# The Honest Migration Playbook - IPsec Series, Part 11

DevFeed: [The Honest Migration Playbook - IPsec Series, Part 11](<https://devfeed.tech/articles/the-honest-migration-playbook-ipsec-series-part-11-17428.md>)

Original publisher: [Read original article](<https://blogs.cisco.com/developer/the-honest-migration-playbook-ipsec-series-part-11>)

Author: Julio Gomez

Published: 2026-09-14T19:41:59Z

Content type: article

Language: en

Sources: [Cisco Blogs](<https://devfeed.tech/sources/cisco-blogs.md>)

Topics: [migration](<https://devfeed.tech/topics/migration.md>), [Post-Quantum](<https://devfeed.tech/topics/post-quantum.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Networks](<https://devfeed.tech/topics/networks.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [cisco](<https://devfeed.tech/tags/cisco.md>), [developer](<https://devfeed.tech/tags/developer.md>), [migration](<https://devfeed.tech/tags/migration.md>), [networks](<https://devfeed.tech/tags/networks.md>), [post](<https://devfeed.tech/tags/post.md>), [post-quantum](<https://devfeed.tech/tags/post-quantum.md>), [post-quantum-authentication](<https://devfeed.tech/tags/post-quantum-authentication.md>), [post-quantum-cryptography-pqc](<https://devfeed.tech/tags/post-quantum-cryptography-pqc.md>), [rsa](<https://devfeed.tech/tags/rsa.md>), [series](<https://devfeed.tech/tags/series.md>)

## AI overview

This article presents an operational playbook for migrating authentication in a live multi-router IPsec network from RSA certificates to ML-DSA. It contrasts authentication with key exchange, explains a mixed hub-and-spoke deployment using ML-KEM-768, and reports that changing signature algorithms cannot be performed without tunnel disruption.

## Source excerpt

The final post in the IPsec series: a fully quantum-safe tunnel on Cisco 8000 routers, both pillars live on real hardware. Part 11 closes the arc with the migration playbook and what a healthy post-quantum tunnel actually looks like.