diff --git a/neutron/tests/tempest/api/admin/test_l3_agent_scheduler.py b/neutron/tests/tempest/api/admin/test_l3_agent_scheduler.py
index 25cdb99..32fccab 100644
--- a/neutron/tests/tempest/api/admin/test_l3_agent_scheduler.py
+++ b/neutron/tests/tempest/api/admin/test_l3_agent_scheduler.py
@@ -64,21 +64,6 @@
             msg = "L3 Agent Scheduler enabled in conf, but L3 Agent not found"
             raise exceptions.InvalidConfiguration(msg)
         cls.router = cls.create_router(data_utils.rand_name('router'))
-        # NOTE(armax): If DVR is an available extension, and the created router
-        # is indeed a distributed one, more resources need to be provisioned
-        # in order to bind the router to the L3 agent.
-        # That said, let's preserve the existing test logic, where the extra
-        # query and setup steps are only required if the extension is available
-        # and only if the router's default type is distributed.
-        if test.is_extension_enabled('dvr', 'network'):
-            is_dvr_router = cls.admin_client.show_router(
-                cls.router['id'])['router'].get('distributed', False)
-            if is_dvr_router:
-                cls.network = cls.create_network()
-                cls.create_subnet(cls.network)
-                cls.port = cls.create_port(cls.network)
-                cls.client.add_router_interface_with_port_id(
-                    cls.router['id'], cls.port['id'])
 
     @decorators.idempotent_id('b7ce6e89-e837-4ded-9b78-9ed3c9c6a45a')
     def test_list_routers_on_l3_agent(self):
diff --git a/neutron/tests/tempest/api/admin/test_quotas.py b/neutron/tests/tempest/api/admin/test_quotas.py
index 20a0cc6..99ef2c3 100644
--- a/neutron/tests/tempest/api/admin/test_quotas.py
+++ b/neutron/tests/tempest/api/admin/test_quotas.py
@@ -13,7 +13,6 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-import six
 from tempest.lib.common.utils import data_utils
 from tempest.lib import decorators
 from tempest.lib import exceptions as lib_exc
@@ -83,7 +82,7 @@
 
         # Change quotas for tenant
         quota_set = self._setup_quotas(tenant_id, **new_quotas)
-        for key, value in six.iteritems(new_quotas):
+        for key, value in new_quotas.items():
             self.assertEqual(value, quota_set[key])
 
         # Confirm our tenant is listed among tenants with non default quotas
@@ -98,7 +97,7 @@
         # Confirm from API quotas were changed as requested for tenant
         quota_set = self.admin_client.show_quotas(tenant_id)
         quota_set = quota_set['quota']
-        for key, value in six.iteritems(new_quotas):
+        for key, value in new_quotas.items():
             self.assertEqual(value, quota_set[key])
 
         # Reset quotas to default and confirm
diff --git a/neutron/tests/tempest/api/admin/test_shared_network_extension.py b/neutron/tests/tempest/api/admin/test_shared_network_extension.py
index 6f3e391..042a73e 100644
--- a/neutron/tests/tempest/api/admin/test_shared_network_extension.py
+++ b/neutron/tests/tempest/api/admin/test_shared_network_extension.py
@@ -279,6 +279,17 @@
         # anchor is gone, delete should pass
         self.admin_client.delete_rbac_policy(wild['id'])
 
+    @decorators.idempotent_id('34d627da-a732-68c0-2e1a-bc4a19246698')
+    def test_delete_self_share_rule(self):
+        net = self.create_network()
+        self_share = self.client.create_rbac_policy(
+                         object_type='network', object_id=net['id'],
+                         action='access_as_shared',
+                         target_tenant=net['tenant_id'])['rbac_policy']
+        port = self.client.create_port(network_id=net['id'])['port']
+        self.client.delete_rbac_policy(self_share['id'])
+        self.client.delete_port(port['id'])
+
     @decorators.idempotent_id('86c3529b-1231-40de-803c-beefbeefbeef')
     def test_tenant_can_delete_port_on_own_network(self):
         net = self.create_network()  # owned by self.client
@@ -399,6 +410,18 @@
             self.client.update_rbac_policy(pol['rbac_policy']['id'],
                                            target_tenant='*')
 
