diff --git a/components/bt/esp_ble_mesh/Kconfig.in b/components/bt/esp_ble_mesh/Kconfig.in
index ac5548d140..0d44b98cba 100644
--- a/components/bt/esp_ble_mesh/Kconfig.in
+++ b/components/bt/esp_ble_mesh/Kconfig.in
@@ -1091,6 +1091,16 @@ if BLE_MESH
                 help
                     Maximum number of Bridging Table entries that the Bridge Configuration Server can support.
 
+            config BLE_MESH_BRIDGE_CRPL
+                int "Maximum capacity of bridge replay protection list"
+                default 5
+                range 1 255
+                help
+                    This option specifies the maximum capacity of the bridge replay
+                    protection list. The bridge replay protection list is used to
+                    prevent a bridged subnet from replay attack, which will store the
+                    source address and sequence number of the received bridge messages.
+
         endif #BLE_MESH_BRC_SRV
 
         config BLE_MESH_PRB_CLI
@@ -1474,6 +1484,7 @@ if BLE_MESH
 
         config BLE_MESH_BQB_TEST
             bool "Enable BLE Mesh specific internal test"
+            select BLE_MESH_IV_UPDATE_TEST
             default n
             help
                 This option is used to enable some internal functions for auto-pts test.
diff --git a/components/bt/esp_ble_mesh/api/core/esp_ble_mesh_proxy_api.c b/components/bt/esp_ble_mesh/api/core/esp_ble_mesh_proxy_api.c
index 582ea77557..0365711d86 100644
--- a/components/bt/esp_ble_mesh/api/core/esp_ble_mesh_proxy_api.c
+++ b/components/bt/esp_ble_mesh/api/core/esp_ble_mesh_proxy_api.c
@@ -53,6 +53,34 @@ esp_err_t esp_ble_mesh_proxy_gatt_disable(void)
     return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
 }
 
+#if CONFIG_BLE_MESH_PRB_SRV
+esp_err_t esp_ble_mesh_private_proxy_identity_enable(void)
+{
+    btc_msg_t msg = {0};
+
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_PROV;
+    msg.act = BTC_BLE_MESH_ACT_PRIVATE_PROXY_IDENTITY_ENABLE;
+
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+
+esp_err_t esp_ble_mesh_private_proxy_identity_disable(void)
+{
+    btc_msg_t msg = {0};
+
+    ESP_BLE_HOST_STATUS_CHECK(ESP_BLE_HOST_STATUS_ENABLED);
+
+    msg.sig = BTC_SIG_API_CALL;
+    msg.pid = BTC_PID_PROV;
+    msg.act = BTC_BLE_MESH_ACT_PRIVATE_PROXY_IDENTITY_DISABLE;
+
+    return (btc_transfer_context(&msg, NULL, 0, NULL, NULL) == BT_STATUS_SUCCESS ? ESP_OK : ESP_FAIL);
+}
+#endif /* CONFIG_BLE_MESH_PRB_SRV */
+
 esp_err_t esp_ble_mesh_proxy_client_connect(esp_ble_mesh_bd_addr_t addr,
                                             esp_ble_mesh_addr_type_t addr_type,
                                             uint16_t net_idx)
diff --git a/components/bt/esp_ble_mesh/api/core/include/esp_ble_mesh_proxy_api.h b/components/bt/esp_ble_mesh/api/core/include/esp_ble_mesh_proxy_api.h
index b0f9c82104..66b1e1d4be 100644
--- a/components/bt/esp_ble_mesh/api/core/include/esp_ble_mesh_proxy_api.h
+++ b/components/bt/esp_ble_mesh/api/core/include/esp_ble_mesh_proxy_api.h
@@ -48,6 +48,30 @@ esp_err_t esp_ble_mesh_proxy_gatt_enable(void);
  */
 esp_err_t esp_ble_mesh_proxy_gatt_disable(void);
 
+/**
+ * @brief   Enable advertising with Private Node Identity.
+ *
+ * @note    This API requires that GATT Proxy support be enabled. Once called,
+ *          each subnet starts advertising using Private Node Identity for the
+ *          next 60 seconds, and after 60s Private Network ID will be advertised.
+ *          Under normal conditions, the BLE Mesh Proxy Node Identity, Network
+ *          ID advertising, Proxy Private Node Identity and Private Network
+ *          ID advertising will be enabled automatically by BLE Mesh stack
+ *          after the device is provisioned.
+ *
+ * @return  ESP_OK on success or error code otherwise.
+ *
+ */
+esp_err_t esp_ble_mesh_private_proxy_identity_enable(void);
+
+/**
+ * @brief   Disable advertising with Private Node Identity.
+ *
+ * @return  ESP_OK on success or error code otherwise.
+ *
+ */
+esp_err_t esp_ble_mesh_private_proxy_identity_disable(void);
+
 /**
  * @brief        Proxy Client creates a connection with the Proxy Server.
  *
diff --git a/components/bt/esp_ble_mesh/api/esp_ble_mesh_defs.h b/components/bt/esp_ble_mesh/api/esp_ble_mesh_defs.h
index 37f4bf05dc..744b85c844 100644
--- a/components/bt/esp_ble_mesh/api/esp_ble_mesh_defs.h
+++ b/components/bt/esp_ble_mesh/api/esp_ble_mesh_defs.h
@@ -916,6 +916,8 @@ typedef enum {
     ESP_BLE_MESH_NODE_PROV_INPUT_NUMBER_COMP_EVT,               /*!< Node input number completion event */
     ESP_BLE_MESH_NODE_PROV_INPUT_STRING_COMP_EVT,               /*!< Node input string completion event */
     ESP_BLE_MESH_NODE_PROXY_IDENTITY_ENABLE_COMP_EVT,           /*!< Enable BLE Mesh Proxy Identity advertising completion event */
+    ESP_BLE_MESH_NODE_PRIVATE_PROXY_IDENTITY_ENABLE_COMP_EVT,   /*!< Enable BLE Mesh Private Proxy Identity advertising completion event */
+    ESP_BLE_MESH_NODE_PRIVATE_PROXY_IDENTITY_DISABLE_COMP_EVT,  /*!< Disable BLE Mesh Private Proxy Identity advertising completion event */
     ESP_BLE_MESH_NODE_PROXY_GATT_ENABLE_COMP_EVT,               /*!< Enable BLE Mesh GATT Proxy Service completion event */
     ESP_BLE_MESH_NODE_PROXY_GATT_DISABLE_COMP_EVT,              /*!< Disable BLE Mesh GATT Proxy Service completion event */
     ESP_BLE_MESH_NODE_ADD_LOCAL_NET_KEY_COMP_EVT,               /*!< Node add NetKey locally completion event */
@@ -1109,6 +1111,18 @@ typedef union {
     struct ble_mesh_proxy_gatt_disable_comp_param {
         int err_code;                           /*!< Indicate the result of disabling Mesh Proxy Service */
     } node_proxy_gatt_disable_comp;             /*!< Event parameter of ESP_BLE_MESH_NODE_PROXY_GATT_DISABLE_COMP_EVT */
+    /**
+     * @brief ESP_BLE_MESH_NODE_PRIVATE_PROXY_IDENTITY_ENABLE_COMP_EVT
+     */
+    struct ble_mesh_proxy_private_identity_enable_comp_param {
+        int err_code;                           /*!< Indicate the result of enabling Mesh Proxy private advertising */
+    } node_private_proxy_identity_enable_comp;  /*!< Event parameter of ESP_BLE_MESH_NODE_PRIVATE_PROXY_IDENTITY_ENABLE_COMP_EVT */
+    /**
+     * @brief ESP_BLE_MESH_NODE_PRIVATE_PROXY_IDENTITY_DISABLE_COMP_EVT
+     */
+    struct ble_mesh_proxy_private_identity_disable_comp_param {
+        int err_code;                           /*!< Indicate the result of disabling Mesh Proxy private advertising */
+    } node_private_proxy_identity_disable_comp;  /*!< Event parameter of ESP_BLE_MESH_NODE_PRIVATE_PROXY_IDENTITY_DISABLE_COMP_EVT */
     /**
      * @brief ESP_BLE_MESH_NODE_ADD_LOCAL_NET_KEY_COMP_EVT
      */
diff --git a/components/bt/esp_ble_mesh/btc/btc_ble_mesh_prov.c b/components/bt/esp_ble_mesh/btc/btc_ble_mesh_prov.c
index 826fbf02c1..cbbee08cd4 100644
--- a/components/bt/esp_ble_mesh/btc/btc_ble_mesh_prov.c
+++ b/components/bt/esp_ble_mesh/btc/btc_ble_mesh_prov.c
@@ -2368,6 +2368,16 @@ void btc_ble_mesh_prov_call_handler(btc_msg_t *msg)
         act = ESP_BLE_MESH_NODE_PROXY_GATT_DISABLE_COMP_EVT;
         param.node_proxy_gatt_disable_comp.err_code = bt_mesh_proxy_server_gatt_disable();
         break;
+#if CONFIG_BLE_MESH_PRB_SRV
+    case BTC_BLE_MESH_ACT_PRIVATE_PROXY_IDENTITY_ENABLE:
+        act = ESP_BLE_MESH_NODE_PRIVATE_PROXY_IDENTITY_ENABLE_COMP_EVT;
+        param.node_private_proxy_identity_enable_comp.err_code = bt_mesh_proxy_private_identity_enable();
+        break;
+    case BTC_BLE_MESH_ACT_PRIVATE_PROXY_IDENTITY_DISABLE:
+        act = ESP_BLE_MESH_NODE_PRIVATE_PROXY_IDENTITY_DISABLE_COMP_EVT;
+        param.node_private_proxy_identity_disable_comp.err_code = bt_mesh_proxy_private_identity_disable();
+        break;
+#endif /* CONFIG_BLE_MESH_PRB_SRV */
 #endif /* CONFIG_BLE_MESH_GATT_PROXY_SERVER */
 #endif /* (CONFIG_BLE_MESH_NODE && CONFIG_BLE_MESH_PB_GATT) || CONFIG_BLE_MESH_GATT_PROXY_SERVER */
 #if CONFIG_BLE_MESH_PROVISIONER
diff --git a/components/bt/esp_ble_mesh/btc/include/btc_ble_mesh_prov.h b/components/bt/esp_ble_mesh/btc/include/btc_ble_mesh_prov.h
index efdae7f337..e303f43ab7 100644
--- a/components/bt/esp_ble_mesh/btc/include/btc_ble_mesh_prov.h
+++ b/components/bt/esp_ble_mesh/btc/include/btc_ble_mesh_prov.h
@@ -28,6 +28,8 @@ typedef enum {
     BTC_BLE_MESH_ACT_INPUT_STRING,
     BTC_BLE_MESH_ACT_SET_DEVICE_NAME,
     BTC_BLE_MESH_ACT_PROXY_IDENTITY_ENABLE,
+    BTC_BLE_MESH_ACT_PRIVATE_PROXY_IDENTITY_ENABLE,
+    BTC_BLE_MESH_ACT_PRIVATE_PROXY_IDENTITY_DISABLE,
     BTC_BLE_MESH_ACT_PROXY_GATT_ENABLE,
     BTC_BLE_MESH_ACT_PROXY_GATT_DISABLE,
     BTC_BLE_MESH_ACT_NODE_ADD_LOCAL_NET_KEY,
diff --git a/components/bt/esp_ble_mesh/common/timer.c b/components/bt/esp_ble_mesh/common/timer.c
index 74fe3b492e..0d65bd3a10 100644
--- a/components/bt/esp_ble_mesh/common/timer.c
+++ b/components/bt/esp_ble_mesh/common/timer.c
@@ -207,7 +207,7 @@ int k_delayed_work_free(struct k_delayed_work *work)
 
