Cisco Demonstrates Quantum-Safe VPN Tunnels on Its Routers

Cisco has been working on making its routers quantum-safe by implementing post-quantum key exchange (PQKE) protocols. In the ninth part of a series, they demonstrate how to set up a VPN tunnel on Cisco's 8000 Series Secure Router using IOS XE 26.2 with native support for ML-KEM hybrid key exchange.

The setup involves three routers: R1, R2, and R3, connected in a hub-and-spoke topology. The authors start by configuring the tunnel between R1 and R3 using IKEv2 with classical encryption and authentication. They then add a Postquantum Preshared Key (PPK) to the keyring on both R1 and R3, which is used to protect the key derivation against quantum attacks.

Finally, they remove the PPK and configure native ML-KEM hybrid key exchange using two lines of code. The resulting configuration uses a combination of classical DH exchange and quantum-safe encryption, providing protection against future quantum computers.