diff --git a/doc/manuals/vty/msc_vty_reference.xml b/doc/manuals/vty/msc_vty_reference.xml
index 36cbf77..6418425 100644
--- a/doc/manuals/vty/msc_vty_reference.xml
+++ b/doc/manuals/vty/msc_vty_reference.xml
@@ -576,10 +576,11 @@
         <param name='&lt;0-65535&gt;' doc='CI' />
       </params>
     </command>
-    <command id='show timer [(mgw|mncc|sccp|geran|utran|sgs)] [TNNNN]'>
+    <command id='show timer [(vlr|mgw|mncc|sccp|geran|utran|sgs)] [TNNNN]'>
       <params>
         <param name='show' doc='Show running system information' />
         <param name='timer' doc='Show timers' />
+        <param name='[vlr]' doc='VLR (Visitors Location Register)' />
         <param name='[mgw]' doc='MGW (Media Gateway) interface' />
         <param name='[mncc]' doc='MNCC (Mobile Network Call Control) interface' />
         <param name='[sccp]' doc='SCCP (Signalling Connection Control Part)' />
@@ -1405,10 +1406,11 @@
         <param name='&lt;0-65535&gt;' doc='CI' />
       </params>
     </command>
-    <command id='show timer [(mgw|mncc|sccp|geran|utran|sgs)] [TNNNN]'>
+    <command id='show timer [(vlr|mgw|mncc|sccp|geran|utran|sgs)] [TNNNN]'>
       <params>
         <param name='show' doc='Show running system information' />
         <param name='timer' doc='Show timers' />
+        <param name='[vlr]' doc='VLR (Visitors Location Register)' />
         <param name='[mgw]' doc='MGW (Media Gateway) interface' />
         <param name='[mncc]' doc='MNCC (Mobile Network Call Control) interface' />
         <param name='[sccp]' doc='SCCP (Signalling Connection Control Part)' />
@@ -2936,9 +2938,10 @@
         <param name='RAN_PC_OR_MSC_IPA_NAME' doc='Point code or MSC IPA name value' />
       </params>
     </command>
-    <command id='timer [(mgw|mncc|sccp|geran|utran|sgs)] [TNNNN] [(&lt;0-2147483647&gt;|default)]'>
+    <command id='timer [(vlr|mgw|mncc|sccp|geran|utran|sgs)] [TNNNN] [(&lt;0-2147483647&gt;|default)]'>
       <params>
         <param name='timer' doc='Configure or show timers' />
+        <param name='[vlr]' doc='VLR (Visitors Location Register)' />
         <param name='[mgw]' doc='MGW (Media Gateway) interface' />
         <param name='[mncc]' doc='MNCC (Mobile Network Call Control) interface' />
         <param name='[sccp]' doc='SCCP (Signalling Connection Control Part)' />
diff --git a/include/osmocom/msc/msc_common.h b/include/osmocom/msc/msc_common.h
index bd85722..8a43e69 100644
--- a/include/osmocom/msc/msc_common.h
+++ b/include/osmocom/msc/msc_common.h
@@ -10,6 +10,7 @@
 struct vlr_subscr;
 
 extern struct osmo_tdef_group msc_tdef_group[];
+extern struct osmo_tdef msc_tdefs_vlr[];
 
 #define MSC_HLR_REMOTE_IP_DEFAULT "127.0.0.1"
 #define MSC_HLR_REMOTE_PORT_DEFAULT OSMO_GSUP_PORT
diff --git a/include/osmocom/msc/vlr.h b/include/osmocom/msc/vlr.h
index d22e3ec..615c6c8 100644
--- a/include/osmocom/msc/vlr.h
+++ b/include/osmocom/msc/vlr.h
@@ -252,13 +252,6 @@
 	int (*subscr_assoc)(void *msc_conn_ref, struct vlr_subscr *vsub);
 };
 
