diff --git a/api/current.txt b/api/current.txt
index 9673b33..b76a971 100644
--- a/api/current.txt
+++ b/api/current.txt
@@ -33,6 +33,11 @@
 
   public abstract static class EapSessionConfig.EapMethodConfig {
     method public int getMethodType();
+    field public static final int EAP_TYPE_AKA = 23; // 0x17
+    field public static final int EAP_TYPE_AKA_PRIME = 50; // 0x32
+    field public static final int EAP_TYPE_MSCHAP_V2 = 26; // 0x1a
+    field public static final int EAP_TYPE_SIM = 18; // 0x12
+    field public static final int EAP_TYPE_TTLS = 21; // 0x15
   }
 
   public static class EapSessionConfig.EapMsChapV2Config extends android.net.eap.EapSessionConfig.EapMethodConfig {
diff --git a/src/java/android/net/eap/EapSessionConfig.java b/src/java/android/net/eap/EapSessionConfig.java
index ff42b6f..2a09cd3 100644
--- a/src/java/android/net/eap/EapSessionConfig.java
+++ b/src/java/android/net/eap/EapSessionConfig.java
@@ -377,7 +377,6 @@
          * @see <a href="https://tools.ietf.org/html/rfc4186">RFC 4186, Extensible Authentication
          *     Protocol Method for Global System for Mobile Communications (GSM) Subscriber Identity
          *     Modules (EAP-SIM)</a>
-         * @hide
          */
         public static final int EAP_TYPE_SIM = 18;
 
@@ -390,7 +389,6 @@
          * @see <a href="https://tools.ietf.org/html/rfc5281">RFC 5281, Extensible Authentication
          *     Protocol Tunneled Transport Layer Security Authenticated Protocol Version 0
          *     (EAP-TTLSv0)</a>
-         * @hide
          */
         public static final int EAP_TYPE_TTLS = 21;
 
@@ -402,7 +400,6 @@
          *
          * @see <a href="https://tools.ietf.org/html/rfc4187">RFC 4187, Extensible Authentication
          *     Protocol Method for 3rd Generation Authentication and Key Agreement (EAP-AKA)</a>
-         * @hide
          */
         public static final int EAP_TYPE_AKA = 23;
 
@@ -414,7 +411,6 @@
          *
          * @see <a href="https://tools.ietf.org/html/draft-kamath-pppext-eap-mschapv2-02">Microsoft
          *     EAP CHAP Extensions Draft (EAP MSCHAPv2)</a>
-         * @hide
          */
         public static final int EAP_TYPE_MSCHAP_V2 = 26;
 
@@ -427,7 +423,6 @@
          * @see <a href="https://tools.ietf.org/html/rfc5448">RFC 5448, Improved Extensible
          *     Authentication Protocol Method for 3rd Generation Authentication and Key Agreement
          *     (EAP-AKA')</a>
-         * @hide
          */
         public static final int EAP_TYPE_AKA_PRIME = 50;
 
