diff --git a/msc/BSC_ConnectionHandler.ttcn b/msc/BSC_ConnectionHandler.ttcn
index 1dd4d05..e951400 100644
--- a/msc/BSC_ConnectionHandler.ttcn
+++ b/msc/BSC_ConnectionHandler.ttcn
@@ -70,7 +70,11 @@
 	OCT1	kc_support,
 	boolean expect_tmsi,
 	boolean	expect_auth,
-	boolean	expect_ciph
+	boolean	expect_ciph,
+	boolean expect_imei,
+	boolean expect_imei_early,
+	GSUP_IMEIResult check_imei_result,
+	boolean check_imei_error
 }
 
 type record BSC_ConnHdlrPars {
@@ -433,6 +437,82 @@
 	}
 }
 
+function f_mm_imei() runs on BSC_ConnHdlr
+{
+	var PDU_DTAP_MT dtap_mt;
+	var GSUP_PDU gsup_msg;
+	var MobileL3_CommonIE_Types.MobileIdentityLV mi;
+
+	if (not g_pars.net.expect_imei) {
+		return
+	}
+
+	/* MSC <-> BSC: ID req/rsp for IMEI */
+	alt {
+	[] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_MM_ID_Req(CM_ID_TYPE_IMEI))) {
+		mi := valueof(ts_MI_IMEI_LV(g_pars.imei));
+		BSSAP.send(ts_PDU_DTAP_MO(ts_ML3_MO_MM_ID_Rsp(mi)));
+		}
+	[] BSSAP.receive(tr_PDU_DTAP_MT(?)) -> value dtap_mt {
+		setverdict(fail, "Expected ID REQ for IMEI DTAP MT message, but got: ", dtap_mt);
+		mtc.stop;
+		}
+	}
+
+	/* MSC <-> HLR: Check IMEI req/res/err */
+	alt {
+	[g_pars.net.check_imei_error] GSUP.receive(tr_GSUP_CHECK_IMEI_REQ(g_pars.imsi, g_pars.imei)) {
+		GSUP.send(ts_GSUP_CHECK_IMEI_ERR(g_pars.imsi, 96 /* Invalid Mandatory Information */));
+		}
+	[not g_pars.net.check_imei_error] GSUP.receive(tr_GSUP_CHECK_IMEI_REQ(g_pars.imsi, g_pars.imei)) {
+		GSUP.send(ts_GSUP_CHECK_IMEI_RES(g_pars.imsi, g_pars.net.check_imei_result));
+		}
+	[] GSUP.receive(?) -> value gsup_msg {
+		setverdict(fail, "Expected CHECK IMEI REQ GSUP message (with IMEI:", g_pars.imei, " and IMSI: ",
+			   g_pars.imsi, "), but got: ", gsup_msg);
+		mtc.stop;
+		}
+	}
+}
+
+function f_mm_imei_early() runs on BSC_ConnHdlr
+{
+	var PDU_DTAP_MT dtap_mt;
+	var GSUP_PDU gsup_msg;
+	var MobileL3_CommonIE_Types.MobileIdentityLV mi;
+
+	if (not g_pars.net.expect_imei_early) {
+		return
+	}
+
+	/* MSC <-> BSC: ID req/rsp for IMEISV */
+	alt {
+	[] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_MM_ID_Req(CM_ID_TYPE_IMEISV))) {
+		mi := valueof(ts_MI_IMEISV_LV(g_pars.imei));
+		BSSAP.send(ts_PDU_DTAP_MO(ts_ML3_MO_MM_ID_Rsp(mi)));
+		}
+	[] BSSAP.receive(tr_PDU_DTAP_MT(?)) -> value dtap_mt {
+		setverdict(fail, "Expected ID REQ for IMEISV DTAP MT message, but got: ", dtap_mt);
+		mtc.stop;
+		}
+	}
+
+	/* MSC <-> HLR: Check IMEI req/res/err */
+	alt {
+	[g_pars.net.check_imei_error] GSUP.receive(tr_GSUP_CHECK_IMEI_REQ(g_pars.imsi, g_pars.imei)) {
+		GSUP.send(ts_GSUP_CHECK_IMEI_ERR(g_pars.imsi, 96 /* Invalid Mandatory Information */));
+		}
+	[not g_pars.net.check_imei_error] GSUP.receive(tr_GSUP_CHECK_IMEI_REQ(g_pars.imsi, g_pars.imei)) {
+		GSUP.send(ts_GSUP_CHECK_IMEI_RES(g_pars.imsi, g_pars.net.check_imei_result));
+		}
+	[] GSUP.receive(?) -> value gsup_msg {
+		setverdict(fail, "Expected CHECK IMEI REQ GSUP message (with IMEI:", g_pars.imei, " and IMSI: ",
+			   g_pars.imsi, "), but got: ", gsup_msg);
+		mtc.stop;
+		}
+	}
+}
+
 function f_mm_common() runs on BSC_ConnHdlr
 {
 	f_mm_auth();
@@ -508,8 +588,10 @@
 		f_ranap_initial_ue(l3_lu);
 	}
 
+	f_mm_imei_early();
 	f_mm_common();
 	f_msc_lu_hlr();
+	f_mm_imei();
 	f_accept_reject_lu();