+    @decorators.idempotent_id('34d627da-869f-68c0-2e1a-bc4a19246698')
+    def test_update_self_share_rule(self):
+        net = self.create_network()
+        self_share = self.client.create_rbac_policy(
+                         object_type='network', object_id=net['id'],
+                         action='access_as_shared',
+                         target_tenant=net['tenant_id'])['rbac_policy']
+        port = self.client.create_port(network_id=net['id'])['port']
+        self.client.update_rbac_policy(self_share['id'],
+                                       target_tenant=self.client2.tenant_id)
+        self.client.delete_port(port['id'])
+
     @decorators.idempotent_id('86c3529b-1231-40de-803c-aeeeeeee7fff')
     def test_filtering_works_with_rbac_records_present(self):
         resp = self._make_admin_net_and_subnet_shared_to_tenant_id(
diff --git a/neutron/tests/tempest/api/test_qos.py b/neutron/tests/tempest/api/test_qos.py
index 184c092..104fb9b 100644
--- a/neutron/tests/tempest/api/test_qos.py
+++ b/neutron/tests/tempest/api/test_qos.py
@@ -473,7 +473,7 @@
                                                     max_kbps=1,
                                                     max_burst_kbps=1)
         self.assertRaises(
-            exceptions.NotFound,
+            exceptions.Forbidden,
             self.client.update_bandwidth_limit_rule,
             policy['id'], rule['id'], max_kbps=2, max_burst_kbps=4)
 
diff --git a/neutron/tests/tempest/api/test_routers.py b/neutron/tests/tempest/api/test_routers.py
index d6beb77..7a1e458 100644
--- a/neutron/tests/tempest/api/test_routers.py
+++ b/neutron/tests/tempest/api/test_routers.py
@@ -14,7 +14,6 @@
 #    under the License.
 
 import netaddr
-import six
 from tempest.lib.common.utils import data_utils
 from tempest.lib import decorators
 from tempest import test
@@ -91,7 +90,7 @@
             self.assertIsNone(actual_ext_gw_info)
             return
         # Verify only keys passed in exp_ext_gw_info
-        for k, v in six.iteritems(exp_ext_gw_info):
+        for k, v in exp_ext_gw_info.items():
             self.assertEqual(v, actual_ext_gw_info[k])
 
     def _verify_gateway_port(self, router_id):
diff --git a/neutron/tests/tempest/api/test_security_groups_negative.py b/neutron/tests/tempest/api/test_security_groups_negative.py
index 9202060..1d841b1 100644
--- a/neutron/tests/tempest/api/test_security_groups_negative.py
+++ b/neutron/tests/tempest/api/test_security_groups_negative.py
@@ -13,12 +13,15 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+from neutron_lib.db import constants as db_const
 from tempest.lib import decorators
 from tempest.lib import exceptions as lib_exc
 from tempest import test
 
 from neutron.tests.tempest.api import base_security_groups as base
 
+LONG_NAME_NG = 'x' * (db_const.NAME_FIELD_SIZE + 1)
+
 
 class NegativeSecGroupTest(base.BaseSecGroupTest):
 
@@ -28,6 +31,20 @@
         super(NegativeSecGroupTest, cls).resource_setup()
 
     @test.attr(type='negative')
+    @decorators.idempotent_id('594edfa8-9a5b-438e-9344-49aece337d49')
+    def test_create_security_group_with_too_long_name(self):
+        self.assertRaises(lib_exc.BadRequest,
+                          self.client.create_security_group,
+                          name=LONG_NAME_NG)
+
+    @test.attr(type='negative')
+    @decorators.idempotent_id('b6b79838-7430-4d3f-8e07-51dfb61802c2')
+    def test_create_security_group_with_boolean_type_name(self):
+        self.assertRaises(lib_exc.BadRequest,
+                          self.client.create_security_group,
+                          name=True)
+
+    @test.attr(type='negative')
     @decorators.idempotent_id('55100aa8-b24f-333c-0bef-64eefd85f15c')
     def test_update_default_security_group_name(self):
         sg_list = self.client.list_security_groups(name='default')
@@ -35,6 +52,24 @@
         self.assertRaises(lib_exc.Conflict, self.client.update_security_group,
                           sg['id'], name='test')
 
+    @test.attr(type='negative')
+    @decorators.idempotent_id('c8510dd8-c3a8-4df9-ae44-24354db50960')
+    def test_update_security_group_with_too_long_name(self):
+        sg_list = self.client.list_security_groups(name='default')
+        sg = sg_list['security_groups'][0]
+        self.assertRaises(lib_exc.BadRequest,
+                          self.client.update_security_group,
+                          sg['id'], name=LONG_NAME_NG)
+
+    @test.attr(type='negative')
+    @decorators.idempotent_id('d9a14917-f66f-4eca-ab72-018563917f1b')
+    def test_update_security_group_with_boolean_type_name(self):
+        sg_list = self.client.list_security_groups(name='default')
+        sg = sg_list['security_groups'][0]
+        self.assertRaises(lib_exc.BadRequest,
+                          self.client.update_security_group,
+                          sg['id'], name=True)
+
 
 class NegativeSecGroupIPv6Test(NegativeSecGroupTest):
     _ip_version = 6
diff --git a/neutron/tests/tempest/scenario/test_dvr.py b/neutron/tests/tempest/scenario/test_dvr.py
index 3c62f3a..049aa8f 100644
--- a/neutron/tests/tempest/scenario/test_dvr.py
+++ b/neutron/tests/tempest/scenario/test_dvr.py
@@ -22,15 +22,7 @@
 CONF = config.CONF
 
