Connection migration in mobile systems is to support continuous and transparent communication operations between mobile agents. This paper presents a reliable connection migration mechanism that provides exactly-once delivery for all transmitted data during agent migration. It integrates with an agent-based access control mechanism that controls the access to network ports. To avoid frequent agent authentication and permission checking due to agent migration, a secret session key is associated with each connection. We present the design and implementation of the mechanism, named NapletSocket in Naplet mobile agent system. It is a pure middleware implementation, requiring no modification of Java virtual machines. Evaluation results show that the NapletSocket system incurs a moderate overhead in connection setup, mainly due to security checking. Once a secure connection is established, only a marginal cost is needed to pay for reliable communication during agent migration.