 	/* FIXME: there could be pending SMS or other common procedures by the MSC, let's ignore them */
 	f_expect_clear();
diff --git a/msc/MSC_Tests.ttcn b/msc/MSC_Tests.ttcn
index 6f9eecd..c7c96eb 100644
--- a/msc/MSC_Tests.ttcn
+++ b/msc/MSC_Tests.ttcn
@@ -335,6 +335,7 @@
 	/* set some defaults */
 	f_vty_config(MSCVTY, "network", "authentication optional");
 	f_vty_config(MSCVTY, "msc", "assign-tmsi");
+	f_vty_config(MSCVTY, "msc", "check-imei-rqd 0");
 	f_vty_config(MSCVTY, "network", "encryption a5 0");
 	if (mp_enable_osmux_test) {
 		if (osmux) {
@@ -367,7 +368,11 @@
 		kc_support := '0A'O,	/* A5/1 and A5/3 enabled */
 		expect_tmsi := true,
 		expect_auth := false,
-		expect_ciph := false
+		expect_ciph := false,
+		expect_imei := false,
+		expect_imei_early := false,
+		check_imei_result := OSMO_GSUP_IMEI_RESULT_ACK,
+		check_imei_error := false
 	};
 	var BSC_ConnHdlrPars pars := {
 		sccp_addr_own := g_bssap[ran_idx].sccp_addr_own,
@@ -5531,6 +5536,287 @@
 	vc_conn.done;
 }
 
+private function f_tc_lu_imsi_auth_tmsi_check_imei(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	pars.net.expect_auth := true;
+	pars.net.expect_imei := true;
+	f_init_handler(pars);
+	f_perform_lu();
+}
+testcase TC_lu_imsi_auth_tmsi_check_imei() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+	f_vty_config(MSCVTY, "network", "authentication required");
+	f_vty_config(MSCVTY, "msc", "check-imei-rqd 1");
+
+	vc_conn := f_start_handler(refers(f_tc_lu_imsi_auth_tmsi_check_imei), 5);
+	vc_conn.done;
+}
+
+private function f_tc_lu_imsi_auth3g_tmsi_check_imei(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	pars.net.expect_auth := true;
+	pars.use_umts_aka := true;
+	pars.net.expect_imei := true;
+	f_init_handler(pars);
+	f_perform_lu();
+}
+testcase TC_lu_imsi_auth3g_tmsi_check_imei() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+	f_vty_config(MSCVTY, "network", "authentication required");
+	f_vty_config(MSCVTY, "msc", "check-imei-rqd 1");
+
+	vc_conn := f_start_handler(refers(f_tc_lu_imsi_auth3g_tmsi_check_imei), 5);
+	vc_conn.done;
+}
+
+private function f_tc_lu_imsi_noauth_tmsi_check_imei(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	pars.net.expect_imei := true;
+	f_init_handler(pars);
+	f_perform_lu();
+}
+testcase TC_lu_imsi_noauth_tmsi_check_imei() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+	f_vty_config(MSCVTY, "msc", "check-imei-rqd 1");
+
+	vc_conn := f_start_handler(refers(f_tc_lu_imsi_noauth_tmsi_check_imei), 5);
+	vc_conn.done;
+}
+
+private function f_tc_lu_imsi_noauth_notmsi_check_imei(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	pars.net.expect_tmsi := false;
+	pars.net.expect_imei := true;
+	f_init_handler(pars);
+	f_perform_lu();
+}
+testcase TC_lu_imsi_noauth_notmsi_check_imei() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+	f_vty_config(MSCVTY, "msc", "no assign-tmsi");
+	f_vty_config(MSCVTY, "msc", "check-imei-rqd 1");
+
+	vc_conn := f_start_handler(refers(f_tc_lu_imsi_noauth_notmsi_check_imei), 5);
+	vc_conn.done;
+}
+
+private function f_tc_lu_imsi_auth_tmsi_check_imei_nack(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	var PDU_ML3_MS_NW l3_lu;
+	var PDU_DTAP_MT dtap_mt;
+
+	pars.net.expect_auth := true;
+	pars.net.expect_imei := true;
+	pars.net.check_imei_result := OSMO_GSUP_IMEI_RESULT_NACK;