 
-class NetworkDvrTest(base.BaseTempestTestCase):
-    credentials = ['primary', 'admin']
-    force_tenant_isolation = False
-
-    @classmethod
-    @test.requires_ext(extension="dvr", service="network")
-    def skip_checks(cls):
-        super(NetworkDvrTest, cls).skip_checks()
-
+class NetworkTestMixin(object):
     def _check_connectivity(self):
         self.check_connectivity(self.fip['floating_ip_address'],
                                 CONF.validation.image_ssh_user,
@@ -51,6 +43,16 @@
         self.admin_manager.network_client.update_port(
             port_id, admin_state_up=False)
 
+
+class NetworkDvrTest(base.BaseTempestTestCase, NetworkTestMixin):
+    credentials = ['primary', 'admin']
+    force_tenant_isolation = False
+
+    @classmethod
+    @test.requires_ext(extension="dvr", service="network")
+    def skip_checks(cls):
+        super(NetworkDvrTest, cls).skip_checks()
+
     @decorators.idempotent_id('3d73ec1a-2ec6-45a9-b0f8-04a283d9d344')
     def test_vm_reachable_through_compute(self):
         """Check that the VM is reachable through compute node.
@@ -62,23 +64,3 @@
             ha=False)
         self.setup_network_and_server(router=router)
         self._check_snat_port_connectivity()
-
-    @decorators.idempotent_id('23724222-483a-4129-bc15-7a9278f3828b')
-    def test_update_centralized_router_to_dvr(self):
-        """Check that updating centralized router to be distributed works.
-        """
-        # Created a centralized router on a DVR setup
-        router = self.create_router_by_client(
-            distributed=False, tenant_id=self.client.tenant_id, is_admin=True,
-            ha=False)
-        self.setup_network_and_server(router=router)
-        self._check_connectivity()
-
-        # Update router to be distributed
-        self.admin_manager.network_client.update_router(
-            router_id=router['id'], admin_state_up=False)
-        self.admin_manager.network_client.update_router(
-            router_id=router['id'], distributed=True)
-        self.admin_manager.network_client.update_router(
-            router_id=router['id'], admin_state_up=True)
-        self._check_snat_port_connectivity()
diff --git a/neutron/tests/tempest/scenario/test_migration.py b/neutron/tests/tempest/scenario/test_migration.py
new file mode 100644
index 0000000..db89716
--- /dev/null
+++ b/neutron/tests/tempest/scenario/test_migration.py
@@ -0,0 +1,127 @@
+# Copyright 2017 Red Hat, Inc.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from tempest.lib import decorators
+from tempest import test
+
+from neutron.tests.tempest.scenario import base
+from neutron.tests.tempest.scenario import test_dvr
+
+
+class NetworkMigrationTestBase(base.BaseTempestTestCase,
+                               test_dvr.NetworkTestMixin):
+    credentials = ['primary', 'admin']
+    force_tenant_isolation = False
+
+    @classmethod
+    @test.requires_ext(extension="dvr", service="network")
+    @test.requires_ext(extension="l3-ha", service="network")
+    def skip_checks(cls):
+        super(NetworkMigrationTestBase, cls).skip_checks()
+
+    def _check_update(self, router, is_dvr, is_ha):
+        router = self.admin_manager.network_client.show_router(router['id'])
+        self.assertEqual(is_dvr, router['router']['distributed'])
+        self.assertEqual(is_ha, router['router']['ha'])
+
+    def _test_migration(self, before_dvr, before_ha, after_dvr, after_ha):
+        router = self.create_router_by_client(
+            distributed=before_dvr, ha=before_ha,
+            tenant_id=self.client.tenant_id, is_admin=True)
+
+        self.setup_network_and_server(router=router)
+        self._check_connectivity()
+
+        self.admin_manager.network_client.update_router(
+            router_id=router['id'], admin_state_up=False)
+        self.admin_manager.network_client.update_router(
+            router_id=router['id'], distributed=after_dvr, ha=after_ha)
+        self._check_update(router, after_dvr, after_ha)