     alarm = hash_map_get(bm_alarm_hash_map, work);
     if (alarm == NULL) {
-        BT_WARN("Free, alarm not found");
+        BT_DBG("Free, alarm not found");
         bt_mesh_alarm_unlock();
         return -EINVAL;
     }
diff --git a/components/bt/esp_ble_mesh/core/access.c b/components/bt/esp_ble_mesh/core/access.c
index 531ccd689a..9606581eb8 100644
--- a/components/bt/esp_ble_mesh/core/access.c
+++ b/components/bt/esp_ble_mesh/core/access.c
@@ -964,6 +964,9 @@ int bt_mesh_model_publish(struct bt_mesh_model *model)
     ctx.send_ttl = pub->ttl;
     ctx.send_cred = pub->cred ? BLE_MESH_FRIENDSHIP_CRED : BLE_MESH_FLOODING_CRED;
     ctx.send_szmic = pub->send_szmic;
+#if 0
+    ctx.send_tag |= BLE_MESH_TAG_IMMUTABLE_CRED;
+#endif
     if (pub->send_rel) {
         /* Tag with send-segmented */
         ctx.send_tag |= BLE_MESH_TAG_SEND_SEGMENTED;
diff --git a/components/bt/esp_ble_mesh/core/adv.c b/components/bt/esp_ble_mesh/core/adv.c
index b99d22f2a1..6d5f1a988c 100644
--- a/components/bt/esp_ble_mesh/core/adv.c
+++ b/components/bt/esp_ble_mesh/core/adv.c
@@ -180,7 +180,7 @@ static inline int adv_send(struct net_buf *buf)
             bt_mesh_adv_buf_ref_debug(__func__, buf, 3U, BLE_MESH_BUF_REF_SMALL);
             struct bt_mesh_adv_data solic_ad[3] = {
                 BLE_MESH_ADV_DATA_BYTES(BLE_MESH_DATA_FLAGS, (BLE_MESH_AD_GENERAL | BLE_MESH_AD_NO_BREDR)),
-                BLE_MESH_ADV_DATA_BYTES(BLE_MESH_DATA_UUID16_ALL, 0x29, 0x18),
+                BLE_MESH_ADV_DATA_BYTES(BLE_MESH_DATA_UUID16_ALL, 0x59, 0x18),
                 BLE_MESH_ADV_DATA(BLE_MESH_DATA_SVC_DATA16, buf->data, buf->len),
             };
             err = bt_le_adv_start(&param, solic_ad, 3, NULL, 0);
diff --git a/components/bt/esp_ble_mesh/core/bluedroid_host/adapter.c b/components/bt/esp_ble_mesh/core/bluedroid_host/adapter.c
index a9908b7250..68a768c794 100644
--- a/components/bt/esp_ble_mesh/core/bluedroid_host/adapter.c
+++ b/components/bt/esp_ble_mesh/core/bluedroid_host/adapter.c
@@ -30,6 +30,7 @@
 #include "mesh/common.h"
 #include "prov_pvnr.h"
 #include "net.h"
+#include "beacon.h"
 
 #include "mesh_v1.1/utils.h"
 
@@ -369,7 +370,15 @@ int bt_le_adv_start(const struct bt_mesh_adv_param *param,
     }
 
 #if CONFIG_BLE_MESH_PRB_SRV
-    addr_type_own = bt_mesh_private_beacon_update_addr_type(ad);
+    /* NOTE: When a Mesh Private beacon is advertised, the Mesh Private beacon shall
+     * use a resolvable private address or a non-resolvable private address in the
+     * AdvA field of the advertising PDU.
+     */
+    if (ad->type == BLE_MESH_DATA_MESH_BEACON && ad->data[0] == BEACON_TYPE_PRIVATE) {
+        addr_type_own = BLE_MESH_ADDR_RANDOM;
+    } else {
+        addr_type_own = BLE_MESH_ADDR_PUBLIC;
+    }
 #else
     addr_type_own = BLE_MESH_ADDR_PUBLIC;
 #endif
@@ -1978,7 +1987,7 @@ int bt_mesh_update_exceptional_list(uint8_t sub_code, uint32_t type, void *info)
 
     if ((sub_code > BLE_MESH_EXCEP_LIST_SUB_CODE_CLEAN) ||
         (sub_code < BLE_MESH_EXCEP_LIST_SUB_CODE_CLEAN &&
-         type > BLE_MESH_EXCEP_LIST_TYPE_MESH_PROXY_ADV) ||
+         type >= BLE_MESH_EXCEP_LIST_TYPE_MAX) ||
         (sub_code == BLE_MESH_EXCEP_LIST_SUB_CODE_CLEAN &&
          !(type & BLE_MESH_EXCEP_LIST_CLEAN_ALL_LIST))) {
         BT_ERR("%s, Invalid parameter", __func__);
@@ -1990,6 +1999,16 @@ int bt_mesh_update_exceptional_list(uint8_t sub_code, uint32_t type, void *info)
             BT_ERR("Invalid Provisioning Link ID");
             return -EINVAL;
         }
+
+        /* When removing an unused link (i.e., Link ID is 0), and since
+         * Controller has never added this Link ID, it will cause error
+         * log been wrongly reported.
+         * Therefore, add this check here to avoid such occurrences.
+         */
+        if (*(uint32_t *)info == 0) {
+            return 0;
+        }
+
         sys_memcpy_swap(value, info, sizeof(uint32_t));
     }
 
diff --git a/components/bt/esp_ble_mesh/core/cfg_srv.c b/components/bt/esp_ble_mesh/core/cfg_srv.c
index 614387405c..9d91cb217b 100644
--- a/components/bt/esp_ble_mesh/core/cfg_srv.c
+++ b/components/bt/esp_ble_mesh/core/cfg_srv.c
@@ -2,7 +2,7 @@
 
 /*
  * SPDX-FileCopyrightText: 2017 Intel Corporation
- * SPDX-FileContributor: 2018-2021 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2018-2023 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -2514,7 +2514,7 @@ static void node_identity_set(struct bt_mesh_model *model,
                  * any subnet is 0x01, then the value of the Private Node
                  * Identity state shall be Disable (0x00).
                  */
-                disable_all_private_node_identity();
+                bt_mesh_proxy_private_identity_disable();
 #endif
                 bt_mesh_proxy_server_identity_start(sub);
             } else {
@@ -3575,6 +3575,17 @@ uint8_t bt_mesh_net_transmit_get(void)
     return 0;
 }
 