diff --git a/tests/cts/src/android/ipsec/ike/cts/IkeSessionDigitalSignatureTest.java b/tests/cts/src/android/ipsec/ike/cts/IkeSessionDigitalSignatureTest.java
index b66316a..b616661 100644
--- a/tests/cts/src/android/ipsec/ike/cts/IkeSessionDigitalSignatureTest.java
+++ b/tests/cts/src/android/ipsec/ike/cts/IkeSessionDigitalSignatureTest.java
@@ -150,7 +150,7 @@
     private IkeSession openIkeSessionWithRemoteAddress(InetAddress remoteAddress) {
         IkeSessionParams ikeParams =
                 new IkeSessionParams.Builder(sContext)
-                        .setNetwork(mTunNetwork)
+                        .setNetwork(mTunNetworkContext.tunNetwork)
                         .setServerHostname(remoteAddress.getHostAddress())
                         .addSaProposal(SaProposalTest.buildIkeSaProposalWithNormalModeCipher())
                         .addSaProposal(SaProposalTest.buildIkeSaProposalWithCombinedModeCipher())
diff --git a/tests/cts/src/android/ipsec/ike/cts/IkeSessionMobikeTest.java b/tests/cts/src/android/ipsec/ike/cts/IkeSessionMobikeTest.java
new file mode 100644
index 0000000..ce27be7
--- /dev/null
+++ b/tests/cts/src/android/ipsec/ike/cts/IkeSessionMobikeTest.java
@@ -0,0 +1,115 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.ipsec.ike.cts;
+
+import static org.junit.Assert.assertFalse;
+
+import android.net.ipsec.ike.IkeSession;
+import android.net.ipsec.ike.IkeSessionConfiguration;
+import android.net.ipsec.ike.IkeSessionParams;
+import android.platform.test.annotations.AppModeFull;
+
+import androidx.test.ext.junit.runners.AndroidJUnit4;
+
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import java.net.InetAddress;
+
+@RunWith(AndroidJUnit4.class)
+@AppModeFull(reason = "MANAGE_IPSEC_TUNNELS permission can't be granted to instant apps")
+public class IkeSessionMobikeTest extends IkeSessionPskTestBase {
+    private TunNetworkContext mSecondaryTunNetworkContext;
+
+    private InetAddress mSecondaryLocalAddr;
+
+    private IkeSession mIkeSession;
+
+    @Before
+    public void setUp() throws Exception {
+        super.setUp();
+
+        mSecondaryLocalAddr = getNextAvailableIpv4AddressLocal();
+
+        mSecondaryTunNetworkContext = new TunNetworkContext(mSecondaryLocalAddr);
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        mSecondaryTunNetworkContext.tearDown();
+
+        if (mIkeSession != null) {
+            mIkeSession.kill();
+        }
+
+        super.tearDown();
+    }
+
+    @Override
+    protected IkeSessionParams getIkeSessionParams(InetAddress remoteAddress) {
+        return createIkeParamsBuilderBase(remoteAddress)
+                .addIkeOption(IkeSessionParams.IKE_OPTION_MOBIKE)
+                .build();
+    }
+
+    @Test(expected = IllegalStateException.class)
+    public void testSetNetworkWithoutMobikeEnabled() throws Exception {
+        if (!hasTunnelsFeature()) return;
+
+        final String ikeInitResp =
+                "46B8ECA1E0D72A18B45427679F9245D421202220000000000000015022000030"
+                        + "0000002C010100040300000C0100000C800E0080030000080300000203000008"
+                        + "0200000200000008040000022800008800020000A7AA3435D088EC1A2B7C2A47"
+                        + "1FA1B85F1066C9B2006E7C353FB5B5FDBC2A88347ED2C6F5B7A265D03AE34039"
+                        + "6AAC0145CFCC93F8BDB219DDFF22A603B8856A5DC59B6FAB7F17C5660CF38670"
+                        + "8794FC72F273ADEB7A4F316519794AED6F8AB61F95DFB360FAF18C6C8CABE471"
+                        + "6E18FE215348C2E582171A57FC41146B16C4AFE429000024A634B61C0E5C90C6"
+                        + "8D8818B0955B125A9B1DF47BBD18775710792E651083105C2900001C00004004"
+                        + "406FA3C5685A16B9B72C7F2EEE9993462C619ABE2900001C00004005AF905A87"
+                        + "0A32222AA284A7070585601208A282F0290000080000402E290000100000402F"
+                        + "00020003000400050000000800004014";
+        final String IkeAuthRespWithoutMobikeSupport =
+                "46B8ECA1E0D72A18B45427679F9245D42E20232000000001000000EC240000D0"
+                        + "0D06D37198F3F0962DE8170D66F1A9008267F98CDD956D984BDCED2FC7FAF84A"
+                        + "A6664EF25049B46B93C9ED420488E0C172AA6635BF4011C49792EF2B88FE7190"
+                        + "E8859FEEF51724FD20C46E7B9A9C3DC4708EF7005707A18AB747C903ABCEAC5C"
+                        + "6ECF5A5FC13633DCE3844A920ED10EF202F115DBFBB5D6D2D7AB1F34EB08DE7C"
+                        + "A54DCE0A3A582753345CA2D05A0EFDB9DC61E81B2483B7D13EEE0A815D37252C"
+                        + "23D2F29E9C30658227D2BB0C9E1A481EAA80BC6BE9006BEDC13E925A755A0290"
+                        + "AEC4164D29997F52ED7DCC2E";
+
+        // Open IKE Session
+        mIkeSession = openIkeSessionWithTunnelModeChild(mRemoteAddress);
+        performSetupIkeAndFirstChildBlocking(ikeInitResp, IkeAuthRespWithoutMobikeSupport);
+
+        verifyIkeSessionSetupBlocking();
+
+        final IkeSessionConfiguration ikeConfig = mIkeSessionCallback.awaitIkeConfig();
+        assertFalse(ikeConfig.isIkeExtensionEnabled(IkeSessionConfiguration.EXTENSION_TYPE_MOBIKE));
+
+        // manually change network when MOBIKE is not enabled
+        mIkeSession.setNetwork(mSecondaryTunNetworkContext.tunNetwork);
+    }
+
+    /** The MOBIKE spec explicitly disallows Transport mode. */
+    @Test(expected = IllegalArgumentException.class)
+    public void testStartSessionWithMobikeAndTransportMode() {
+        mIkeSession = openIkeSessionWithTransportModeChild(mRemoteAddress);
+    }
+}
diff --git a/tests/cts/src/android/ipsec/ike/cts/IkeSessionMschapV2Test.java b/tests/cts/src/android/ipsec/ike/cts/IkeSessionMschapV2Test.java
index 07584c5..a7a0904 100644
--- a/tests/cts/src/android/ipsec/ike/cts/IkeSessionMschapV2Test.java
+++ b/tests/cts/src/android/ipsec/ike/cts/IkeSessionMschapV2Test.java
@@ -148,7 +148,7 @@
     private IkeSession openIkeSessionWithRemoteAddress(InetAddress remoteAddress) {
         IkeSessionParams ikeParams =
                 new IkeSessionParams.Builder(sContext)
-                        .setNetwork(mTunNetwork)
+                        .setNetwork(mTunNetworkContext.tunNetwork)
                         .setServerHostname(remoteAddress.getHostAddress())
                         .addSaProposal(SaProposalTest.buildIkeSaProposalWithNormalModeCipher())
                         .addSaProposal(SaProposalTest.buildIkeSaProposalWithCombinedModeCipher())
@@ -171,30 +171,30 @@
         // Open IKE Session
         IkeSession ikeSession = openIkeSessionWithRemoteAddress(mRemoteAddress);
         int expectedMsgId = 0;
-        mTunUtils.awaitReqAndInjectResp(
+        mTunNetworkContext.tunUtils.awaitReqAndInjectResp(
                 IKE_DETERMINISTIC_INITIATOR_SPI,
                 expectedMsgId++,
                 false /* expectedUseEncap */,
                 IKE_INIT_RESP);
 