-enum vlr_timer {
-	VLR_T_3250,
-	VLR_T_3260,
-	VLR_T_3270,
-	_NUM_VLR_TIMERS
-};
-
 /* An instance of the VLR codebase */
 struct vlr_instance {
 	struct llist_head subscribers;
@@ -275,7 +268,6 @@
 		bool auth_reuse_old_sets_on_error;
 		bool parq_retrieve_imsi;
 		bool is_ps;
-		uint32_t timer[_NUM_VLR_TIMERS];
 	} cfg;
 	/* A free-form pointer for use by the caller */
 	void *user_ctx;
diff --git a/src/libmsc/msc_net_init.c b/src/libmsc/msc_net_init.c
index ffb8a3b..8c8fb86 100644
--- a/src/libmsc/msc_net_init.c
+++ b/src/libmsc/msc_net_init.c
@@ -41,6 +41,7 @@
 };
 
 struct osmo_tdef_group msc_tdef_group[] = {
+	{ .name = "vlr", .tdefs = msc_tdefs_vlr, .desc = "VLR (Visitors Location Register)" },
 	{ .name = "mgw", .tdefs = g_mgw_tdefs, .desc = "MGW (Media Gateway) interface" },
 	{ .name = "mncc", .tdefs = mncc_tdefs, .desc = "MNCC (Mobile Network Call Control) interface" },
 	{ .name = "sccp", .tdefs = g_sccp_tdefs, .desc = "SCCP (Signalling Connection Control Part)" },
diff --git a/src/libvlr/vlr.c b/src/libvlr/vlr.c
index b164fd8..a1489f2 100644
--- a/src/libvlr/vlr.c
+++ b/src/libvlr/vlr.c
@@ -23,6 +23,7 @@
 #include <osmocom/core/fsm.h>
 #include <osmocom/core/utils.h>
 #include <osmocom/core/timer.h>
+#include <osmocom/core/tdef.h>
 #include <osmocom/gsm/protocol/gsm_04_08_gprs.h>
 #include <osmocom/gsm/gsup.h>
 #include <osmocom/gsm/apn.h>
@@ -61,24 +62,20 @@
 	{ 0, NULL }
 };
 
+/* 3GPP TS 24.008, table 11.2 Mobility management timers (network-side) */
+struct osmo_tdef msc_tdefs_vlr[] = {
+	/* TODO: also define T3212 here */
+	{ .T = 3250, .default_val = 12, .desc = "TMSI Reallocation procedure" },
+	{ .T = 3260, .default_val = 12, .desc = "Authentication procedure" },
+	{ .T = 3270, .default_val = 12, .desc = "Identification procedure" },
+	{ /* terminator */ }
+};
+
+/* This is just a wrapper around the osmo_tdef API.
+ * TODO: we should start using osmo_tdef_fsm_inst_state_chg() */
 uint32_t vlr_timer(struct vlr_instance *vlr, uint32_t timer)
 {
-	uint32_t tidx = 0xffffffff;
-
-	switch (timer) {
-	case 3270:
-		tidx = VLR_T_3270;
-		break;
-	case 3260:
-		tidx = VLR_T_3260;
-		break;
-	case 3250:
-		tidx = VLR_T_3250;
-		break;
-	}
-
-	OSMO_ASSERT(tidx < sizeof(vlr->cfg.timer));
-	return vlr->cfg.timer[tidx];
+	return osmo_tdef_get(msc_tdefs_vlr, timer, OSMO_TDEF_S, 0);
 }
 
 /* return static buffer with printable name of VLR subscriber */
diff --git a/tests/test_nodes.vty b/tests/test_nodes.vty
index 2c2ce1b..b87a371 100644
--- a/tests/test_nodes.vty
+++ b/tests/test_nodes.vty
@@ -69,7 +69,7 @@
   neighbor (a|iu) lac-ci <0-65535> <0-65535> (ran-pc|msc-ipa-name) RAN_PC_OR_MSC_IPA_NAME
   neighbor (a|iu) cgi <0-999> <0-999> <0-65535> <0-65535> (ran-pc|msc-ipa-name) RAN_PC_OR_MSC_IPA_NAME
   no neighbor (a|iu) (ran-pc|msc-ipa-name) RAN_PC_OR_MSC_IPA_NAME
-  timer [(mgw|mncc|sccp|geran|utran|sgs)] [TNNNN] [(<0-2147483647>|default)]
+  timer [(vlr|mgw|mncc|sccp|geran|utran|sgs)] [TNNNN] [(<0-2147483647>|default)]
   mgw local-ip A.B.C.D
   mgw local-port <0-65535>
   mgw remote-ip A.B.C.D