Quantum-safe networking labs
Spotlight PQC
Simulated Cisco IOS XE labs in the browser for learning quantum-safe IPsec VPNs. No routers needed.
Quick labs — start here
GRE
A tunnel over a WAN
Short steps: route the WAN, build a GRE tunnel between R1 and R3, send their LANs through it and size the tunnel MTU. The simplest tunnel, before any encryption.
Classic
Build a classic IKEv2 VPN
6 short steps: route the WAN, configure the seven IKEv2/IPsec blocks on R1 and R3, and prove traffic is encrypted.
PQC
Build a post-quantum VPN
7 short steps: an ML-KEM-768 hybrid VPN from scratch, with fragmentation and quantum-safe rekeys.
Classic → PQC
From classic to post-quantum
Start with a classic VPN, then upgrade it step by step: fragmentation, ML-KEM optional, PFS, enforcement.
Negotiation
When the two ends differ
Choose the parameters on each router, predict, and watch the negotiation fail, retry or go half-open — matched to real IOS XE captures.
Full tutorials
Classic VPN
Classic Site-to-Site VPN (IKEv2 + VTI)
Start here: underlay routing, IKEv2 proposal → policy → keyring → profile → IPsec profile → VTI, and proof that traffic is really encrypted.
v3 · 3 routers
Post-Quantum Key Exchange on Cisco Routers
Hands-on reproduction of IPsec Series Part 9: classical → PPK → ML-KEM-768 hybrid, ending with a phased hub-and-spoke migration on R1 / R2 / R3.
Blocks
VPN Block Builder
Build R1 and R3 from the seven configuration blocks, side by side: what each block does, which values must match or mirror, and the IOS each block becomes.
Blocks · earlier version
VPN Building Blocks (Blockly style)
The first blocks prototype: Blockly-style blocks for both peers, lines that turn green when the parameters agree, and predict-first scenarios.
Legacy — known errors
Kept for reference only. These tutorials route the tunnel destination through the tunnel, use invalid esp-256-aes syntax and unnecessary IKEv1 commands, and treat a ping as proof of encryption. Use the tracks above instead.
v2 — 2 routers (WASM engine)
v2IPsec VPN with VTIClassical IKEv2 site-to-site baseline.
v2Quantum-Safe VPN — IKEv2 PPKRFC 8784 Postquantum Preshared Keys.
v2Quantum-Safe VPN — ML-KEMFIPS 203 hybrid key exchange.