-        mTunUtils.awaitReqAndInjectResp(
+        mTunNetworkContext.tunUtils.awaitReqAndInjectResp(
                 IKE_DETERMINISTIC_INITIATOR_SPI,
                 expectedMsgId++,
                 true /* expectedUseEncap */,
                 IKE_AUTH_RESP_1_FRAG_1,
                 IKE_AUTH_RESP_1_FRAG_2);
 
-        mTunUtils.awaitReqAndInjectResp(
+        mTunNetworkContext.tunUtils.awaitReqAndInjectResp(
                 IKE_DETERMINISTIC_INITIATOR_SPI,
                 expectedMsgId++,
                 true /* expectedUseEncap */,
                 IKE_AUTH_RESP_2);
-        mTunUtils.awaitReqAndInjectResp(
+        mTunNetworkContext.tunUtils.awaitReqAndInjectResp(
                 IKE_DETERMINISTIC_INITIATOR_SPI,
                 expectedMsgId++,
                 true /* expectedUseEncap */,
                 IKE_AUTH_RESP_3);
-        mTunUtils.awaitReqAndInjectResp(
+        mTunNetworkContext.tunUtils.awaitReqAndInjectResp(
                 IKE_DETERMINISTIC_INITIATOR_SPI,
                 expectedMsgId++,
                 true /* expectedUseEncap */,
diff --git a/tests/cts/src/android/ipsec/ike/cts/IkeSessionParamsTest.java b/tests/cts/src/android/ipsec/ike/cts/IkeSessionParamsTest.java
index 3f26788..e4d11fe 100644
--- a/tests/cts/src/android/ipsec/ike/cts/IkeSessionParamsTest.java
+++ b/tests/cts/src/android/ipsec/ike/cts/IkeSessionParamsTest.java
@@ -49,7 +49,6 @@
 
 import com.android.internal.net.ipsec.test.ike.testutils.CertUtils;
 
-import org.junit.After;
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
@@ -110,8 +109,7 @@
 
     @Before
     public void setUp() throws Exception {
-        // This address is never used except for setting up the test network
-        setUpTestNetwork(IPV4_ADDRESS_LOCAL);
+        super.setUp();
 
         mServerCaCert = CertUtils.createCertFromPemFile("server-a-self-signed-ca.pem");
         mClientEndCert = CertUtils.createCertFromPemFile("client-a-end-cert.pem");
@@ -122,11 +120,6 @@
         mClientPrivateKey = CertUtils.createRsaPrivateKeyFromKeyFile("client-a-private-key.key");
     }
 
-    @After
-    public void tearDown() throws Exception {
-        tearDownTestNetwork();
-    }
-
     private static EapSessionConfig.Builder createEapOnlySafeMethodsBuilder() {
         return new EapSessionConfig.Builder()
                 .setEapIdentity(EAP_IDENTITY)
@@ -144,7 +137,7 @@
      */
     private IkeSessionParams.Builder createIkeParamsBuilderMinimum() {
         return new IkeSessionParams.Builder(sContext)
-                .setNetwork(mTunNetwork)
+                .setNetwork(mTunNetworkContext.tunNetwork)
                 .setServerHostname(IPV4_ADDRESS_REMOTE.getHostAddress())
                 .addSaProposal(SA_PROPOSAL)
                 .setLocalIdentification(LOCAL_ID)
@@ -158,7 +151,7 @@
      * @see #createIkeParamsBuilderMinimum
      */
     private void verifyIkeParamsMinimum(IkeSessionParams sessionParams) {
-        assertEquals(mTunNetwork, sessionParams.getNetwork());
+        assertEquals(mTunNetworkContext.tunNetwork, sessionParams.getNetwork());
         assertEquals(IPV4_ADDRESS_REMOTE.getHostAddress(), sessionParams.getServerHostname());
         assertEquals(Arrays.asList(SA_PROPOSAL), sessionParams.getSaProposals());
         assertEquals(LOCAL_ID, sessionParams.getLocalIdentification());
@@ -292,7 +285,7 @@
      */
     private IkeSessionParams.Builder createIkeParamsBuilderMinimumWithoutAuth() {
         return new IkeSessionParams.Builder(sContext)
-                .setNetwork(mTunNetwork)
+                .setNetwork(mTunNetworkContext.tunNetwork)
                 .setServerHostname(IPV4_ADDRESS_REMOTE.getHostAddress())
                 .addSaProposal(SA_PROPOSAL)
                 .setLocalIdentification(LOCAL_ID)
@@ -306,13 +299,22 @@
      * @see #createIkeParamsBuilderMinimumWithoutAuth
      */
     private void verifyIkeParamsMinimumWithoutAuth(IkeSessionParams sessionParams) {
-        assertEquals(mTunNetwork, sessionParams.getNetwork());
+        assertEquals(mTunNetworkContext.tunNetwork, sessionParams.getNetwork());
         assertEquals(IPV4_ADDRESS_REMOTE.getHostAddress(), sessionParams.getServerHostname());
         assertEquals(Arrays.asList(SA_PROPOSAL), sessionParams.getSaProposals());
         assertEquals(LOCAL_ID, sessionParams.getLocalIdentification());
         assertEquals(REMOTE_ID, sessionParams.getRemoteIdentification());
     }
 