+	f_init_handler(pars);
+
+	/* Cannot use f_perform_lu() as we expect a reject */
+	l3_lu := f_build_lu_imsi(g_pars.imsi)
+	f_create_gsup_expect(hex2str(g_pars.imsi));
+	f_bssap_compl_l3(l3_lu);
+	BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3));
+
+	f_mm_common();
+	f_msc_lu_hlr();
+	f_mm_imei();
+
+	/* Expect reject. As of writing, sometimes it passes, sometimes we get a broken pipe (race condition)! */
+	alt {
+	[] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Rej)) {
+		setverdict(pass);
+		}
+	[] BSSAP.receive(tr_PDU_DTAP_MT(?)) -> value dtap_mt {
+		setverdict(fail, "Expected LU reject BSSAP message, got: ", dtap_mt);
+		mtc.stop;
+		}
+	}
+}
+testcase TC_lu_imsi_auth_tmsi_check_imei_nack() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+	f_vty_config(MSCVTY, "network", "authentication required");
+	f_vty_config(MSCVTY, "msc", "check-imei-rqd 1");
+
+	vc_conn := f_start_handler(refers(f_tc_lu_imsi_auth_tmsi_check_imei_nack), 5);
+	vc_conn.done;
+}
+
+private function f_tc_lu_imsi_auth_tmsi_check_imei_err(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	var PDU_ML3_MS_NW l3_lu;
+	var PDU_DTAP_MT dtap_mt;
+
+	pars.net.expect_auth := true;
+	pars.net.expect_imei := true;
+	pars.net.check_imei_error := true;
+	f_init_handler(pars);
+
+	/* Cannot use f_perform_lu() as we expect a reject */
+	l3_lu := f_build_lu_imsi(g_pars.imsi)
+	f_create_gsup_expect(hex2str(g_pars.imsi));
+	f_bssap_compl_l3(l3_lu);
+	BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3));
+
+	f_mm_common();
+	f_msc_lu_hlr();
+	f_mm_imei();
+
+	/* Expect reject. As of writing, sometimes it passes, sometimes we get a broken pipe (race condition)! */
+	alt {
+	[] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Rej)) {
+		setverdict(pass);
+		}
+	[] BSSAP.receive(tr_PDU_DTAP_MT(?)) -> value dtap_mt {
+		setverdict(fail, "Expected LU reject BSSAP message, got: ", dtap_mt);
+		mtc.stop;
+		}
+	}
+}
+testcase TC_lu_imsi_auth_tmsi_check_imei_err() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+	f_vty_config(MSCVTY, "network", "authentication required");
+	f_vty_config(MSCVTY, "msc", "check-imei-rqd 1");
+
+	vc_conn := f_start_handler(refers(f_tc_lu_imsi_auth_tmsi_check_imei_err), 5);
+	vc_conn.done;
+}
+
+private function f_tc_lu_imsi_auth_tmsi_check_imei_early(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	pars.net.expect_auth := true;
+	pars.net.expect_imei_early := true;
+	f_init_handler(pars);
+	f_perform_lu();
+}
+testcase TC_lu_imsi_auth_tmsi_check_imei_early() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+	f_vty_config(MSCVTY, "network", "authentication required");
+	f_vty_config(MSCVTY, "msc", "check-imei-rqd early");
+
+	vc_conn := f_start_handler(refers(f_tc_lu_imsi_auth_tmsi_check_imei_early), 5);
+	vc_conn.done;
+}
+
+private function f_tc_lu_imsi_auth3g_tmsi_check_imei_early(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	pars.net.expect_auth := true;
+	pars.use_umts_aka := true;
+	pars.net.expect_imei_early := true;
+	f_init_handler(pars);
+	f_perform_lu();
+}
+testcase TC_lu_imsi_auth3g_tmsi_check_imei_early() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+	f_vty_config(MSCVTY, "network", "authentication required");
+	f_vty_config(MSCVTY, "msc", "check-imei-rqd early");
+