+void bt_mesh_relay_local_set(bool enable)
+{
+    if (conf && conf->relay != BLE_MESH_RELAY_NOT_SUPPORTED) {
+        if (enable) {
+            conf->relay = BLE_MESH_RELAY_ENABLED;
+        } else {
+            conf->relay = BLE_MESH_RELAY_DISABLED;
+        }
+    }
+}
+
 uint8_t bt_mesh_relay_get(void)
 {
     if (conf) {
diff --git a/components/bt/esp_ble_mesh/core/foundation.h b/components/bt/esp_ble_mesh/core/foundation.h
index 0a07e70b02..4f3aa79ad1 100644
--- a/components/bt/esp_ble_mesh/core/foundation.h
+++ b/components/bt/esp_ble_mesh/core/foundation.h
@@ -246,10 +246,10 @@ extern "C" {
 /* Defines the status codes for Opcodes Aggregator messages. */
 #define AGG_STATUS_SUCCESS                          0x00
 #define AGG_STATUS_INVALID_ADDRESS                  0x01
-#define AGG_STATUS_INVALID_MODEL                    0x02
-#define AGG_STATUS_WRONG_ACCESS_KEY                 0x03
-#define AGG_STATUS_WRONG_OPCODE                     0x04
-#define AGG_STATUS_MSG_NOT_UNDERSTOOD               0x05
+#define AGG_STATUS_WRONG_ACCESS_KEY                 0x02
+#define AGG_STATUS_WRONG_OPCODE                     0x03
+#define AGG_STATUS_MSG_NOT_UNDERSTOOD               0x04
+#define AGG_STATUS_RESPONSE_OVERFLOW                0x05
 
 enum {
     BLE_MESH_VA_CHANGED,    /* Label information changed */
diff --git a/components/bt/esp_ble_mesh/core/include/mesh/access.h b/components/bt/esp_ble_mesh/core/include/mesh/access.h
index 1b78cbd416..ed42ed75f7 100644
--- a/components/bt/esp_ble_mesh/core/include/mesh/access.h
+++ b/components/bt/esp_ble_mesh/core/include/mesh/access.h
@@ -4,7 +4,7 @@
 
 /*
  * SPDX-FileCopyrightText: 2017 Intel Corporation
- * SPDX-FileContributor: 2018-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileContributor: 2018-2023 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
diff --git a/components/bt/esp_ble_mesh/core/include/mesh/adapter.h b/components/bt/esp_ble_mesh/core/include/mesh/adapter.h
index 431fc72cfe..e1b8af79bf 100644
--- a/components/bt/esp_ble_mesh/core/include/mesh/adapter.h
+++ b/components/bt/esp_ble_mesh/core/include/mesh/adapter.h
@@ -810,6 +810,9 @@ enum {
     BLE_MESH_EXCEP_LIST_TYPE_MESH_BEACON,
     BLE_MESH_EXCEP_LIST_TYPE_MESH_PROV_ADV,
     BLE_MESH_EXCEP_LIST_TYPE_MESH_PROXY_ADV,
+    BLE_MESH_EXCEP_LIST_TYPE_MESH_SOLIC_PDU,
+    BLE_MESH_EXCEP_LIST_TYPE_MESH_URI,
+    BLE_MESH_EXCEP_LIST_TYPE_MAX,
 };
 
 #define BLE_MESH_EXCEP_LIST_CLEAN_ADDR_LIST              BIT(0)
@@ -817,8 +820,10 @@ enum {
 #define BLE_MESH_EXCEP_LIST_CLEAN_MESH_BEACON_LIST       BIT(2)
 #define BLE_MESH_EXCEP_LIST_CLEAN_MESH_PROV_ADV_LIST     BIT(3)
 #define BLE_MESH_EXCEP_LIST_CLEAN_MESH_PROXY_ADV_LIST    BIT(4)
-#define BLE_MESH_EXCEP_LIST_CLEAN_ALL_LIST               (BIT(0) | BIT(1) | \
-                                                          BIT(2) | BIT(3) | BIT(4))
+#define BLE_MESH_EXCEP_LIST_CLEAN_MESH_SOLIC_PDU_LIST    BIT(5)
+#define BLE_MESH_EXCEP_LIST_CLEAN_MESH_URI_LIST          BIT(6)
+#define BLE_MESH_EXCEP_LIST_CLEAN_ALL_LIST               (BIT(0) | BIT(1) | BIT(2) | BIT(3) | \
+                                                          BIT(4) | BIT(5) | BIT(6))
 
 int bt_mesh_update_exceptional_list(uint8_t sub_code, uint32_t type, void *info);
 
diff --git a/components/bt/esp_ble_mesh/core/include/mesh/cfg_srv.h b/components/bt/esp_ble_mesh/core/include/mesh/cfg_srv.h
index 99c67eab49..dc46c19041 100644
--- a/components/bt/esp_ble_mesh/core/include/mesh/cfg_srv.h
+++ b/components/bt/esp_ble_mesh/core/include/mesh/cfg_srv.h
@@ -212,6 +212,8 @@ typedef union {
     } cfg_net_transmit_set;
 } bt_mesh_cfg_server_state_change_t;
 
+void bt_mesh_relay_local_set(bool enable);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/components/bt/esp_ble_mesh/core/include/mesh/uuid.h b/components/bt/esp_ble_mesh/core/include/mesh/uuid.h
index bd63b84d86..bea37c6ef4 100644
--- a/components/bt/esp_ble_mesh/core/include/mesh/uuid.h
+++ b/components/bt/esp_ble_mesh/core/include/mesh/uuid.h
@@ -141,6 +141,11 @@ struct bt_mesh_uuid_128 {
  */
 #define BLE_MESH_UUID_MESH_PROXY                BLE_MESH_UUID_DECLARE_16(0x1828)
 #define BLE_MESH_UUID_MESH_PROXY_VAL            0x1828
+/** @def BLE_MESH_UUID_MESH_PROXY_SOLIC_VAL
+ *  @brief Mesh Proxy Solicitation UUID
+ */
+#define BLE_MESH_UUID_MESH_PROXY_SOLIC          BLE_MESH_UUID_DECLARE_16(0x1859)
+#define BLE_MESH_UUID_MESH_PROXY_SOLIC_VAL      0x1859
 /** @def BLE_MESH_UUID_GATT_PRIMARY
  *  @brief GATT Primary Service
  */
@@ -466,10 +471,6 @@ struct bt_mesh_uuid_128 {
  */
 #define BLE_MESH_UUID_MESH_PROXY_DATA_OUT       BLE_MESH_UUID_DECLARE_16(0x2ade)
 #define BLE_MESH_UUID_MESH_PROXY_DATA_OUT_VAL   0x2ade
-/** @def BLE_MESH_UUID_MESH_PROXY_SOLIC_VAL
- *  @brief Mesh Proxy Solicitation UUID
- */
-#define BLE_MESH_UUID_MESH_PROXY_SOLIC_VAL      0x7fcb
 
 /*
  * Protocol UUIDs
diff --git a/components/bt/esp_ble_mesh/core/local.c b/components/bt/esp_ble_mesh/core/local.c
index b8bcfffa55..4451e0d7b2 100644
--- a/components/bt/esp_ble_mesh/core/local.c
+++ b/components/bt/esp_ble_mesh/core/local.c
@@ -148,10 +148,9 @@ int bt_mesh_enable_directed_forwarding(uint16_t net_idx, bool directed_forwardin
 
     return 0;
 }
+#endif /* CONFIG_BLE_MESH_DF_SRV */
 
-#endif
 #if CONFIG_BLE_MESH_NODE
-
 const uint8_t *bt_mesh_node_get_local_net_key(uint16_t net_idx)
 {
     struct bt_mesh_subnet *sub = NULL;
@@ -369,5 +368,4 @@ int bt_mesh_node_bind_app_key_to_model(uint16_t elem_addr, uint16_t mod_id,
     BT_ERR("Model bound is full!");
     return -ENOMEM;
 }
-
 #endif /* CONFIG_BLE_MESH_NODE */
diff --git a/components/bt/esp_ble_mesh/core/lpn.c b/components/bt/esp_ble_mesh/core/lpn.c
index 98c24a323b..f445be5632 100644
--- a/components/bt/esp_ble_mesh/core/lpn.c
+++ b/components/bt/esp_ble_mesh/core/lpn.c
@@ -238,6 +238,20 @@ static void clear_friendship(bool force, bool disable)
         lpn_cb(lpn->frnd, false);
     }
 