+    private void verifyIkeParamsWithPsk(IkeSessionParams sessionParams) {
+        IkeAuthConfig localConfig = sessionParams.getLocalAuthConfig();
+        assertTrue(localConfig instanceof IkeAuthPskConfig);
+        assertArrayEquals(IKE_PSK, ((IkeAuthPskConfig) localConfig).getPsk());
+        IkeAuthConfig remoteConfig = sessionParams.getRemoteAuthConfig();
+        assertTrue(remoteConfig instanceof IkeAuthPskConfig);
+        assertArrayEquals(IKE_PSK, ((IkeAuthPskConfig) remoteConfig).getPsk());
+    }
+
     @Test
     public void testBuildWithPsk() throws Exception {
         IkeSessionParams sessionParams =
@@ -320,12 +322,21 @@
 
         verifyIkeParamsMinimumWithoutAuth(sessionParams);
 
-        IkeAuthConfig localConfig = sessionParams.getLocalAuthConfig();
-        assertTrue(localConfig instanceof IkeAuthPskConfig);
-        assertArrayEquals(IKE_PSK, ((IkeAuthPskConfig) localConfig).getPsk());
-        IkeAuthConfig remoteConfig = sessionParams.getRemoteAuthConfig();
-        assertTrue(remoteConfig instanceof IkeAuthPskConfig);
-        assertArrayEquals(IKE_PSK, ((IkeAuthPskConfig) remoteConfig).getPsk());
+        verifyIkeParamsWithPsk(sessionParams);
+    }
+
+    @Test
+    public void testBuildWithPskMobikeEnabled() throws Exception {
+        IkeSessionParams sessionParams =
+                createIkeParamsBuilderMinimumWithoutAuth()
+                        .setAuthPsk(IKE_PSK)
+                        .addIkeOption(IkeSessionParams.IKE_OPTION_MOBIKE)
+                        .build();
+
+        verifyIkeParamsMinimumWithoutAuth(sessionParams);
+
+        verifyIkeParamsWithPsk(sessionParams);
+        assertTrue(sessionParams.hasIkeOption(IkeSessionParams.IKE_OPTION_MOBIKE));
     }
 
     @Test
diff --git a/tests/cts/src/android/ipsec/ike/cts/IkeSessionPskTest.java b/tests/cts/src/android/ipsec/ike/cts/IkeSessionPskTest.java
index b9b710d..9e8e722 100644
--- a/tests/cts/src/android/ipsec/ike/cts/IkeSessionPskTest.java
+++ b/tests/cts/src/android/ipsec/ike/cts/IkeSessionPskTest.java
@@ -16,7 +16,6 @@
 
 package android.ipsec.ike.cts;
 
-import static android.app.AppOpsManager.OP_MANAGE_IPSEC_TUNNELS;
 import static android.net.ipsec.ike.exceptions.IkeProtocolException.ERROR_TYPE_AUTHENTICATION_FAILED;
 import static android.net.ipsec.ike.exceptions.IkeProtocolException.ERROR_TYPE_NO_PROPOSAL_CHOSEN;
 import static android.net.ipsec.ike.exceptions.IkeProtocolException.ERROR_TYPE_TS_UNACCEPTABLE;
@@ -25,8 +24,6 @@
 import static org.junit.Assert.assertEquals;
 
 import android.net.LinkAddress;
-import android.net.ipsec.ike.ChildSessionParams;
-import android.net.ipsec.ike.IkeFqdnIdentification;
 import android.net.ipsec.ike.IkeSession;
 import android.net.ipsec.ike.IkeSessionParams;
 import android.net.ipsec.ike.exceptions.IkeProtocolException;
@@ -34,8 +31,6 @@
 
 import androidx.test.ext.junit.runners.AndroidJUnit4;
 
-import org.junit.AfterClass;
-import org.junit.BeforeClass;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
@@ -45,7 +40,7 @@
 
 @RunWith(AndroidJUnit4.class)
 @AppModeFull(reason = "MANAGE_IPSEC_TUNNELS permission can't be granted to instant apps")
-public class IkeSessionPskTest extends IkeSessionTestBase {
+public class IkeSessionPskTest extends IkeSessionPskTestBase {
     // Test vectors for success workflow
     private static final String SUCCESS_IKE_INIT_RESP =
             "46B8ECA1E0D72A18B45427679F9245D421202220000000000000015022000030"
@@ -85,47 +80,9 @@
                     + "9352D71100777B00ABCC6BD7DBEA697827FFAAA48DF9A54D1D68161939F5DC8"
                     + "6743A7CEB2BE34AC00095A5B8";
 
-    private IkeSession openIkeSessionWithTunnelModeChild(InetAddress remoteAddress) {
-        return openIkeSession(remoteAddress, buildTunnelModeChildSessionParams());
-    }
-
-    private IkeSession openIkeSessionWithTransportModeChild(InetAddress remoteAddress) {
-        return openIkeSession(remoteAddress, buildTransportModeChildParamsWithDefaultTs());
-    }
-
-    private IkeSession openIkeSession(InetAddress remoteAddress, ChildSessionParams childParams) {
-        IkeSessionParams ikeParams =
-                new IkeSessionParams.Builder(sContext)
-                        .setNetwork(mTunNetwork)
-                        .setServerHostname(remoteAddress.getHostAddress())
-                        .addSaProposal(SaProposalTest.buildIkeSaProposalWithNormalModeCipher())
-                        .addSaProposal(SaProposalTest.buildIkeSaProposalWithCombinedModeCipher())
-                        .setLocalIdentification(new IkeFqdnIdentification(LOCAL_HOSTNAME))
-                        .setRemoteIdentification(new IkeFqdnIdentification(REMOTE_HOSTNAME))
-                        .setAuthPsk(IKE_PSK)
-                        .build();
-        return new IkeSession(
-                sContext,
-                ikeParams,
-                childParams,
-                mUserCbExecutor,
-                mIkeSessionCallback,
-                mFirstChildSessionCallback);
-    }
-
-    @BeforeClass
-    public static void setUpTunnelPermissionBeforeClass() throws Exception {
-        // Under normal circumstances, the MANAGE_IPSEC_TUNNELS appop would be auto-granted, and
-        // a standard permission is insufficient. So we shell out the appop, to give us the
-        // right appop permissions.
-        setAppOp(OP_MANAGE_IPSEC_TUNNELS, true);
-    }
-
-    // This method is guaranteed to run in subclasses and will run after subclasses' @AfterClass
-    // methods.
-    @AfterClass
-    public static void tearDownTunnelPermissionAfterClass() throws Exception {
-        setAppOp(OP_MANAGE_IPSEC_TUNNELS, false);
+    @Override
+    protected IkeSessionParams getIkeSessionParams(InetAddress remoteAddress) {
+        return createIkeParamsBuilderBase(remoteAddress).build();
     }
 