+
+        self.admin_manager.network_client.update_router(
+            router_id=router['id'], admin_state_up=True)
+        self._check_connectivity()
+
+
+class NetworkMigrationFromLegacy(NetworkMigrationTestBase):
+
+    @decorators.idempotent_id('23724222-483a-4129-bc15-7a9278f3828b')
+    def test_from_legacy_to_dvr(self):
+        self._test_migration(before_dvr=False, before_ha=False,
+                             after_dvr=True, after_ha=False)
+
+    @decorators.idempotent_id('09d85102-994f-4ff9-bf3e-17051145ca12')
+    def test_from_legacy_to_ha(self):
+        self._test_migration(before_dvr=False, before_ha=False,
+                             after_dvr=False, after_ha=True)
+
+    @decorators.idempotent_id('fe169f2c-6ed3-4eb0-8afe-2d540c4b49e2')
+    def test_from_legacy_to_dvr_ha(self):
+        self._test_migration(before_dvr=False, before_ha=False,
+                             after_dvr=True, after_ha=True)
+
+
+class NetworkMigrationFromHA(NetworkMigrationTestBase):
+
+    @decorators.idempotent_id('b4e68ac0-3b76-4306-ae8a-51cf4d363b22')
+    def test_from_ha_to_legacy(self):
+        self._test_migration(before_dvr=False, before_ha=True,
+                             after_dvr=False, after_ha=False)
+
+    @decorators.idempotent_id('42260eea-5d56-4d30-b62a-a62694dfe4d5')
+    def test_from_ha_to_dvr(self):
+        self._test_migration(before_dvr=False, before_ha=True,
+                             after_dvr=True, after_ha=False)
+
+    @decorators.idempotent_id('e4149576-248b-43fa-9d0b-a5c2f51967ce')
+    def test_from_ha_to_dvr_ha(self):
+        self._test_migration(before_dvr=False, before_ha=True,
+                             after_dvr=True, after_ha=True)
+
+
+class NetworkMigrationFromDVR(NetworkMigrationTestBase):
+
+    @decorators.idempotent_id('e5cac02c-248d-4aac-bd5e-9d47c5197307')
+    def test_from_dvr_to_legacy(self):
+        self._test_migration(before_dvr=True, before_ha=False,
+                             after_dvr=False, after_ha=False)
+
+    @decorators.idempotent_id('a00d5ad7-8509-4bb0-bdd2-7f1ee052d1cd')
+    def test_from_dvr_to_ha(self):
+        self._test_migration(before_dvr=True, before_ha=False,
+                             after_dvr=False, after_ha=True)
+
+    @decorators.idempotent_id('25304a51-93a8-4cf3-9523-bce8b4eaecf8')
+    def test_from_dvr_to_dvr_ha(self):
+        self._test_migration(before_dvr=True, before_ha=False,
+                             after_dvr=True, after_ha=True)
+
+
+class NetworkMigrationFromDVRHA(NetworkMigrationTestBase):
+
+    @decorators.idempotent_id('1be9b2e2-379c-40a4-a269-6687b81df691')
+    def test_from_dvr_ha_to_legacy(self):
+        self._test_migration(before_dvr=True, before_ha=True,
+                             after_dvr=False, after_ha=False)
+
+    @decorators.idempotent_id('55957267-4e84-4314-a2f7-7cd36a2df04b')
+    def test_from_dvr_ha_to_ha(self):
+        self._test_migration(before_dvr=True, before_ha=True,
+                             after_dvr=False, after_ha=True)
+
+    @decorators.idempotent_id('d6bedff1-72be-4a9a-8ea2-dc037cd838e0')
+    def test_from_dvr_ha_to_dvr(self):
+        self._test_migration(before_dvr=True, before_ha=True,
+                             after_dvr=True, after_ha=False)
diff --git a/neutron/tests/tempest/services/network/json/network_client.py b/neutron/tests/tempest/services/network/json/network_client.py
index 671c040..83c4570 100644
--- a/neutron/tests/tempest/services/network/json/network_client.py
+++ b/neutron/tests/tempest/services/network/json/network_client.py
@@ -366,6 +366,8 @@
             'external_gateway_info', body['router']['external_gateway_info'])
         if 'distributed' in kwargs:
             update_body['distributed'] = kwargs['distributed']
+        if 'ha' in kwargs:
+            update_body['ha'] = kwargs['ha']
         update_body = dict(router=update_body)
         update_body = jsonutils.dumps(update_body)
         resp, body = self.put(uri, update_body)