+    /* If the Low Power node supports directed forwarding functionality when
+     * the friendship is established in a subnet, the Low Power node shall
+     * store the current value of the Directed Forwarding state and shall set
+     * the state to 0x00 for that subnet. When that friendship is terminated,
+     * the Low Power node shall set the Directed Forwarding state to the stored
+     * value.
+     */
+#if CONFIG_BLE_MESH_DF_SRV
+    if (lpn->established) {
+        bt_mesh_restore_directed_forwarding_state(bt_mesh.sub[0].net_idx,
+                                                  lpn->old_directed_forwarding);
+    }
+#endif
+
     lpn->frnd = BLE_MESH_ADDR_UNASSIGNED;
     lpn->fsn = 0U;
     lpn->req_attempts = 0U;
@@ -1027,9 +1041,9 @@ int bt_mesh_lpn_friend_update(struct bt_mesh_net_rx *rx,
          * the Low Power node shall set the Directed Forwarding state to the stored
          * value.
          */
-        /* TODO:
-         * Store - clear - restore directed forwarding state value of the subnet.
-         */
+#if CONFIG_BLE_MESH_DF_SRV
+        lpn->old_directed_forwarding = bt_mesh_get_and_disable_directed_forwarding_state(sub);
+#endif
     }
 
     friend_response_received(lpn);
diff --git a/components/bt/esp_ble_mesh/core/net.c b/components/bt/esp_ble_mesh/core/net.c
index 072768fca5..340cf7d7ac 100644
--- a/components/bt/esp_ble_mesh/core/net.c
+++ b/components/bt/esp_ble_mesh/core/net.c
@@ -606,6 +606,13 @@ bool bt_mesh_kr_update(struct bt_mesh_subnet *sub, uint8_t new_kr, bool new_key)
         case BLE_MESH_KR_PHASE_2:
             BT_INFO("KR Phase 0x%02x -> Normal", sub->kr_phase);
 
+#if CONFIG_BLE_MESH_PRB_SRV
+            /* In this case, consider that kr_flag has changed, so
+             * need to modify the content of the random field.
+             */
+            bt_mesh_private_beacon_update_random(sub);
+#endif
+
             sub->kr_phase = BLE_MESH_KR_NORMAL;
             bt_mesh_net_revoke_keys(sub);
 
@@ -669,13 +676,26 @@ bool bt_mesh_net_iv_update(uint32_t iv_index, bool iv_update)
 {
     int i;
 
+    /* If a node in Normal Operation receives a Secure Network beacon or
+     * a Mesh Private beacon with an IV index less than the last known
+     * IV Index or greater than the last known IV Index + 42, the Secure
+     * Network beacon or the Mesh Private beacon shall be ignored.
+     */
+    if (iv_index < bt_mesh.iv_index ||
+        iv_index > bt_mesh.iv_index + 42) {
+        BT_ERR("IV Index out of sync: 0x%08x != 0x%08x",
+                iv_index, bt_mesh.iv_index);
+        return false;
+    }
+
     if (bt_mesh_atomic_test_bit(bt_mesh.flags, BLE_MESH_IVU_IN_PROGRESS)) {
         /* We're currently in IV Update mode */
-
-        if (iv_index != bt_mesh.iv_index) {
-            BT_WARN("IV Index mismatch: 0x%08x != 0x%08x",
-                    iv_index, bt_mesh.iv_index);
-            return false;
+        if (iv_index >= bt_mesh.iv_index + 1) {
+            BT_WARN("Performing IV Index Recovery");
+            (void)memset(bt_mesh.rpl, 0, sizeof(bt_mesh.rpl));
+            bt_mesh.iv_index = iv_index;
+            bt_mesh.seq = 0U;
+            goto do_update;
         }
 
         if (iv_update) {
@@ -691,18 +711,6 @@ bool bt_mesh_net_iv_update(uint32_t iv_index, bool iv_update)
             return false;
         }
 
-        /* If a node in Normal Operation receives a Secure Network beacon or
-         * a Mesh Private beacon with an IV index less than the last known
-         * IV Index or greater than the last known IV Index + 42, the Secure
-         * Network beacon or the Mesh Private beacon shall be ignored.
-         */
-        if (iv_index < bt_mesh.iv_index ||
-            iv_index > bt_mesh.iv_index + 42) {
-            BT_ERR("IV Index out of sync: 0x%08x != 0x%08x",
-                   iv_index, bt_mesh.iv_index);
-            return false;
-        }
-
         /* If a node in Normal Operation receives a Secure Network beacon
          * or a Mesh Private beacon with an IV index greater than the
          * last known IV Index + 1, it may initiate an IV Index Recovery
@@ -1027,6 +1035,7 @@ int bt_mesh_net_send(struct bt_mesh_net_tx *tx, struct net_buf *buf,
         tx->ctx->send_ttl = bt_mesh_default_ttl_get();
     }
 
+#if 0
     /* The output filter of the interface connected to advertising
      * or GATT bearers shall drop all messages with the TTL value
      * set to 1 unless they contain a network PDU that is tagged
@@ -1038,6 +1047,7 @@ int bt_mesh_net_send(struct bt_mesh_net_tx *tx, struct net_buf *buf,
         err = -EIO;
         goto done;
     }
+#endif
 
     /* Spec:
      * If the message security material is not set by the network
@@ -1246,7 +1256,7 @@ int net_decrypt(struct bt_mesh_subnet *sub, const uint8_t *enc,
 
     rx->ctx.addr = BLE_MESH_NET_HDR_SRC(buf->data);
     if (!BLE_MESH_ADDR_IS_UNICAST(rx->ctx.addr)) {
-        BT_INFO("Ignoring non-unicast src addr 0x%04x", rx->ctx.addr);
+        BT_DBG("Ignoring non-unicast src addr 0x%04x", rx->ctx.addr);
         return -EINVAL;
     }
 
@@ -1397,7 +1407,8 @@ static bool relay_to_adv(enum bt_mesh_net_if net_if)
     case BLE_MESH_NET_IF_ADV:
         return (bt_mesh_relay_get() == BLE_MESH_RELAY_ENABLED);
     case BLE_MESH_NET_IF_PROXY:
-        return (bt_mesh_gatt_proxy_get() == BLE_MESH_GATT_PROXY_ENABLED);
+        return (bt_mesh_gatt_proxy_get() == BLE_MESH_GATT_PROXY_ENABLED ||
+                bt_mesh_private_gatt_proxy_state_get() == BLE_MESH_PRIVATE_GATT_PROXY_ENABLED);
     default:
         return false;
     }
@@ -1465,6 +1476,13 @@ static void bt_mesh_net_relay(struct net_buf_simple *sbuf,
         return;
     }
 
+#if CONFIG_BLE_MESH_BRC_SRV
+    if (rx->sbr_rpl) {
+        BT_ERR("Bridge RPL attack");
+        goto done;
+    }
+#endif
+
     if (cred != BLE_MESH_FLOODING_CRED
 #if CONFIG_BLE_MESH_DF_SRV
          && cred != BLE_MESH_DIRECTED_CRED
@@ -1474,8 +1492,13 @@ static void bt_mesh_net_relay(struct net_buf_simple *sbuf,
         return;
     }
 
-    if (rx->ctx.recv_ttl == 0x01 && bt_mesh_tag_relay(tag) == false) {
-        BT_DBG("Ignore PDU with TTL=1 but not tagged as relay");
+    if (rx->ctx.recv_ttl == 0x01) {
+        BT_DBG("Ignore PDU with TTL = 1");
+        return;
+    }
+
+    if (rx->ctx.recv_ttl == 0x02 && bt_mesh_tag_relay(tag) == false) {
+        BT_DBG("Ignore PDU with TTL = 2 but not tagged as relay");
         return;
     }
 
@@ -1553,10 +1576,11 @@ static void bt_mesh_net_relay(struct net_buf_simple *sbuf,
 
     BT_DBG("Relaying packet. TTL is now %u", BLE_MESH_NET_HDR_TTL(buf->data));
 
-    /* 1. Update NID if RX or RX was with friend credentials.
+    /* 1. Update NID if RX or RX was with friend credentials(included by case 3).
      * 2. Update NID if the net_key has changed.
+     * 3. Update NID if credential has changed.
      */
-    if (rx->ctx.recv_cred == BLE_MESH_FRIENDSHIP_CRED || netkey_changed) {
+    if (netkey_changed || cred != rx->ctx.recv_cred) {
         buf->data[0] &= 0x80; /* Clear everything except IVI */
         buf->data[0] |= nid;
     }
@@ -1600,19 +1624,6 @@ static void bt_mesh_net_relay(struct net_buf_simple *sbuf,
     if (((bearer & BLE_MESH_ADV_BEARER) && relay_to_adv(rx->net_if)) ||
         netkey_changed ||
         rx->ctx.recv_cred == BLE_MESH_FRIENDSHIP_CRED) {
-        /* NOTE: temporary add for case MESH/NODE/SBR/NET/BV-01-C */
-#if CONFIG_BLE_MESH_BRC_SRV
-        if (bt_mesh_bridge_rpl_check(rx, NULL) && netkey_changed) {
-            BT_ERR("It is RPL attack, not bridge");
-            /**
-             * @todo:/NODE/DF/INIT/BV-TBD-C,
-             * The message from LT2 was double-checked,
-             * so the message was mistaken for an RPL attack.
-            */
-            goto done;
-        }
-#endif
-
 #if !CONFIG_BLE_MESH_RELAY_ADV_BUF
         bt_mesh_adv_send(buf, xmit, NULL, NULL);
 #else
diff --git a/components/bt/esp_ble_mesh/core/net.h b/components/bt/esp_ble_mesh/core/net.h
index b9dfb42dda..60ca5dc6ab 100644
--- a/components/bt/esp_ble_mesh/core/net.h
+++ b/components/bt/esp_ble_mesh/core/net.h
@@ -58,7 +58,6 @@ struct bt_mesh_subnet {
     uint8_t  mpb_flags_last;            /* Flags of last sent private beacon */
     uint8_t  mpb_ivi_last: 1;           /* IV Index of last sent private beacon */
     uint8_t  mpb_random[13];            /* Random of current private beacon */
-    uint8_t  mpb_random_last[13];       /* Random of last sent private beacon */
 
     uint8_t  private_node_id;           /* Private Node Identity State */
 #endif /* CONFIG_BLE_MESH_PRIVATE_BEACON */
@@ -274,6 +273,10 @@ struct bt_mesh_lpn {
     /* Previous Friend of this LPN */
     uint16_t old_friend;
 