+	vc_conn := f_start_handler(refers(f_tc_lu_imsi_auth3g_tmsi_check_imei_early), 5);
+	vc_conn.done;
+}
+
+private function f_tc_lu_imsi_noauth_tmsi_check_imei_early(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	pars.net.expect_imei_early := true;
+	f_init_handler(pars);
+	f_perform_lu();
+}
+testcase TC_lu_imsi_noauth_tmsi_check_imei_early() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+	f_vty_config(MSCVTY, "msc", "check-imei-rqd early");
+
+	vc_conn := f_start_handler(refers(f_tc_lu_imsi_noauth_tmsi_check_imei_early), 5);
+	vc_conn.done;
+}
+
+private function f_tc_lu_imsi_noauth_notmsi_check_imei_early(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	pars.net.expect_tmsi := false;
+	pars.net.expect_imei_early := true;
+	f_init_handler(pars);
+	f_perform_lu();
+}
+testcase TC_lu_imsi_noauth_notmsi_check_imei_early() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+	f_vty_config(MSCVTY, "msc", "no assign-tmsi");
+	f_vty_config(MSCVTY, "msc", "check-imei-rqd early");
+
+	vc_conn := f_start_handler(refers(f_tc_lu_imsi_noauth_notmsi_check_imei_early), 5);
+	vc_conn.done;
+}
+
+private function f_tc_lu_imsi_auth_tmsi_check_imei_early_nack(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	var PDU_ML3_MS_NW l3_lu;
+	var PDU_DTAP_MT dtap_mt;
+
+	pars.net.expect_auth := true;
+	pars.net.expect_imei_early := true;
+	pars.net.check_imei_result := OSMO_GSUP_IMEI_RESULT_NACK;
+	f_init_handler(pars);
+
+	/* Cannot use f_perform_lu() as we expect a reject */
+	l3_lu := f_build_lu_imsi(g_pars.imsi)
+	f_create_gsup_expect(hex2str(g_pars.imsi));
+	f_bssap_compl_l3(l3_lu);
+	BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3));
+
+	f_mm_imei_early();
+
+	/* Expect reject */
+	alt {
+	[] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Rej)) {
+		setverdict(pass);
+		}
+	[] BSSAP.receive(tr_PDU_DTAP_MT(?)) -> value dtap_mt {
+		setverdict(fail, "Expected LU reject BSSAP message, got: ", dtap_mt);
+		mtc.stop;
+		}
+	}
+}
+testcase TC_lu_imsi_auth_tmsi_check_imei_early_nack() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+	f_vty_config(MSCVTY, "network", "authentication required");
+	f_vty_config(MSCVTY, "msc", "check-imei-rqd early");
+
+	vc_conn := f_start_handler(refers(f_tc_lu_imsi_auth_tmsi_check_imei_early_nack), 5);
+	vc_conn.done;
+}
+
+private function f_tc_lu_imsi_auth_tmsi_check_imei_early_err(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	var PDU_ML3_MS_NW l3_lu;
+	var PDU_DTAP_MT dtap_mt;
+
+	pars.net.expect_auth := true;
+	pars.net.expect_imei_early := true;
+	pars.net.check_imei_error := true;
+	f_init_handler(pars);
+
+	/* Cannot use f_perform_lu() as we expect a reject */
+	l3_lu := f_build_lu_imsi(g_pars.imsi)
+	f_create_gsup_expect(hex2str(g_pars.imsi));
+	f_bssap_compl_l3(l3_lu);
+	BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3));
+
+	f_mm_imei_early();
+
+	/* Expect reject */
+	alt {
+	[] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Rej)) {
+		setverdict(pass);
+		}
+	[] BSSAP.receive(tr_PDU_DTAP_MT(?)) -> value dtap_mt {
+		setverdict(fail, "Expected LU reject BSSAP message, got: ", dtap_mt);
+		mtc.stop;
+		}
+	}
+}
+testcase TC_lu_imsi_auth_tmsi_check_imei_early_err() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+	f_vty_config(MSCVTY, "network", "authentication required");
