diff --git a/openbsc/include/openbsc/ipaccess.h b/openbsc/include/openbsc/ipaccess.h
index d3c9d1dca..a25a348b6 100644
--- a/openbsc/include/openbsc/ipaccess.h
+++ b/openbsc/include/openbsc/ipaccess.h
@@ -11,7 +11,8 @@ struct ipac_msgt_sccp_state {
 	uint8_t	dst_ref[3];
 	uint8_t trans_id;
 	uint8_t invoke_id;
-	char		imsi[GSM_IMSI_LENGTH];
+	char	imsi[GSM_IMSI_LENGTH];
+	uint8_t data[0];
 } __attribute__((packed));
 
 /*
diff --git a/openbsc/src/osmo-bsc_nat/bsc_ussd.c b/openbsc/src/osmo-bsc_nat/bsc_ussd.c
index f972ba5ef..59f76e458 100644
--- a/openbsc/src/osmo-bsc_nat/bsc_ussd.c
+++ b/openbsc/src/osmo-bsc_nat/bsc_ussd.c
@@ -38,6 +38,9 @@
 #include <string.h>
 #include <unistd.h>
 
+#define USSD_LAC_IE	0
+#define USSD_CI_IE	1
+
 static void ussd_auth_con(struct tlv_parsed *, struct bsc_nat_ussd_con *);
 
 static struct bsc_nat_ussd_con *bsc_nat_ussd_alloc(struct bsc_nat *nat)
@@ -292,6 +295,7 @@ static int forward_ussd(struct nat_sccp_connection *con, const struct ussd_reque
 	struct msgb *msg, *copy;
 	struct ipac_msgt_sccp_state *state;
 	struct bsc_nat_ussd_con *ussd;
+	uint16_t lac, ci;
 
 	if (!con->bsc->nat->ussd_con)
 		return -1;
@@ -323,6 +327,12 @@ static int forward_ussd(struct nat_sccp_connection *con, const struct ussd_reque
 	memcpy(&state->dst_ref, &con->real_ref, sizeof(con->real_ref));
 	memcpy(state->imsi, con->imsi, strlen(con->imsi));
 
+	/* add additional tag/values */
+	lac = htons(con->lac);
+	ci = htons(con->ci);
+	msgb_tv_fixed_put(msg, USSD_LAC_IE, sizeof(lac), &lac);
+	msgb_tv_fixed_put(msg, USSD_CI_IE, sizeof(ci), &ci);
+
 	ussd = con->bsc->nat->ussd_con;
 	bsc_do_write(&ussd->queue, msg, IPAC_PROTO_IPACCESS);
 	bsc_do_write(&ussd->queue, copy, IPAC_PROTO_SCCP);