+#if CONFIG_BLE_MESH_DF_SRV
+    uint8_t  old_directed_forwarding;
+#endif
+
     /* Duration reported for last advertising packet */
     uint16_t adv_duration;
 
@@ -381,13 +384,14 @@ struct bt_mesh_net_rx {
     struct bt_mesh_subnet *sub;
     struct bt_mesh_msg_ctx ctx;
     uint32_t seq;            /* Sequence Number */
-    uint8_t  old_iv:1,       /* iv_index - 1 was used */
+    uint16_t old_iv:1,       /* iv_index - 1 was used */
              new_key:1,      /* Data was encrypted with updated key */
              friend_cred:1 __attribute__((deprecated)), /* Data was encrypted with friend cred */
              ctl:1,          /* Network Control */
              net_if:2,       /* Network interface */
              local_match:1,  /* Matched a local element */
-             friend_match:1; /* Matched an LPN we're friends for */
+             friend_match:1, /* Matched an LPN we're friends for */
+             sbr_rpl:1;      /* Bridge RPL attacker */
     uint16_t msg_cache_idx;  /* Index of entry in message cache */
 };
 
@@ -406,7 +410,7 @@ extern struct bt_mesh_net bt_mesh;
 
 #define BLE_MESH_NET_IVI_TX         (bt_mesh.iv_index - \
                                      bt_mesh_atomic_test_bit(bt_mesh.flags, \
-                                     BLE_MESH_IVU_IN_PROGRESS))
+                                                             BLE_MESH_IVU_IN_PROGRESS))
 #define BLE_MESH_NET_IVI_RX(rx)     (bt_mesh.iv_index - (rx)->old_iv)
 
 #define BLE_MESH_NET_HDR_LEN        9
diff --git a/components/bt/esp_ble_mesh/core/nimble_host/adapter.c b/components/bt/esp_ble_mesh/core/nimble_host/adapter.c
index eec69f1080..806f4e0eb5 100644
--- a/components/bt/esp_ble_mesh/core/nimble_host/adapter.c
+++ b/components/bt/esp_ble_mesh/core/nimble_host/adapter.c
@@ -1958,6 +1958,16 @@ int bt_mesh_update_exceptional_list(uint8_t sub_code, uint32_t type, void *info)
             BT_ERR("Invalid Provisioning Link ID");
             return -EINVAL;
         }
+
+        /* When removing an unused link (i.e., Link ID is 0), and since
+         * Controller has never added this Link ID, it will cause error
+         * log been wrongly reported.
+         * Therefore, add this check here to avoid such occurrences.
+         */
+        if (*(uint32_t *)info == 0) {
+            return 0;
+        }
+
         sys_memcpy_swap(value, info, sizeof(uint32_t));
     }
 
diff --git a/components/bt/esp_ble_mesh/core/prov_common.h b/components/bt/esp_ble_mesh/core/prov_common.h
index 4671b07f21..561712ef14 100644
--- a/components/bt/esp_ble_mesh/core/prov_common.h
+++ b/components/bt/esp_ble_mesh/core/prov_common.h
@@ -62,8 +62,8 @@ extern "C" {
 #define REC_RSP_REC_NOT_PRESENT         0x01
 #define REC_RSP_OFFSET_OUT_OF_BOUND     0x02
 
-#define CERT_BASED_PROV_SUPPORT(oob)    ((oob) & BIT_MASK(7))
-#define PROV_REC_SUPPORT(oob)           ((oob) & BIT_MASK(8))
+#define CERT_BASED_PROV_SUPPORT(oob)    ((oob) & BIT(7))
+#define PROV_REC_SUPPORT(oob)           ((oob) & BIT(8))
 
 #if CONFIG_BLE_MESH_PROV_EPA
 #define PROV_ENC_SIZE(link)             ((link)->algorithm == PROV_ALG_P256_HMAC_SHA256 ? 32 : 16)
diff --git a/components/bt/esp_ble_mesh/core/prov_pvnr.c b/components/bt/esp_ble_mesh/core/prov_pvnr.c
index c6902333ed..50811a3082 100644
--- a/components/bt/esp_ble_mesh/core/prov_pvnr.c
+++ b/components/bt/esp_ble_mesh/core/prov_pvnr.c
@@ -371,8 +371,7 @@ static int provisioner_start_prov_pb_adv(const uint8_t uuid[16], const bt_mesh_a
 
     for (i = 0; i < CONFIG_BLE_MESH_PBA_SAME_TIME; i++) {
         if (!bt_mesh_atomic_test_bit(prov_links[i].flags, LINK_ACTIVE) &&
-            !bt_mesh_atomic_test_bit(prov_links[i].flags, LINK_CLOSING)
-            ) {
+            !bt_mesh_atomic_test_bit(prov_links[i].flags, LINK_CLOSING)) {
             memcpy(prov_links[i].uuid, uuid, 16);
             prov_links[i].oob_info = oob_info;
             if (addr) {
@@ -1070,14 +1069,24 @@ static void reset_adv_link(struct bt_mesh_prov_link *link, uint8_t reason)
 
 static void send_link_open(struct bt_mesh_prov_link *link)
 {
+    uint8_t count;
     int i;
 
-    /* Generate link ID, and may need to check if this id is
-     * currently being used, which may will not happen ever.
-     */
-    bt_mesh_rand(&link->link_id, sizeof(link->link_id));
+    link->link_id = 0;
 
     while (1) {
+        count = 0;
+
+        /* Make sure the generated Link ID is not 0 */
+        while(link->link_id == 0) {
+            bt_mesh_rand(&link->link_id, sizeof(link->link_id));
+            if (count++ > 10) {
+                BT_ERR("Link ID error: all zero");
+                return;
+            }
+        }
+
+        /* Check if the generated Link ID is the same with other links */
         for (i = 0; i < CONFIG_BLE_MESH_PBA_SAME_TIME; i++) {
             if (bt_mesh_atomic_test_bit(prov_links[i].flags, LINK_ACTIVE) &&
                 prov_links[i].link_id == link->link_id) {
@@ -1085,6 +1094,7 @@ static void send_link_open(struct bt_mesh_prov_link *link)
                 break;
             }
         }
+
         if (i == CONFIG_BLE_MESH_PBA_SAME_TIME) {
             break;
         }
@@ -3037,8 +3047,8 @@ void bt_mesh_provisioner_prov_adv_recv(struct net_buf_simple *buf,
 
     uuid = buf->data;
     net_buf_simple_pull(buf, 16);
-    /* Mesh beacon uses big-endian to send beacon data */
-    oob_info = net_buf_simple_pull_be16(buf);
+    /* According CSS, all the field within adv data shall be little-endian */
+    oob_info = net_buf_simple_pull_le16(buf);
 
     if (provisioner_check_unprov_dev_info(uuid, BLE_MESH_PROV_GATT)) {
         return;
diff --git a/components/bt/esp_ble_mesh/core/proxy_server.c b/components/bt/esp_ble_mesh/core/proxy_server.c
index aa360b85f8..020793dc6e 100644
--- a/components/bt/esp_ble_mesh/core/proxy_server.c
+++ b/components/bt/esp_ble_mesh/core/proxy_server.c
@@ -35,7 +35,8 @@ _Static_assert(!(IS_ENABLED(CONFIG_BLE_MESH_GATT_PROXY_SERVER) && IS_ENABLED(CON
 
 #define ADV_OPT     (BLE_MESH_ADV_OPT_CONNECTABLE | BLE_MESH_ADV_OPT_ONE_TIME)
 
-#if CONFIG_BLE_MESH_GATT_PROXY_SERVER && CONFIG_BLE_MESH_PRB_SRV
+#if CONFIG_BLE_MESH_GATT_PROXY_SERVER && \
+    (CONFIG_BLE_MESH_PRB_SRV || CONFIG_BLE_MESH_PROXY_SOLIC_PDU_RX)
 #define RAND_UPDATE_INTERVAL    K_MINUTES(10)
 
 /* The Random field of Private Network Identity
@@ -438,12 +439,12 @@ static int beacon_send(struct bt_mesh_proxy_client *client, struct bt_mesh_subne
 
