diff --git a/hlr/HLR_Tests.ttcn b/hlr/HLR_Tests.ttcn
index c1cc129..5e9eea6 100644
--- a/hlr/HLR_Tests.ttcn
+++ b/hlr/HLR_Tests.ttcn
@@ -36,6 +36,7 @@
 import from MSLookup_mDNS_Templates all;
 
 type component test_CT extends CTRL_Adapter_CT {
+	/* emulated GSUP client (MSC/SGSN) */
 	var IPA_Emulation_CT vc_IPA;
 	var IPA_CCM_Parameters ccm_pars;
 	/* legacy tests without ConnHdlr */
@@ -49,10 +50,15 @@
 
 	var MSLookup_mDNS_Emulation_CT vc_MSLookup_mDNS;
 
+	/* emulated GSUP server (second HLR) */
+	var IPA_Emulation_CT vc_IPA_server;
+	var GSUP_Emulation_CT vc_GSUP_server;
+
 	timer g_Tguard := 10.0;
 };
 
 modulepar {
+	/* OsmoHLR */
 	charstring mp_hlr_ip := "127.0.0.1";
 	integer mp_hlr_gsup_port := 4222;
 	integer mp_hlr_ctrl_port := 4259;
@@ -60,6 +66,10 @@
 	   when IE ts_GSUP_IE_NUM_VECTORS_REQ is absent */
 	integer mp_default_num_auth_tuples := 5;
 
+	/* emulated GSUP server (second HLR) */
+	charstring mp_hlr_ts_ip := "127.0.0.99";
+	integer mp_hlr_ts_port := 4222;
+
 	/* drop after osmo-hlr release > 1.2.0 */
 	boolean mp_hlr_supports_dgsm := true;
 };
@@ -90,6 +100,11 @@
 	var HLR_ConnHdlrPars g_pars;
 	port TELNETasp_PT VTY;
 	port MSLookup_mDNS_PT mDNS;
+
+	/* Pass from test_CT for explicit addressing */
+	var GSUP_Emulation_CT vc_GSUP_server;
+	var GSUP_Emulation_CT vc_GSUP_client;
+	var IPA_CCM_Parameters ccm_pars_client;
 }
 
 type record HLR_ConnHdlrPars {
@@ -138,6 +153,7 @@
 	}
 }
 
+/* emulated GSUP client (MSC/SGSN) */
 function f_init_gsup(charstring id, boolean legacy) runs on test_CT {
 	id := id & "-GSUP";
 	var GsupOps ops := {
@@ -180,12 +196,29 @@
 	}
 }
 
+/* emulated GSUP server (second HLR) */
+function f_init_gsup_server(charstring id) runs on test_CT {
+	id := id & "-GSUP-server";
+	var GsupOps ops := {
+		create_cb := refers(GSUP_Emulation.ExpectedCreateCallback)
+	}
+
+	vc_GSUP_server := GSUP_Emulation_CT.create(id);
+	vc_IPA_server := IPA_Emulation_CT.create(id & "-IPA");
+
+	connect(vc_GSUP_server:GSUP, vc_IPA_server:IPA_GSUP_PORT);
+	map(vc_IPA_server:IPA_PORT, system:IPA_CODEC_PT);
+
+	vc_GSUP_server.start(GSUP_Emulation.main(ops, id));
+	vc_IPA_server.start(IPA_Emulation.main_server(mp_hlr_ts_ip, mp_hlr_ts_port));
+}
+
 function f_init_mslookup() runs on test_CT {
 	vc_MSLookup_mDNS := MSLookup_mDNS_Emulation_CT.create;
 	vc_MSLookup_mDNS.start(MSLookup_mDNS_Emulation.f_main());
 }
 
-function f_init(boolean legacy := true) runs on test_CT {
+function f_init(boolean legacy := true, boolean gsup_server := false) runs on test_CT {
 
 	/* activate default guard timer to ensure all tests eventually terminate */
 	g_Tguard.start;
@@ -195,10 +228,20 @@
 	f_init_vty();
 	f_init_mslookup();
 
+	if (gsup_server) {
+		f_init_gsup_server("HLR_Test");
+	}
+
 	f_ipa_ctrl_start(mp_hlr_ip, mp_hlr_ctrl_port);
 }
 
-function f_start_handler(void_fn fn, HLR_ConnHdlrPars pars) runs on test_CT return HLR_ConnHdlr {
+/*! Start HLR_ConnHdlr from testCT in a separate thread.
+ * \param void_fn  function to run inside the thread.
+ * \param gsup_server  if true, connect the emulated GSUP server ports to the new HLR_ConnHdlr. Then both the emulated
+ *                     GSUP client (MSC/SGSN) and server (second HLR) are connected. Explicit addressing with "to" and
+ *                     "from" must be used, i.e. 'GSUP.receive(tr_GSUP_UL_REQ(...)) from vc_GSUP_server'. */
+function f_start_handler(void_fn fn, HLR_ConnHdlrPars pars, boolean gsup_server := false) runs on test_CT
+return HLR_ConnHdlr {
 	var HLR_ConnHdlr vc_conn;
 	var charstring id := testcasename();
 
@@ -207,7 +250,14 @@
 	connect(vc_conn:GSUP_PROC, vc_GSUP:GSUP_PROC);
 	connect(vc_conn:mDNS, vc_MSLookup_mDNS:mDNS);
 
-	vc_conn.start(f_handler_init(fn, id, pars));
+	if (gsup_server) {
+		connect(vc_conn:GSUP, vc_GSUP_server:GSUP_CLIENT);
+		connect(vc_conn:GSUP_PROC, vc_GSUP_server:GSUP_PROC);
+		vc_conn.start(f_handler_init(fn, id, vc_GSUP_server, vc_GSUP, ccm_pars, pars));
+	} else {
+		vc_conn.start(f_handler_init(fn, id, omit, vc_GSUP, ccm_pars, pars));
+	}
+
 	return vc_conn;
 }
 
@@ -218,12 +268,23 @@
 }
 
 /* first function inside ConnHdlr component; sets g_pars + starts function */
-function f_handler_init(void_fn fn, charstring id, template (omit) HLR_ConnHdlrPars pars := omit)
+function f_handler_init(void_fn fn, charstring id,
+			template (omit) GSUP_Emulation_CT vc_GSUP_server_test_ct,
+			GSUP_Emulation_CT vc_GSUP_client_test_ct,
+			IPA_CCM_Parameters ccm_pars_client_test_ct,
+			template (omit) HLR_ConnHdlrPars pars := omit)
 runs on HLR_ConnHdlr
 {
+	/* Pass from test_CT for explicit addressing */
+	if (isvalue(vc_GSUP_server_test_ct)) {
+		vc_GSUP_server := valueof(vc_GSUP_server_test_ct);
+	}
+	vc_GSUP_client := vc_GSUP_client_test_ct;
+	ccm_pars_client := ccm_pars_client_test_ct;
+
 	if (isvalue(pars)) {
 		g_pars := valueof(pars);
-		f_create_gsup_expect(hex2str(g_pars.sub.imsi));
+		f_create_gsup_expect_explicit(hex2str(g_pars.sub.imsi), vc_GSUP_client);
 	}
 	f_handler_init_vty();
 	fn.apply();