Post-Quantum Key Exchange on Cisco Routers – IPsec Series, Part 9

Over the first 8 parts of this series we built quantum-safe VPN tunnels on your laptop, using containers. That’s how you learn protocols: in a clean environment where everything is under your control.

But running a VPN in a container is not the usual setup in production. At some point the question changes from “does the protocol work?” to “does theplatformwork?”. This is where we go find out.

The hardware

The platform I’ve used for this exercise is part of theCisco 8000 Series Secure Router, specifically the C8235-G2. Three of them, wired back to back, runningIOS XE 26.2with the “advantage” license (which unlocks all crypto features).

Why 26.2? Because 26.1 gave you post-quantumkey exchange(ML-KEM) and left authentication classical.26.2 adds ML-DSA signatures for IKEv2, so a site-to-site tunnel can now be quantum-safe end to end. Both pillars in one box.

The lab

3 routers, 2 VLANs, 1 hub-and-spoke topology that stays the same for everything that follows:

    ┌──────────────┐          ┌──────────────┐          ┌──────────────┐
    │      R1      │          │      R2      │          │      R3      │
    │   (Spoke-1)  │          │ (Hub/Transit)│          │   (Spoke-2)  │
    │              │          │              │          │              │
    │  Vlan12      │          │  Vlan12      │          │              │
    │  10.0.12.1   │          │  10.0.12.2   │          │              │
    │              │  VLAN 12 │              │          │              │
    │      Tw0/0/0 ├──────────┤ Tw0/0/0      │          │              │
    │              │  2.5 Gb  │              │          │              │
    │              │          │  Vlan23      │          │  Vlan23      │
    │              │          │  10.0.23.1   │          │  10.0.23.2   │
    │              │          │              │  VLAN 23 │              │
    │              │          │      Tw0/0/1 ├──────────┤ Tw0/0/0      │
    │              │          │              │  2.5 Gb  │              │
    └──────────────┘          └──────────────┘          └──────────────┘

R2 sits in the middle as a Layer 3 transit router. The IPsec tunnel runs end to end between R1 and R3, traversing R2 as an intermediate hop to emulate a real WAN where crypto endpoints are not directly connected.

Later, when we test phased migration, R2 becomes a VPN hub terminating tunnels to both spokes. Same 3 boxes, different role for the one in the middle.