 #if CONFIG_BLE_MESH_PROXY_PRIVACY
     if (client->proxy_privacy == BLE_MESH_PROXY_PRIVACY_ENABLED) {
-        bt_mesh_private_beacon_create(sub, &buf);
-
         /* NOTE: Each time a Mesh Private beacon for a subnet is sent to a Proxy Client,
          * the Random field in the Mesh Private beacon shall be regenerated.
          */
         bt_mesh_private_beacon_update_random(sub);
+
+        bt_mesh_private_beacon_create(sub, &buf);
     } else
 #endif
     {
@@ -476,22 +477,9 @@ static void proxy_send_beacons(struct k_work *work)
     for (i = 0; i < ARRAY_SIZE(bt_mesh.sub); i++) {
         struct bt_mesh_subnet *sub = &bt_mesh.sub[i];
 
-#if 0
-        if (bt_mesh_gatt_proxy_get() == BLE_MESH_GATT_PROXY_ENABLED ||
-            sub->node_id == BLE_MESH_NODE_IDENTITY_RUNNING) {
-            sub->proxy_privacy = BLE_MESH_PROXY_PRIVACY_DISABLED;
-        } else if (true) {
-#if CONFIG_BLE_MESH_PRB_SRV
-            /* TODO: Check if Private GATT Proxy or Private Node Identity is enabled */
-#endif
-            sub->proxy_privacy = BLE_MESH_PROXY_PRIVACY_ENABLED;
-        } else {
-            sub->proxy_privacy = BLE_MESH_PROXY_PRIVACY_NOT_SUPPORTED;
-        }
-#endif
-
         if (sub->net_idx != BLE_MESH_KEY_UNUSED) {
             beacon_send(client, sub);
+
 #if CONFIG_BLE_MESH_DF_SRV
             if (sub->directed_proxy != BLE_MESH_DIRECTED_PROXY_NOT_SUPPORTED) {
                 bt_mesh_directed_proxy_server_directed_proxy_caps_status_send(client->conn, sub);
@@ -630,16 +618,58 @@ static bool is_exist_private_node_id_enable(void)
     return false;
 }
 
-void disable_all_private_node_identity(void)
+int bt_mesh_proxy_private_identity_disable(void)
 {
+    if (!bt_mesh_is_provisioned()) {
+        return -EAGAIN;
+    }
+
     for (size_t i = 0; i < ARRAY_SIZE(bt_mesh.sub); i++) {
         /* NOTE: Set private node identity state of all valid subnets disabled */
         struct bt_mesh_subnet *sub = &bt_mesh.sub[i];
 
-        if (sub->net_idx != BLE_MESH_KEY_UNUSED) {
-            bt_mesh_proxy_server_private_identity_stop(sub);
+        if (sub->net_idx == BLE_MESH_KEY_UNUSED) {
+            continue;
         }
+
+        if (sub->private_node_id == BLE_MESH_PRIVATE_NODE_IDENTITY_NOT_SUPPORTED) {
+            continue;
+        }
+
+        bt_mesh_proxy_server_private_identity_stop(sub);
     }
+
+    return 0;
+}
+
+int bt_mesh_proxy_private_identity_enable(void)
+{
+    int count = 0;
+
+    if (!bt_mesh_is_provisioned()) {
+        return -EAGAIN;
+    }
+
+    for (size_t i = 0U; i < ARRAY_SIZE(bt_mesh.sub); i++) {
+        struct bt_mesh_subnet *sub = &bt_mesh.sub[i];
+
+        if (sub->net_idx == BLE_MESH_KEY_UNUSED) {
+            continue;
+        }
+
+        if (sub->private_node_id == BLE_MESH_PRIVATE_NODE_IDENTITY_NOT_SUPPORTED) {
+            continue;
+        }
+
+        bt_mesh_proxy_server_private_identity_start(sub);
+        count++;
+    }
+
+    if (count) {
+        bt_mesh_adv_update();
+    }
+
+    return 0;
 }
 #endif /* CONFIG_BLE_MESH_PRB_SRV */
 #endif /* GATT_PROXY */
@@ -1373,7 +1403,7 @@ static const struct bt_mesh_adv_data net_id_ad[] = {
     BLE_MESH_ADV_DATA(BLE_MESH_DATA_SVC_DATA16, proxy_svc_data, NET_ID_LEN),
 };
 
-#if CONFIG_BLE_MESH_PRB_SRV
+#if CONFIG_BLE_MESH_PRB_SRV || CONFIG_BLE_MESH_PROXY_SOLIC_PDU_RX
 static const struct bt_mesh_adv_data private_node_id_ad[] = {
     BLE_MESH_ADV_DATA_BYTES(BLE_MESH_DATA_FLAGS, (BLE_MESH_AD_GENERAL | BLE_MESH_AD_NO_BREDR)),
     BLE_MESH_ADV_DATA_BYTES(BLE_MESH_DATA_UUID16_ALL, 0x28, 0x18),
@@ -1533,23 +1563,6 @@ static int private_node_id_adv(struct bt_mesh_subnet *sub)
 
     return 0;
 }
-
-void bt_mesh_prb_pnid_adv_local_set(bool start)
-{
-    for (size_t i = 0U; i < ARRAY_SIZE(bt_mesh.sub); i++) {
-        struct bt_mesh_subnet *sub = &bt_mesh.sub[i];
-
-        if (sub->net_idx == BLE_MESH_KEY_UNUSED) {
-            continue;
-        }
-
-        if (start) {
-            bt_mesh_proxy_server_private_identity_start(sub);
-        } else {
-            bt_mesh_proxy_server_private_identity_stop(sub);
-        }
-    }
-}
 #endif /* CONFIG_BLE_MESH_PRB_SRV */
 
 #if (CONFIG_BLE_MESH_PRB_SRV || \
@@ -1751,7 +1764,8 @@ static size_t gatt_prov_adv_create(struct bt_mesh_adv_data prov_sd[2])
     }
 
     memcpy(prov_svc_data + 2, bt_mesh_prov_get()->uuid, 16);
-    sys_put_be16(bt_mesh_prov_get()->oob_info, prov_svc_data + 18);
+    /* According CSS, all the field within adv data shall be little-endian */
+    sys_put_le16(bt_mesh_prov_get()->oob_info, prov_svc_data + 18);
 
     if (bt_mesh_prov_get()->uri) {
         size_t uri_len = strlen(bt_mesh_prov_get()->uri);
diff --git a/components/bt/esp_ble_mesh/core/proxy_server.h b/components/bt/esp_ble_mesh/core/proxy_server.h
index 5ae0a08126..b98728910d 100644
--- a/components/bt/esp_ble_mesh/core/proxy_server.h
+++ b/components/bt/esp_ble_mesh/core/proxy_server.h
@@ -107,9 +107,9 @@ void bt_mesh_disable_private_gatt_proxy(void);
 
 bool bt_mesh_proxy_server_is_node_id_enable(void);
 
-void disable_all_private_node_identity(void);
+int bt_mesh_proxy_private_identity_disable(void);
 
-void bt_mesh_prb_pnid_adv_local_set(bool start);
+int bt_mesh_proxy_private_identity_enable(void);
 #endif /* CONFIG_BLE_MESH_PRB_SRV */
 
 void bt_mesh_proxy_server_identity_start(struct bt_mesh_subnet *sub);
diff --git a/components/bt/esp_ble_mesh/core/rpl.c b/components/bt/esp_ble_mesh/core/rpl.c
index cbf763bd01..2b44350805 100644
--- a/components/bt/esp_ble_mesh/core/rpl.c
+++ b/components/bt/esp_ble_mesh/core/rpl.c
@@ -87,11 +87,6 @@ bool bt_mesh_rpl_check(struct bt_mesh_net_rx *rx, struct bt_mesh_rpl **match)
     return rpl_check_and_store(rx, match);
 }
 
-bool bt_mesh_bridge_rpl_check(struct bt_mesh_net_rx *rx, struct bt_mesh_rpl **match)
-{
-    return rpl_check_and_store(rx, match);
-}
-
 void bt_mesh_rpl_update(void)
 {
     /* Discard "old old" IV Index entries from RPL and flag
diff --git a/components/bt/esp_ble_mesh/core/rpl.h b/components/bt/esp_ble_mesh/core/rpl.h
index ae4e49f734..cb6fef5e82 100644
--- a/components/bt/esp_ble_mesh/core/rpl.h
+++ b/components/bt/esp_ble_mesh/core/rpl.h
@@ -20,8 +20,6 @@ void bt_mesh_update_rpl(struct bt_mesh_rpl *rpl, struct bt_mesh_net_rx *rx);
 
 bool bt_mesh_rpl_check(struct bt_mesh_net_rx *rx, struct bt_mesh_rpl **match);
 
