When should the various Android VPN service APIs be called?

Note — This answer for the VPN Services only

When the framework triggers the startConnection() API, which your client will handle as part of the knoxvpnservice interface, the VPN Client should prepare for the VPN connection by executing the following APIs present in either Android VPN service or generic VPN service: prepare(), protect(), establish()