diff --git a/msc_tests/MSC_Tests.ttcn b/msc_tests/MSC_Tests.ttcn
index a21ad50..c2d1771 100644
--- a/msc_tests/MSC_Tests.ttcn
+++ b/msc_tests/MSC_Tests.ttcn
@@ -620,6 +620,98 @@
 	vc_conn.done;
 }
 
+/* Test LU but with illegal mobile identity type = IMEI */
+private function f_tc_lu_by_imei(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	g_pars := pars;
+
+	var PDU_ML3_MS_NW l3_lu := f_build_lu_imei(g_pars.imsi)
+	var PDU_DTAP_MT dtap_mt;
+
+	/* tell GSUP dispatcher to send this IMSI to us */
+	f_create_gsup_expect(hex2str(g_pars.imsi));
+
+	/* Send BSSAP_Conn_Req with COMPL L3 INFO to MSC */
+	f_bssap_compl_l3(l3_lu);
+
+	/* Send Early Classmark, just for the fun of it */
+	BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3));
+	/* wait for LU reject, ignore any ID REQ */
+	alt {
+	[] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Rej)) { }
+	[] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_MM_ID_Req)) { repeat; }
+	}
+	/* wait for normal teardown */
+	BSSAP.receive(tr_BSSMAP_ClearCommand);
+	BSSAP.send(ts_BSSMAP_ClearComplete);
+	BSSAP.receive(BSSAP_Conn_Prim:MSC_CONN_PRIM_DISC_IND);
+	setverdict(pass);
+}
+testcase TC_lu_by_imei() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+
+	vc_conn := f_start_handler(refers(f_tc_lu_by_imei), testcasename(), 9);
+	vc_conn.done;
+}
+
+/* Test LU by TMSI with unknown TMSI, expect (and answer) ID REQ. */
+private function f_tc_lu_tmsi_noauth_unknown(charstring id, BSC_ConnHdlrPars pars) runs on BSC_ConnHdlr {
+	g_pars := pars;
+
+	var PDU_ML3_MS_NW l3_lu := f_build_lu_tmsi('01020304'O); /* FIXME: Random */
+	var PDU_DTAP_MT dtap_mt;
+
+	/* tell GSUP dispatcher to send this IMSI to us */
+	f_create_gsup_expect(hex2str(g_pars.imsi));
+
+	/* Send BSSAP_Conn_Req with COMPL L3 INFO to MSC */
+	f_bssap_compl_l3(l3_lu);
+
+	/* Send Early Classmark, just for the fun of it */
+	BSSAP.send(ts_BSSMAP_ClassmarkUpd(g_pars.cm2, g_pars.cm3));
+
+	/* Wait for + respond to ID REQ (IMSI) */
+	BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_MM_ID_Req('001'B)));
+	BSSAP.send(ts_PDU_DTAP_MO(ts_ML3_MO_MM_ID_Rsp_IMSI(g_pars.imsi)));
+
+	/* Expect MSC to do UpdateLocation to HLR; respond to it */
+	GSUP.receive(tr_GSUP_UL_REQ(g_pars.imsi));
+	GSUP.send(ts_GSUP_ISD_REQ(g_pars.imsi, g_pars.msisdn));
+	GSUP.receive(tr_GSUP_ISD_RES(g_pars.imsi));
+	GSUP.send(ts_GSUP_UL_RES(g_pars.imsi));
+
+	alt {
+	[] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Acc)) { }
+	[] BSSAP.receive(tr_PDU_DTAP_MT(tr_ML3_MT_LU_Rej)) {
+		setverdict(fail, "Expected LU ACK, but received REJ");
+		}
+	}
+
+	/* wait for normal teardown */
+	BSSAP.receive(tr_BSSMAP_ClearCommand);
+	BSSAP.send(ts_BSSMAP_ClearComplete);
+	BSSAP.receive(BSSAP_Conn_Prim:MSC_CONN_PRIM_DISC_IND);
+	setverdict(pass);
+}
+testcase TC_lu_by_tmsi_noauth_unknown() runs on MTC_CT {
+	var BSC_ConnHdlr vc_conn;
+	f_init();
+
+	vc_conn := f_start_handler(refers(f_tc_lu_tmsi_noauth_unknown), testcasename(), 1);
+	vc_conn.done;
+}
+
+
+/* TODO:
+   * continue to send repeated MO signalling messages to keep channel open: does MSC tmeout?
+   * malformed messages (missing IE, invalid message type): properly rejected?
+   * MT call while LU or is ongoing: Do we use existing lchan or page while lchan active?
+   * 3G/2G auth permutations
+   * encryption algorithms vs. classmark vs. vty config
+   * emergency call
+   * IMSI DETACH
+   * send new transaction after/during clear (like SMS, ...)
+ */
 
 
 control {