Best Quantum-Safe Gateways for Legacy Applications
Start with FortiGate or a supported Cisco IOS XE platform if your legacy application already crosses a routed site-to-site IPsec boundary. Consider QuSecure QuProtect if you need an overlay or a gateway close to a service that you cannot modify. Consider Quantum Xchange separately if your design specifically needs external key delivery. These solve different problems. Buy the approach that covers the traffic and exposure you actually identified.
This is a documentation-based shortlist. We did not run interoperability tests or measure tunnel performance. In a gateway pair, the new cryptography protects the segment between the peers. The application’s connection to the first gateway and the last hop to the destination keep their existing security properties. Draw both paths before you describe an application as migrated.
Compare the actual security boundary
| Candidate | Approach to evaluate | Evidence required |
|---|---|---|
| FortiGate / FortiOS | Site-to-site IPsec with a documented hybrid key exchange option | Supported releases on both peers and proof of negotiated IKE and child SAs |
| Cisco IOS XE | Hybrid IKEv2 on documented hardware and releases | Exact SKU and release, peer support and enforcement behavior |
| QuSecure QuProtect R3 | Software overlay, sidecar or gateway close to the workload | Deployment diagram, observed handshake and failure behavior on each hop |
| Quantum Xchange Phio TX | External key delivery for a compatible design | Key source, injection point, rotation and integration with the chosen encryptor |
Fortinet and Cisco when you already have an IPsec boundary
Fortinet’s FortiOS 7.6.7 guidance documents additional exchanges for hybrid IKEv2, including ML-KEM. Test the actual release and configuration at both ends. A PQC option for an administrator’s HTTPS session is a separate feature from the capability you want in the application tunnel. Record which algorithms were negotiated and whether the same protection carries through rekeying. Give the acceptance team a test with an incompatible peer and an explicit expected result.
Cisco’s IOS XE documentation for supported 8000 Series Secure Routers covers hybrid IKEv2 with ML-KEM. Do not transfer that capability claim to every Cisco Secure Firewall or router. Cisco also documents an IKEv2 post-quantum preshared key for ASA. Mixing a preshared key into derivation differs from negotiating an ML-KEM exchange. For a mixed fleet, use release-specific evidence on both ends and include HA or standby devices in the check.
QuSecure when an application cannot be modified
QuProtect R3 describes gateway and sidecar deployment options. Ask where sessions terminate and whether the overlay carries the original bytes or acts as a TLS proxy. Those choices affect certificate trust, client identity, logging and who can see the payload. Require the deployment team to mark unprotected segments and explain the controls on the hosts and networks attached to them. Vendor case studies can suggest architectures to evaluate. They cannot establish the negotiated profile or coverage in your network.
Quantum Xchange when the key path is part of the design
The Phio TX Cloud datasheet describes a key delivery architecture. Evaluate that against the proposed encryptor and how it consumes keys. Ask who controls the trust roots and whether the data plane keeps operating if the key service is unavailable. Confirm whether the supplied profile combines key delivery with a post-quantum key exchange, mixes a shared key, or uses a different mechanism. Request an equivalent level of documentation before admitting a Post-Quantum or Thales proposal to the same procurement comparison. A capability claimed for a hardware security module alone says little about the protection of your application traffic.
Make the proof part of the purchase
- List the apps, protocols, ports and peers. Mark where ciphertext could be collected, what stays confidential for years and where the gateway can sit.
- Get a written list of supported protocols, software versions and algorithms. NIST FIPS 203 defines ML-KEM for key establishment. It does not define the application transport or imply a post-quantum certificate signature.
- Capture the negotiated group or collect peer diagnostics for a test session. Record the actual profile in the security association, not merely what was configured as a possible choice. Verify endpoint authentication separately.
- Repeat with mismatched peers, a failover, a rekey and a path with smaller MTU. Check whether a failure is visible and whether any fallback is allowed by policy. Measure establishment, throughput and recovery on representative flows.
- Review application behavior and residual exposure. Include identity propagation, client certificate requirements and where data is decrypted. Get a price for both ends, HA, support and rollout effort.
For an inventory with many applications, require a route-level coverage report with exclusions. A branch that reaches the service through a public hostname or a backup network might bypass the new path. Put one representative bypass test in the acceptance suite and name the team that will maintain the report after routing changes.
Use our cryptographic inventory guide, PQC migration checklist and migration plan template to track the work. For separate decisions, see checking TLS and post-quantum VPNs.
FAQ
Can a gateway protect a legacy app with no changes to the app?
It can protect a network segment without changing application code if both peers support the chosen protocol. Check the local legs and the application’s identity and trust requirements separately.
Does hybrid ML-KEM mean authentication is post-quantum too?
No. Hybrid key establishment and authentication serve different functions. Ask how each peer proves its identity and what signs the relevant certificates or exchange.
What happens with a peer that supports only classical exchange?
It depends on configuration and implementation. Test that a strict profile rejects the peer, or that any allowed fallback is observable and covered by the migration plan.
Does a successful ping prove a tunnel uses PQC?
No. It proves reachability. Check the negotiated profile on both peers and ensure the application’s actual traffic traverses that tunnel.