     @Test
@@ -155,7 +112,7 @@
         // Open additional Child Session
         TestChildSessionCallback additionalChildCb = new TestChildSessionCallback();
         ikeSession.openChildSession(buildTunnelModeChildSessionParams(), additionalChildCb);
-        mTunUtils.awaitReqAndInjectResp(
+        mTunNetworkContext.tunUtils.awaitReqAndInjectResp(
                 IKE_DETERMINISTIC_INITIATOR_SPI,
                 expectedMsgId++,
                 true /* expectedUseEncap */,
@@ -175,7 +132,7 @@
 
         // Close additional Child Session
         ikeSession.closeChildSession(additionalChildCb);
-        mTunUtils.awaitReqAndInjectResp(
+        mTunNetworkContext.tunUtils.awaitReqAndInjectResp(
                 IKE_DETERMINISTIC_INITIATOR_SPI,
                 expectedMsgId++,
                 true /* expectedUseEncap */,
@@ -227,8 +184,8 @@
 
         // Teardown current test network that uses IPv4 address and set up new network with IPv6
         // address.
-        tearDownTestNetwork();
-        setUpTestNetwork(mLocalAddress);
+        mTunNetworkContext.tearDown();
+        mTunNetworkContext = new TunNetworkContext(mLocalAddress);
 
         // Open IKE Session
         IkeSession ikeSession = openIkeSessionWithTunnelModeChild(mRemoteAddress);
@@ -283,7 +240,7 @@
         // Open IKE Session
         IkeSession ikeSession = openIkeSessionWithTransportModeChild(mRemoteAddress);
         int expectedMsgId = 0;
-        mTunUtils.awaitReqAndInjectResp(
+        mTunNetworkContext.tunUtils.awaitReqAndInjectResp(
                 IKE_DETERMINISTIC_INITIATOR_SPI,
                 expectedMsgId++,
                 false /* expectedUseEncap */,
diff --git a/tests/cts/src/android/ipsec/ike/cts/IkeSessionPskTestBase.java b/tests/cts/src/android/ipsec/ike/cts/IkeSessionPskTestBase.java
new file mode 100644
index 0000000..580c0e5
--- /dev/null
+++ b/tests/cts/src/android/ipsec/ike/cts/IkeSessionPskTestBase.java
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2021 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package android.ipsec.ike.cts;
+
+import static android.app.AppOpsManager.OP_MANAGE_IPSEC_TUNNELS;
+
+import android.net.ipsec.ike.ChildSessionParams;
+import android.net.ipsec.ike.IkeFqdnIdentification;
+import android.net.ipsec.ike.IkeSession;
+import android.net.ipsec.ike.IkeSessionParams;
+
+import org.junit.AfterClass;
+import org.junit.BeforeClass;
+
+import java.net.InetAddress;
+
+abstract class IkeSessionPskTestBase extends IkeSessionTestBase {
+    @BeforeClass
+    public static void setUpTunnelPermissionBeforeClass() throws Exception {
+        // Under normal circumstances, the MANAGE_IPSEC_TUNNELS appop would be auto-granted, and
+        // a standard permission is insufficient. So we shell out the appop, to give us the
+        // right appop permissions.
+        setAppOp(OP_MANAGE_IPSEC_TUNNELS, true);
+    }
+
+    // This method is guaranteed to run in subclasses and will run after subclasses' @AfterClass
+    // methods.
+    @AfterClass
+    public static void tearDownTunnelPermissionAfterClass() throws Exception {
+        setAppOp(OP_MANAGE_IPSEC_TUNNELS, false);
+    }
+
+    protected IkeSession openIkeSessionWithTunnelModeChild(InetAddress remoteAddress) {
+        return openIkeSession(remoteAddress, buildTunnelModeChildSessionParams());
+    }
+
+    protected IkeSession openIkeSessionWithTransportModeChild(InetAddress remoteAddress) {
+        return openIkeSession(remoteAddress, buildTransportModeChildParamsWithDefaultTs());
+    }
+
+    protected IkeSessionParams.Builder createIkeParamsBuilderBase(InetAddress remoteAddress) {
+        return new IkeSessionParams.Builder(sContext)
+                .setNetwork(mTunNetworkContext.tunNetwork)
+                .setServerHostname(remoteAddress.getHostAddress())
+                .addSaProposal(SaProposalTest.buildIkeSaProposalWithNormalModeCipher())
+                .addSaProposal(SaProposalTest.buildIkeSaProposalWithCombinedModeCipher())
+                .setLocalIdentification(new IkeFqdnIdentification(LOCAL_HOSTNAME))
+                .setRemoteIdentification(new IkeFqdnIdentification(REMOTE_HOSTNAME))
+                .setAuthPsk(IKE_PSK);
+    }
+
+    protected abstract IkeSessionParams getIkeSessionParams(InetAddress remoteAddress);
+
+    private IkeSession openIkeSession(InetAddress remoteAddress, ChildSessionParams childParams) {
+        return new IkeSession(
+                sContext,
+                getIkeSessionParams(remoteAddress),
+                childParams,
+                mUserCbExecutor,
+                mIkeSessionCallback,
+                mFirstChildSessionCallback);
+    }
+}
diff --git a/tests/cts/src/android/ipsec/ike/cts/IkeSessionRekeyTest.java b/tests/cts/src/android/ipsec/ike/cts/IkeSessionRekeyTest.java
index 0ca12ad..4ec32f8 100644
--- a/tests/cts/src/android/ipsec/ike/cts/IkeSessionRekeyTest.java
+++ b/tests/cts/src/android/ipsec/ike/cts/IkeSessionRekeyTest.java
@@ -53,7 +53,7 @@
     private IkeSession openIkeSessionWithRemoteAddress(InetAddress remoteAddress) {
         IkeSessionParams ikeParams =
                 new IkeSessionParams.Builder(sContext)
-                        .setNetwork(mTunNetwork)
+                        .setNetwork(mTunNetworkContext.tunNetwork)
                         .setServerHostname(remoteAddress.getHostAddress())
                         .addSaProposal(SaProposalTest.buildIkeSaProposalWithNormalModeCipher())
                         .addSaProposal(SaProposalTest.buildIkeSaProposalWithCombinedModeCipher())
@@ -149,11 +149,13 @@
         verifyCreateIpSecTransformPair(firstTransformRecordA, firstTransformRecordB);
 
