The Honest Migration Playbook – IPsec Series, Part 11

Cisco documents a phased migration strategy for IPsec authentication from RSA to ML-DSA on IOS XE 26.2. The post details operational constraints where key exchange supports fallback but authentication requires a single method. It provides configuration examples for a hub-and-spoke topology mixing classical and post-quantum signatures, highlighting specific gotchas encountered during the transition.