy_cn_SOURCES = $(RANAP_FILES) test_common.c dummy_cn_sua.c
-dummy_cn_LDADD = $(COMMON_LIBS) $(top_builddir)/src/libosmo-ranap.la
+# TODO: re-add using SCCP?
+#dummy_cn_SOURCES = $(RANAP_FILES) test_common.c dummy_cn_sua.c
+#dummy_cn_LDADD = $(COMMON_LIBS) $(top_builddir)/src/libosmo-ranap.la
 
 $(top_builddir)/src/libosmo-ranap.la:
 	$(MAKE) -C $(top_builddir)/src libosmo-ranap.la
diff --git a/src/tests/test_common.c b/src/tests/test_common.c
index ba00709..c8aafdd 100644
--- a/src/tests/test_common.c
+++ b/src/tests/test_common.c
@@ -62,11 +62,6 @@
 		.color = "",
 		.description = "RANAP User Adaptation",
 	},
-	[DSUA] = {
-		.name = "SUA", .loglevel = LOGL_DEBUG, .enabled = 1,
-		.color = "",
-		.description = "SCCP User Adaptation",
-	},
 };
 
 static const struct log_info test_log_info = {