         // Inject rekey IKE requests
-        mTunUtils.injectPacket(buildInboundPkt(localRemotePorts, rekeyIkeCreateReq));
-        mTunUtils.awaitResp(
+        mTunNetworkContext.tunUtils.injectPacket(
+                buildInboundPkt(localRemotePorts, rekeyIkeCreateReq));
+        mTunNetworkContext.tunUtils.awaitResp(
                 IKE_DETERMINISTIC_INITIATOR_SPI, expectedRespMsgId++, true /* expectedUseEncap */);
-        mTunUtils.injectPacket(buildInboundPkt(localRemotePorts, rekeyIkeDeleteReq));
-        mTunUtils.awaitResp(
+        mTunNetworkContext.tunUtils.injectPacket(
+                buildInboundPkt(localRemotePorts, rekeyIkeDeleteReq));
+        mTunNetworkContext.tunUtils.awaitResp(
                 IKE_DETERMINISTIC_INITIATOR_SPI, expectedRespMsgId++, true /* expectedUseEncap */);
 
         // IKE has been rekeyed, reset message IDs
@@ -161,8 +163,8 @@
         expectedRespMsgId = 0;
 
         // Inject delete IKE request
-        mTunUtils.injectPacket(buildInboundPkt(localRemotePorts, deleteIkeReq));
-        mTunUtils.awaitResp(
+        mTunNetworkContext.tunUtils.injectPacket(buildInboundPkt(localRemotePorts, deleteIkeReq));
+        mTunNetworkContext.tunUtils.awaitResp(
                 newIkeDeterministicInitSpi, expectedRespMsgId++, true /* expectedUseEncap */);
 
         verifyDeleteIpSecTransformPair(
@@ -236,11 +238,13 @@
         verifyCreateIpSecTransformPair(oldTransformRecordA, oldTransformRecordB);
 
         // Inject rekey Child requests
-        mTunUtils.injectPacket(buildInboundPkt(localRemotePorts, rekeyChildCreateReq));
-        mTunUtils.awaitResp(
+        mTunNetworkContext.tunUtils.injectPacket(
+                buildInboundPkt(localRemotePorts, rekeyChildCreateReq));
+        mTunNetworkContext.tunUtils.awaitResp(
                 IKE_DETERMINISTIC_INITIATOR_SPI, expectedRespMsgId++, true /* expectedUseEncap */);
-        mTunUtils.injectPacket(buildInboundPkt(localRemotePorts, rekeyChildDeleteReq));
-        mTunUtils.awaitResp(
+        mTunNetworkContext.tunUtils.injectPacket(
+                buildInboundPkt(localRemotePorts, rekeyChildDeleteReq));
+        mTunNetworkContext.tunUtils.awaitResp(
                 IKE_DETERMINISTIC_INITIATOR_SPI, expectedRespMsgId++, true /* expectedUseEncap */);
 
         // Verify IpSecTransforms are renewed
@@ -253,8 +257,8 @@
                 mFirstChildSessionCallback, oldTransformRecordA, oldTransformRecordB);
 
