Post-quantum protection reaches Cloudflare IPsec tunnels
Post-quantum cryptography has covered the bulk of TLS traffic to Cloudflare's network for some time, but site-to-site networking has lagged behind. That gap is closing: Cloudflare has made post-quantum encryption in its IPsec product generally available, using the hybrid ML-KEM draft standard (draft-ietf-ipsecme-ikev2-mlkem) based on FIPS 203.
The move follows Cloudflare's decision to pull its full post-quantum security target forward to 2029, driven by recent advances in quantum computing. With this release, organizations can defend wide-area network (WAN) traffic against harvest-now-decrypt-later attacks using branch connectors they already own — Cloudflare has verified interoperability with both Fortinet FortiOS 7.6.6 and later, and Cisco 8000 Series Secure Routers after version 26.1.1.
WAN-level encryption under a quantum threat
Cloudflare IPsec is a WAN Network-as-a-Service offering that replaces traditional network architectures by connecting data centers, branch offices, and cloud VPCs to Cloudflare's global IP Anycast network. It provides simplified configuration and automatic rerouting to healthy data centers if one becomes unavailable, using encrypted IPsec tunnels for site-to-site WAN traffic, outbound Internet connections, and Cloudflare One SASE platform connectivity.
Harvest-now-decrypt-later attacks — in which adversaries collect encrypted data today and decrypt it after a sufficiently powerful quantum computer exists — motivate the upgrade. ML-KEM (Module-Lattice-Based Key-Encapsulation Mechanism) relies on mathematical problems not known to be solvable by quantum computers. Crucially, ML-KEM runs in software on standard processors; no special hardware or dedicated physical links are needed.
The draft specification applies ML-KEM in hybrid fashion within the IPsec handshake. A classical Diffie-Hellman exchange runs first, its derived key encrypts a second exchange running ML-KEM, and outputs from both are mixed into the session keys that protect IPsec data plane traffic via the Encapsulating Security Payload (ESP) protocol.
Vendor interoperability verified
Cloudflare first tested this implementation in a closed beta against a strongSwan reference implementation. General availability extends that testing to additional vendors:
- Cisco: Cisco 8000 Series Secure Routers from version 26.1.1 can establish post-quantum Cloudflare IPsec tunnels per the draft.
- Fortinet: FortiOS 7.6.6 and later can establish post-quantum tunnels to Cloudflare's global network.
That interoperability matters for cryptography rollouts, which are known to be slow. The IPsec standard for hybrid ML-KEM only arrived in late 2025, roughly four years after the equivalent TLS support — Cloudflare shipped hybrid post-quantum key agreement with TLS in 2022, ahead of NIST's final ML-KEM standardization, because the TLS community rapidly agreed on a single interoperable approach and put it into production.
Why IPsec took longer, and where it still lags
Part of the delay traces back to sustained interest in Quantum Key Distribution (QKD) within the IPsec community, formalized in RFC 8784 in 2020. Cloudflare has argued against QKD as a post-quantum strategy: it requires specialized hardware and a dedicated physical link, which prevents Internet-scale deployment. QKD also lacks authentication, so post-quantum cryptography remains necessary to repel active attackers, and cross-vendor QKD interoperability is rare. The U.S. NSA, Germany's BSI, and the UK's NCSC have all cautioned against relying on QKD alone.
The path toward software-based post-quantum IPsec opened with RFC 9370 in 2023, which permitted running up to seven key exchanges in parallel with classical Diffie-Hellman. But that RFC did not specify which ciphersuites the parallel exchanges should use. In the vacuum, some vendors shipped early RFC 9370 implementations with proprietary ciphersuites — some of which are not NIST-standardized — a form of "ciphersuite bloat" that NIST SP 800-52r2 warns against. The practical consequence: Cloudflare IPsec does not yet interoperate with Palo Alto Networks' RFC 9370-based implementation, because that product predates draft-ietf-ipsecme-ikev2-mlkem.
Authentication remains the next frontier
Draft-ietf-ipsecme-ikev2-mlkem fills the gap in RFC 9370 by specifying hybrid ML-KEM as a parallel key exchange mechanism alongside classical Diffie-Hellman. Cloudflare expects Palo Alto Networks to join the interoperable list as the industry consolidates around this draft.
The standards work is not complete, however. The current draft covers post-quantum encryption only. IPsec still lacks standards for post-quantum authentication, which will be required to stop quantum adversaries from attacking live systems after Q-Day. With the shortened timeline for full readiness, the IPsec community's continued focus on interoperable PQC implementations — rather than QKD niche cases — will determine how quickly that next step arrives.