-bool bt_mesh_bridge_rpl_check(struct bt_mesh_net_rx *rx, struct bt_mesh_rpl **match);
-
 void bt_mesh_rpl_update(void);
 
 void bt_mesh_rpl_reset_single(uint16_t src, bool erase);
diff --git a/components/bt/esp_ble_mesh/v1.1/api/core/include/esp_ble_mesh_sar_model_api.h b/components/bt/esp_ble_mesh/v1.1/api/core/include/esp_ble_mesh_sar_model_api.h
index 74a4b59374..47609c5f8b 100644
--- a/components/bt/esp_ble_mesh/v1.1/api/core/include/esp_ble_mesh_sar_model_api.h
+++ b/components/bt/esp_ble_mesh/v1.1/api/core/include/esp_ble_mesh_sar_model_api.h
@@ -70,8 +70,9 @@ typedef struct {
 typedef struct {
     uint8_t sar_segments_threshold:5,                       /*!< SAR Segments Threshold state */
             sar_ack_delay_increment:3;                      /*!< SAR Acknowledgment Delay Increment state */
-    uint8_t sar_ack_retrans_count:2,                        /*!< SAR Acknowledgment Retransmissions Count state */
-            sar_discard_timeout:4;                          /*!< SAR Discard Timeout state */
+    uint8_t sar_discard_timeout:4,                          /*!< SAR Discard Timeout state */
+            sar_receiver_segment_interval_step:4;           /*!< SAR Receiver Segment Interval Step state */
+    uint8_t sar_ack_retrans_count:4;                        /*!< SAR Acknowledgment Retransmissions Count state */
 } esp_ble_mesh_sar_receiver_set_t;
 
 /**
@@ -97,8 +98,9 @@ typedef struct {
 typedef struct {
     uint8_t sar_segments_threshold:5,                       /*!< SAR Segments Threshold state */
             sar_ack_delay_increment:3;                      /*!< SAR Acknowledgment Delay Increment state */
-    uint8_t sar_ack_retrans_count:2,                        /*!< SAR Acknowledgment Retransmissions Count state */
-            sar_discard_timeout:4;                          /*!< SAR Discard Timeout state */
+    uint8_t sar_discard_timeout:4,                          /*!< SAR Discard Timeout state */
+            sar_receiver_segment_interval_step:4;           /*!< SAR Receiver Segment Interval Step state */
+    uint8_t sar_ack_retrans_count:4;                        /*!< SAR Acknowledgment Retransmissions Count state */
 } esp_ble_mesh_sar_receiver_status_t;
 
 /** Result of sending SAR Configuration Client messages */
diff --git a/components/bt/esp_ble_mesh/v1.1/ext.c b/components/bt/esp_ble_mesh/v1.1/ext.c
index 048bcc1c59..3208ebb72a 100644
--- a/components/bt/esp_ble_mesh/v1.1/ext.c
+++ b/components/bt/esp_ble_mesh/v1.1/ext.c
@@ -76,6 +76,7 @@
 #define CLI_PARAM(a)    ((bt_mesh_client_common_param_t *)(a))
 #define CLI_NODE(a)     ((bt_mesh_client_node_t *)(a))
 #define ADV_DATA(a)     ((const struct bt_mesh_adv_data *)(a))
+#define RPL(a)          ((struct bt_mesh_rpl *)(a))
 #define VOID(a)         ((void *)(a))
 
 /* Sys utilities */
@@ -739,6 +740,11 @@ size_t bt_mesh_ext_comp_get_elem_count(const void *comp)
     return COMP(comp)->elem_count;
 }
 
+void *bt_mesh_ext_comp_get_elem_s(const void *comp)
+{
+    return COMP(comp)->elem;
+}
+
 void *bt_mesh_ext_comp_get_elem(const void *comp, uint8_t index)
 {
     return &COMP(comp)->elem[index];
@@ -2228,6 +2234,56 @@ bool bt_mesh_ext_lpn_match(uint16_t addr)
 #endif /* CONFIG_BLE_MESH_LOW_POWER */
 }
 
+uint16_t bt_mesh_ext_lpn_frnd(void)
+{
+#if CONFIG_BLE_MESH_LOW_POWER
+    return bt_mesh.lpn.frnd;
+#else
+    assert(0);
+    return 0;
+#endif /* CONFIG_BLE_MESH_LOW_POWER */
+}
+
+/* RPL */
+uint16_t bt_mesh_ext_rpl_get_src(void *rpl)
+{
+#if CONFIG_BLE_MESH_LOW_POWER
+    return RPL(rpl)->src;
+#else
+    assert(0);
+    return 0;
+#endif /* CONFIG_BLE_MESH_LOW_POWER */
+}
+
+bool bt_mesh_ext_rpl_get_old_iv(void *rpl)
+{
+#if CONFIG_BLE_MESH_LOW_POWER
+    return RPL(rpl)->old_iv;
+#else
+    assert(0);
+    return false;
+#endif /* CONFIG_BLE_MESH_LOW_POWER */
+}
+
+uint32_t bt_mesh_ext_rpl_get_seq(void *rpl)
+{
+#if CONFIG_BLE_MESH_LOW_POWER
+    return RPL(rpl)->seq;
+#else
+    assert(0);
+    return 0;
+#endif /* CONFIG_BLE_MESH_LOW_POWER */
+}
+
+void bt_mesh_ext_update_rpl(void *rpl, void *rx)
+{
+#if CONFIG_BLE_MESH_LOW_POWER
+    bt_mesh_update_rpl(RPL(rpl), NET_RX(rx));
+#else
+    assert(0);
+#endif /* CONFIG_BLE_MESH_LOW_POWER */
+}
+
 /* Adv */
 uint8_t bt_mesh_ext_adv_data_get_type(const void *ad)
 {
@@ -2558,16 +2614,6 @@ uint8_t *bt_mesh_ext_sub_get_mpb_random(void *sub)
 #endif /* CONFIG_BLE_MESH_PRIVATE_BEACON */
 }
 
-uint8_t *bt_mesh_ext_sub_get_mpb_random_last(void *sub)
-{
-#if CONFIG_BLE_MESH_PRIVATE_BEACON
-    return SUBNET(sub)->mpb_random_last;
-#else
-    assert(0);
-    return NULL;
-#endif /* CONFIG_BLE_MESH_PRIVATE_BEACON */
-}
-
 uint8_t bt_mesh_ext_sub_get_private_node_id(void *sub)
 {
 #if CONFIG_BLE_MESH_PRIVATE_BEACON
@@ -3419,6 +3465,21 @@ void bt_mesh_ext_net_rx_set_net_if(void *rx, uint8_t net_if)
     NET_RX(rx)->net_if = net_if;
 }
 
+bool bt_mesh_ext_net_rx_get_old_iv(void *rx)
+{
+    return NET_RX(rx)->old_iv;
+}
+
+bool bt_mesh_ext_net_rx_get_sbr_rpl(void *rx)
+{
+    return NET_RX(rx)->sbr_rpl;
+}
+
+void bt_mesh_ext_net_rx_set_sbr_rpl(void *rx, bool sbr_rpl)
+{
+    NET_RX(rx)->sbr_rpl = sbr_rpl;
+}
+
 /* struct bt_mesh_msg_ctx */
 uint16_t bt_mesh_ext_msg_ctx_get_net_idx(void *ctx)
 {
@@ -3674,12 +3735,6 @@ int bt_mesh_ext_client_send_msg(void *param, struct net_buf_simple *msg,
     return bt_mesh_client_send_msg(param, msg, need_ack, VOID(timeout_cb));
 }
 
-/* Bridge Configuration */
-bool bt_mesh_ext_bridge_rpl_check(void *rx, void **match)
-{
-    return bt_mesh_bridge_rpl_check(rx, (struct bt_mesh_rpl **)match);
-}
-
 #if CONFIG_BLE_MESH_BRC_SRV
 struct bt_mesh_subnet_bridge_table {
     uint8_t  bridge_direction;
@@ -3695,6 +3750,8 @@ struct bt_mesh_bridge_cfg_srv {
     uint16_t bridging_table_size;
     struct bt_mesh_subnet_bridge_table bridge_table[CONFIG_BLE_MESH_MAX_BRIDGING_TABLE_ENTRY_COUNT];
 };
+
+static struct bt_mesh_rpl bridge_rpl[CONFIG_BLE_MESH_BRIDGE_CRPL];
 #endif /* CONFIG_BLE_MESH_BRC_SRV */
 
 void *bt_mesh_ext_brc_srv_get_bridge_table_entry(void *srv, uint8_t index)
@@ -3707,6 +3764,16 @@ void *bt_mesh_ext_brc_srv_get_bridge_table_entry(void *srv, uint8_t index)
 #endif /* CONFIG_BLE_MESH_BRC_SRV */
 }
 