         // Inject delete IKE request
-        mTunUtils.injectPacket(buildInboundPkt(localRemotePorts, deleteIkeReq));
-        mTunUtils.awaitResp(
+        mTunNetworkContext.tunUtils.injectPacket(buildInboundPkt(localRemotePorts, deleteIkeReq));
+        mTunNetworkContext.tunUtils.awaitResp(
                 IKE_DETERMINISTIC_INITIATOR_SPI, expectedRespMsgId++, true /* expectedUseEncap */);
 
         verifyDeleteIpSecTransformPair(
diff --git a/tests/cts/src/android/ipsec/ike/cts/IkeSessionTestBase.java b/tests/cts/src/android/ipsec/ike/cts/IkeSessionTestBase.java
index 745d8fb..12a53bb 100644
--- a/tests/cts/src/android/ipsec/ike/cts/IkeSessionTestBase.java
+++ b/tests/cts/src/android/ipsec/ike/cts/IkeSessionTestBase.java
@@ -47,7 +47,6 @@
 import android.net.ipsec.ike.TransportModeChildSessionParams;
 import android.net.ipsec.ike.TunnelModeChildSessionParams;
 import android.net.ipsec.ike.exceptions.IkeException;
-import android.net.ipsec.ike.exceptions.IkeProtocolException;
 import android.os.Binder;
 import android.os.ParcelFileDescriptor;
 import android.platform.test.annotations.AppModeFull;
@@ -146,10 +145,7 @@
     private static final byte[] NEXT_AVAILABLE_IP4_ADDR_LOCAL = INITIAL_AVAILABLE_IP4_ADDR_LOCAL;
     private static final byte[] NEXT_AVAILABLE_IP4_ADDR_REMOTE = INITIAL_AVAILABLE_IP4_ADDR_REMOTE;
 
-    ParcelFileDescriptor mTunFd;
-    TestNetworkCallback mTunNetworkCallback;
-    Network mTunNetwork;
-    IkeTunUtils mTunUtils;
+    TunNetworkContext mTunNetworkContext;
 
     InetAddress mLocalAddress;
     InetAddress mRemoteAddress;
@@ -181,7 +177,7 @@
     public void setUp() throws Exception {
         mLocalAddress = getNextAvailableIpv4AddressLocal();
         mRemoteAddress = getNextAvailableIpv4AddressRemote();
-        setUpTestNetwork(mLocalAddress);
+        mTunNetworkContext = new TunNetworkContext(mLocalAddress);
 
         mUserCbExecutor = Executors.newSingleThreadExecutor();
         mIkeSessionCallback = new TestIkeSessionCallback();
@@ -190,28 +186,41 @@
 
     @After
     public void tearDown() throws Exception {
-        tearDownTestNetwork();
+        mTunNetworkContext.tearDown();
     }
 
-    void setUpTestNetwork(InetAddress localAddr) throws Exception {
-        int prefixLen = localAddr instanceof Inet4Address ? IP4_PREFIX_LEN : IP6_PREFIX_LEN;
+    protected static class TunNetworkContext {
+        public final ParcelFileDescriptor tunFd;
+        public final TestNetworkCallback tunNetworkCallback;
+        public final Network tunNetwork;
+        public final IkeTunUtils tunUtils;
 
-        TestNetworkInterface testIface =
-                sTNM.createTunInterface(new LinkAddress[] {new LinkAddress(localAddr, prefixLen)});
+        public TunNetworkContext(InetAddress... addresses) throws Exception {
+            final LinkAddress[] linkAddresses = new LinkAddress[addresses.length];
+            for (int i = 0; i < linkAddresses.length; i++) {
+                InetAddress addr = addresses[i];
+                if (addr instanceof Inet4Address) {
+                    linkAddresses[i] = new LinkAddress(addr, IP4_PREFIX_LEN);
+                } else {
+                    linkAddresses[i] = new LinkAddress(addr, IP6_PREFIX_LEN);
+                }
+            }
+            final TestNetworkInterface testIface = sTNM.createTunInterface(linkAddresses);
 
-        mTunFd = testIface.getFileDescriptor();
-        mTunNetworkCallback =
-                TestNetworkUtils.setupAndGetTestNetwork(
-                        sCM, sTNM, testIface.getInterfaceName(), new Binder());
-        mTunNetwork = mTunNetworkCallback.getNetworkBlocking();
-        mTunUtils = new IkeTunUtils(mTunFd);
-    }
+            tunFd = testIface.getFileDescriptor();
+            tunNetworkCallback =
+                    TestNetworkUtils.setupAndGetTestNetwork(
+                            sCM, sTNM, testIface.getInterfaceName(), new Binder());
+            tunNetwork = tunNetworkCallback.getNetworkBlocking();
+            tunUtils = new IkeTunUtils(tunFd);
+        }
 
-    void tearDownTestNetwork() throws Exception {
-        sCM.unregisterNetworkCallback(mTunNetworkCallback);
+        public void tearDown() throws Exception {
+            sCM.unregisterNetworkCallback(tunNetworkCallback);
 
-        sTNM.teardownTestNetwork(mTunNetwork);
-        mTunFd.close();
+            sTNM.teardownTestNetwork(tunNetwork);
+            tunFd.close();
+        }
     }
 
     static void setAppOp(int appop, boolean allow) {
@@ -317,14 +326,15 @@
             boolean expectedAuthUseEncap,
             String... ikeAuthRespHexes)
             throws Exception {
-        mTunUtils.awaitReqAndInjectResp(
+        mTunNetworkContext.tunUtils.awaitReqAndInjectResp(
                 IKE_DETERMINISTIC_INITIATOR_SPI,
                 0 /* expectedMsgId */,
                 false /* expectedUseEncap */,
                 ikeInitRespHex);
 
         byte[] ikeAuthReqPkt =
-                mTunUtils
+                mTunNetworkContext
+                        .tunUtils
                         .awaitReqAndInjectResp(
                                 IKE_DETERMINISTIC_INITIATOR_SPI,
                                 1 /* expectedMsgId */,
@@ -341,7 +351,7 @@
 
     void performCloseIkeBlocking(
             int expectedMsgId, boolean expectedUseEncap, String deleteIkeRespHex) throws Exception {
-        mTunUtils.awaitReqAndInjectResp(
+        mTunNetworkContext.tunUtils.awaitReqAndInjectResp(
                 IKE_DETERMINISTIC_INITIATOR_SPI, expectedMsgId, expectedUseEncap, deleteIkeRespHex);
     }
 