+	f_vty_config(MSCVTY, "msc", "check-imei-rqd early");
+
+	vc_conn := f_start_handler(refers(f_tc_lu_imsi_auth_tmsi_check_imei_early_err), 5);
+	vc_conn.done;
+}
 
 control {
 	execute( TC_cr_before_reset() );
@@ -5642,6 +5928,19 @@
 
 	execute( TC_ho_inter_msc_out() );
 
+	execute( TC_lu_imsi_auth_tmsi_check_imei() );
+	execute( TC_lu_imsi_auth3g_tmsi_check_imei() );
+	execute( TC_lu_imsi_noauth_tmsi_check_imei() );
+	execute( TC_lu_imsi_noauth_notmsi_check_imei() );
+	execute( TC_lu_imsi_auth_tmsi_check_imei_nack() );
+	execute( TC_lu_imsi_auth_tmsi_check_imei_err() );
+	execute( TC_lu_imsi_auth_tmsi_check_imei_early() );
+	execute( TC_lu_imsi_auth3g_tmsi_check_imei_early() );
+	execute( TC_lu_imsi_noauth_tmsi_check_imei_early() );
+	execute( TC_lu_imsi_noauth_notmsi_check_imei_early() );
+	execute( TC_lu_imsi_auth_tmsi_check_imei_early_nack() );
+	execute( TC_lu_imsi_auth_tmsi_check_imei_early_err() );
+
 	/* Run this last: at the time of writing this test crashes the MSC */
 	execute( TC_lu_imsi_auth_tmsi_encr_3_1_log_msc_debug() );
 	execute( TC_mo_cc_bssmap_clear() );
diff --git a/msc/expected-results.xml b/msc/expected-results.xml
index a60e2ec..ca8edd2 100644
--- a/msc/expected-results.xml
+++ b/msc/expected-results.xml
@@ -1,5 +1,5 @@
 <?xml version="1.0"?>
-<testsuite name='Titan' tests='84' failures='2' errors='1' skipped='0' inconc='0' time='MASKED'>
+<testsuite name='Titan' tests='96' failures='2' errors='3' skipped='0' inconc='0' time='MASKED'>
   <testcase classname='MSC_Tests' name='TC_cr_before_reset' time='MASKED'/>
   <testcase classname='MSC_Tests' name='TC_lu_imsi_noauth_tmsi' time='MASKED'/>
   <testcase classname='MSC_Tests' name='TC_lu_imsi_noauth_notmsi' time='MASKED'/>
@@ -97,4 +97,20 @@
   <testcase classname='MSC_Tests' name='TC_lu_imsi_auth_tmsi_encr_3_1_log_msc_debug' time='MASKED'/>
   <testcase classname='MSC_Tests' name='TC_gsup_mt_multi_part_sms' time='MASKED'/>
   <testcase classname='MSC_Tests' name='TC_mo_cc_bssmap_clear' time='MASKED'/>
+  <testcase classname='MSC_Tests' name='TC_lu_imsi_auth_tmsi_check_imei' time='MASKED'/>
+  <testcase classname='MSC_Tests' name='TC_lu_imsi_auth3g_tmsi_check_imei' time='MASKED'/>
+  <testcase classname='MSC_Tests' name='TC_lu_imsi_noauth_tmsi_check_imei' time='MASKED'/>
+  <testcase classname='MSC_Tests' name='TC_lu_imsi_noauth_notmsi_check_imei' time='MASKED'/>
+  <testcase classname='MSC_Tests' name='TC_lu_imsi_auth_tmsi_check_imei_nack' time='MASKED'/>
+    <error type='DTE'></error>
+  </testcase>
+  <testcase classname='MSC_Tests' name='TC_lu_imsi_auth_tmsi_check_imei_err' time='MASKED'/>
+    <error type='DTE'></error>
+  </testcase>
+  <testcase classname='MSC_Tests' name='TC_lu_imsi_auth_tmsi_check_imei_early' time='MASKED'/>
+  <testcase classname='MSC_Tests' name='TC_lu_imsi_auth3g_tmsi_check_imei_early' time='MASKED'/>
+  <testcase classname='MSC_Tests' name='TC_lu_imsi_noauth_tmsi_check_imei_early' time='MASKED'/>
+  <testcase classname='MSC_Tests' name='TC_lu_imsi_noauth_notmsi_check_imei_early' time='MASKED'/>
+  <testcase classname='MSC_Tests' name='TC_lu_imsi_auth_tmsi_check_imei_early_nack' time='MASKED'/>
+  <testcase classname='MSC_Tests' name='TC_lu_imsi_auth_tmsi_check_imei_early_err' time='MASKED'/>
 </testsuite>