+void *bt_mesh_ext_brc_srv_get_bridge_rpl(uint8_t index)
+{
+#if CONFIG_BLE_MESH_BRC_SRV
+    return &bridge_rpl[index];
+#else
+    assert(0);
+    return NULL;
+#endif /* CONFIG_BLE_MESH_BRC_SRV */
+}
+
 /* BTC */
 void bt_mesh_ext_agg_client_cb_evt_to_btc(uint32_t opcode, uint8_t event,
                                           void *model, void *ctx,
@@ -3935,6 +4002,7 @@ typedef struct {
     uint16_t config_ble_mesh_proxy_solic_rx_crpl;
     uint16_t config_ble_mesh_proxy_solic_tx_src_count;
     uint16_t config_ble_mesh_max_bridging_table_entry_count;
+    uint16_t config_ble_mesh_bridge_crpl;
     uint16_t config_ble_mesh_max_disc_table_entry_count;
     uint16_t config_ble_mesh_max_forward_table_entry_count;
     uint16_t config_ble_mesh_max_deps_nodes_per_path;
@@ -4105,6 +4173,7 @@ static const bt_mesh_ext_config_t bt_mesh_ext_cfg = {
 #endif /* CONFIG_BLE_MESH_PROXY_SOLIC_PDU_TX */
 #if CONFIG_BLE_MESH_BRC_SRV
     .config_ble_mesh_max_bridging_table_entry_count = CONFIG_BLE_MESH_MAX_BRIDGING_TABLE_ENTRY_COUNT,
+    .config_ble_mesh_bridge_crpl                    = CONFIG_BLE_MESH_BRIDGE_CRPL,
 #endif /* CONFIG_BLE_MESH_BRC_SRV */
 #if CONFIG_BLE_MESH_DF_SRV
     .config_ble_mesh_max_disc_table_entry_count     = CONFIG_BLE_MESH_MAX_DISC_TABLE_ENTRY_COUNT,
@@ -4328,6 +4397,7 @@ typedef struct {
 
 /* CONFIG_BLE_MESH_LOW_POWER */
     bool (*_bt_mesh_ext_lpn_match)(uint16_t addr);
+    uint16_t (*_bt_mesh_ext_lpn_frnd)(void);
 /* CONFIG_BLE_MESH_LOW_POWER */
 
 /* CONFIG_BLE_MESH_USE_DUPLICATE_SCAN */
@@ -4448,7 +4518,6 @@ typedef struct {
     uint8_t (*_bt_mesh_ext_sub_get_mpb_ivi_last)(void *sub);
     void (*_bt_mesh_ext_sub_set_mpb_ivi_last)(void *sub, uint8_t mpb_ivi_last);
     uint8_t *(*_bt_mesh_ext_sub_get_mpb_random)(void *sub);
-    uint8_t *(*_bt_mesh_ext_sub_get_mpb_random_last)(void *sub);
     uint8_t (*_bt_mesh_ext_sub_get_private_node_id)(void *sub);
     uint8_t *(*_bt_mesh_ext_sub_get_keys_private_beacon)(void *sub, uint8_t index);
 /* CONFIG_BLE_MESH_PRIVATE_BEACON */
@@ -4457,6 +4526,7 @@ typedef struct {
     uint16_t (*_bt_mesh_ext_sub_get_sbr_net_idx)(void *sub);
     void (*_bt_mesh_ext_sub_set_sbr_net_idx)(void *sub, uint16_t sbr_net_idx);
     void *(*_bt_mesh_ext_brc_srv_get_bridge_table_entry)(void *srv, uint8_t index);
+    void *(*_bt_mesh_ext_brc_srv_get_bridge_rpl)(uint8_t index);
 /* CONFIG_BLE_MESH_BRC_SRV */
 
 /* CONFIG_BLE_MESH_AGG_CLI */
@@ -4649,6 +4719,7 @@ static const bt_mesh_ext_funcs_t bt_mesh_ext_func = {
 
 /* CONFIG_BLE_MESH_LOW_POWER */
     ._bt_mesh_ext_lpn_match                             = bt_mesh_ext_lpn_match,
+    ._bt_mesh_ext_lpn_frnd                              = bt_mesh_ext_lpn_frnd,
 /* CONFIG_BLE_MESH_LOW_POWER */
 
 /* CONFIG_BLE_MESH_USE_DUPLICATE_SCAN */
@@ -4770,7 +4841,6 @@ static const bt_mesh_ext_funcs_t bt_mesh_ext_func = {
     ._bt_mesh_ext_sub_get_mpb_ivi_last                  = bt_mesh_ext_sub_get_mpb_ivi_last,
     ._bt_mesh_ext_sub_set_mpb_ivi_last                  = bt_mesh_ext_sub_set_mpb_ivi_last,
     ._bt_mesh_ext_sub_get_mpb_random                    = bt_mesh_ext_sub_get_mpb_random,
-    ._bt_mesh_ext_sub_get_mpb_random_last               = bt_mesh_ext_sub_get_mpb_random_last,
     ._bt_mesh_ext_sub_get_private_node_id               = bt_mesh_ext_sub_get_private_node_id,
     ._bt_mesh_ext_sub_get_keys_private_beacon           = bt_mesh_ext_sub_get_keys_private_beacon,
 /* CONFIG_BLE_MESH_PRIVATE_BEACON */
@@ -4779,6 +4849,7 @@ static const bt_mesh_ext_funcs_t bt_mesh_ext_func = {
     ._bt_mesh_ext_sub_get_sbr_net_idx                   = bt_mesh_ext_sub_get_sbr_net_idx,
     ._bt_mesh_ext_sub_set_sbr_net_idx                   = bt_mesh_ext_sub_set_sbr_net_idx,
     ._bt_mesh_ext_brc_srv_get_bridge_table_entry        = bt_mesh_ext_brc_srv_get_bridge_table_entry,
+    ._bt_mesh_ext_brc_srv_get_bridge_rpl                = bt_mesh_ext_brc_srv_get_bridge_rpl,
 /* CONFIG_BLE_MESH_BRC_SRV */
 
 /* CONFIG_BLE_MESH_AGG_CLI */
diff --git a/components/bt/esp_ble_mesh/v1.1/include/mesh_v1.1/utils.h b/components/bt/esp_ble_mesh/v1.1/include/mesh_v1.1/utils.h
index ab87a87e67..b61bd1cc47 100644
--- a/components/bt/esp_ble_mesh/v1.1/include/mesh_v1.1/utils.h
+++ b/components/bt/esp_ble_mesh/v1.1/include/mesh_v1.1/utils.h
@@ -119,6 +119,11 @@ int bt_mesh_directed_update_dependent_node(void *sub, uint8_t type,
 int bt_mesh_directed_forwarding_ctl_recv(uint8_t ctl_op, void *rx,
                                          struct net_buf_simple *buf);
 
+void bt_mesh_restore_directed_forwarding_state(uint16_t net_idx,
+                                               uint8_t directed_forwarding);
+
+uint8_t bt_mesh_get_and_disable_directed_forwarding_state(void *sub);
+
 int bt_mesh_directed_forwarding_sub_init(void *sub);
 
 int bt_mesh_recovery_directed_forwarding_table(void *sub);
@@ -182,6 +187,8 @@ bool bt_mesh_bridge_change_net_key(void *rx, const uint8_t **enc,
                                    const uint8_t **priv,
                                    uint8_t *nid, uint8_t cred);
 
+int bt_mesh_print_subnet_bridge_table(void);
+
 void bt_mesh_disable_directed_proxy_state(uint16_t net_idx);
 
 void bt_mesh_disable_directed_friend_state(uint16_t net_idx);
diff --git a/components/bt/esp_ble_mesh/v1.1/lib/esp32/libmesh_v1.1.a b/components/bt/esp_ble_mesh/v1.1/lib/esp32/libmesh_v1.1.a
index 4fad457beb..9ee1f915d3 100644
Binary files a/components/bt/esp_ble_mesh/v1.1/lib/esp32/libmesh_v1.1.a and b/components/bt/esp_ble_mesh/v1.1/lib/esp32/libmesh_v1.1.a differ
diff --git a/components/bt/esp_ble_mesh/v1.1/lib/esp32c3/libmesh_v1.1.a b/components/bt/esp_ble_mesh/v1.1/lib/esp32c3/libmesh_v1.1.a
index 532c00ce4b..1af35ab023 100644
Binary files a/components/bt/esp_ble_mesh/v1.1/lib/esp32c3/libmesh_v1.1.a and b/components/bt/esp_ble_mesh/v1.1/lib/esp32c3/libmesh_v1.1.a differ
diff --git a/components/bt/esp_ble_mesh/v1.1/lib/esp32c6/libmesh_v1.1.a b/components/bt/esp_ble_mesh/v1.1/lib/esp32c6/libmesh_v1.1.a
index 532c00ce4b..1af35ab023 100644
Binary files a/components/bt/esp_ble_mesh/v1.1/lib/esp32c6/libmesh_v1.1.a and b/components/bt/esp_ble_mesh/v1.1/lib/esp32c6/libmesh_v1.1.a differ
diff --git a/components/bt/esp_ble_mesh/v1.1/lib/esp32h2/libmesh_v1.1.a b/components/bt/esp_ble_mesh/v1.1/lib/esp32h2/libmesh_v1.1.a
index 532c00ce4b..1af35ab023 100644
Binary files a/components/bt/esp_ble_mesh/v1.1/lib/esp32h2/libmesh_v1.1.a and b/components/bt/esp_ble_mesh/v1.1/lib/esp32h2/libmesh_v1.1.a differ
diff --git a/components/bt/esp_ble_mesh/v1.1/lib/esp32s3/libmesh_v1.1.a b/components/bt/esp_ble_mesh/v1.1/lib/esp32s3/libmesh_v1.1.a
index 4fad457beb..9ee1f915d3 100644
Binary files a/components/bt/esp_ble_mesh/v1.1/lib/esp32s3/libmesh_v1.1.a and b/components/bt/esp_ble_mesh/v1.1/lib/esp32s3/libmesh_v1.1.a differ