@@ -352,9 +362,11 @@
         private CompletableFuture<Boolean> mFutureOnClosedCall = new CompletableFuture<>();
         private CompletableFuture<IkeException> mFutureOnClosedException =
                 new CompletableFuture<>();
+        private CompletableFuture<IkeSessionConnectionInfo> mFutureConnectionConfig =
+                new CompletableFuture<>();
 
         private int mOnErrorExceptionsCount = 0;
-        private ArrayTrackRecord<IkeProtocolException> mOnErrorExceptionsTrackRecord =
+        private ArrayTrackRecord<IkeException> mOnErrorExceptionsTrackRecord =
                 new ArrayTrackRecord<>();
 
         @Override
@@ -373,10 +385,16 @@
         }
 
         @Override
-        public void onError(@NonNull IkeProtocolException exception) {
+        public void onError(@NonNull IkeException exception) {
             mOnErrorExceptionsTrackRecord.add(exception);
         }
 
+        @Override
+        public void onIkeSessionConnectionInfoChanged(
+                @NonNull IkeSessionConnectionInfo connectionInfo) {
+            mFutureConnectionConfig.complete(connectionInfo);
+        }
+
         public IkeSessionConfiguration awaitIkeConfig() throws Exception {
             return mFutureIkeConfig.get(TIMEOUT_MS, TimeUnit.MILLISECONDS);
         }
@@ -385,7 +403,7 @@
             return mFutureOnClosedException.get(TIMEOUT_MS, TimeUnit.MILLISECONDS);
         }
 
-        public IkeProtocolException awaitNextOnErrorException() {
+        public IkeException awaitNextOnErrorException() {
             return mOnErrorExceptionsTrackRecord.poll(
                     (long) TIMEOUT_MS,
                     mOnErrorExceptionsCount++,
@@ -397,6 +415,10 @@
         public void awaitOnClosed() throws Exception {
             mFutureOnClosedCall.get(TIMEOUT_MS, TimeUnit.MILLISECONDS);
         }
+
+        public IkeSessionConnectionInfo awaitOnIkeSessionConnectionInfoChanged() throws Exception {
+            return mFutureConnectionConfig.get(TIMEOUT_MS, TimeUnit.MILLISECONDS);
+        }
     }
 
     /** Testing callback that allows caller to block current thread until a method get called */
@@ -408,9 +430,12 @@
                 new CompletableFuture<>();
 
         private int mCreatedIpSecTransformCount = 0;
+        private int mMigratedIpSecTransformCount = 0;
         private int mDeletedIpSecTransformCount = 0;
         private ArrayTrackRecord<IpSecTransformCallRecord> mCreatedIpSecTransformsTrackRecord =
                 new ArrayTrackRecord<>();
+        private ArrayTrackRecord<IpSecTransformCallRecord[]> mMigratedIpSecTransformsTrackRecord =
+                new ArrayTrackRecord<>();
         private ArrayTrackRecord<IpSecTransformCallRecord> mDeletedIpSecTransformsTrackRecord =
                 new ArrayTrackRecord<>();
 
@@ -436,6 +461,17 @@
         }
 
         @Override
+        public void onIpSecTransformsMigrated(
+                IpSecTransform inIpSecTransform, IpSecTransform outIpSecTransform) {
+            IpSecTransformCallRecord inRecord =
+                    new IpSecTransformCallRecord(inIpSecTransform, IpSecManager.DIRECTION_IN);
+            IpSecTransformCallRecord outRecord =
+                    new IpSecTransformCallRecord(outIpSecTransform, IpSecManager.DIRECTION_OUT);
+            mMigratedIpSecTransformsTrackRecord.add(
+                    new IpSecTransformCallRecord[] {inRecord, outRecord});
+        }
+
+        @Override
         public void onIpSecTransformDeleted(@NonNull IpSecTransform ipSecTransform, int direction) {
             mDeletedIpSecTransformsTrackRecord.add(
                     new IpSecTransformCallRecord(ipSecTransform, direction));
@@ -458,6 +494,15 @@
                     });
         }
 
+        public IpSecTransformCallRecord[] awaitNextMigratedIpSecTransform() {
+            return mMigratedIpSecTransformsTrackRecord.poll(
+                    (long) TIMEOUT_MS,
+                    mMigratedIpSecTransformCount++,
+                    (transform) -> {
+                        return true;
+                    });
+        }
+
         public IpSecTransformCallRecord awaitNextDeletedIpSecTransform() {
             return mDeletedIpSecTransformsTrackRecord.poll(
                     (long) TIMEOUT_MS,
@@ -511,7 +556,7 @@
         assertNotNull(ikeConnectInfo);
         assertEquals(mLocalAddress, ikeConnectInfo.getLocalAddress());
         assertEquals(mRemoteAddress, ikeConnectInfo.getRemoteAddress());
-        assertEquals(mTunNetwork, ikeConnectInfo.getNetwork());
+        assertEquals(mTunNetworkContext.tunNetwork, ikeConnectInfo.getNetwork());
     }
 
     void verifyChildSessionSetupBlocking(