Question 1

What is a post-quantum VPN readiness assessment?

Accepted Answer

It is a structured review of your existing VPN estate that produces a verified inventory of gateways and tunnels, a compatibility position for each one against its exact product and software release, a register of blockers including externally controlled peers, and a prioritised migration plan organised into waves. The output is an executable plan and a fixed-scope migration proposal, not a report describing the general state of post-quantum cryptography.

Question 2

Does PQVPN replace our current VPN?

Accepted Answer

No. PQVPN is not a VPN provider and does not sell a tunnelling product. The work starts from the infrastructure you already run and aims to migrate as much of it as possible in place. Replacement is recommended only where a specific device cannot reach the required capability and no overlay or compensating option is acceptable, and in that case the recommendation names the device and the reason.

Question 3

Can proprietary routers and firewalls be migrated?

Accepted Answer

Sometimes, and the answer depends on the exact model, the running software release, the licence and the remote peer rather than on the vendor's name. Some devices need only a configuration change, some need a software upgrade, some need a licence change, some need replacement, and some can be left in place behind an overlay gateway that terminates a migrated tunnel. Establishing which category each device falls into is the core of the assessment.

Question 4

What happens when a gateway does not support post-quantum key establishment?

Accepted Answer

It goes into the blocker register with a named reason and a set of options: upgrade the firmware or software, change the licence, refresh the hardware, terminate an overlay gateway behind the device, apply a compensating control, or defer and track the dependency. Each option is costed against operational impact and timeline so the decision is a business decision with visible trade-offs rather than a technical dead end.

Question 5

Do both tunnel peers need to support the migration?

Accepted Answer

Yes. A tunnel is a negotiated agreement between two endpoints, and a key establishment method that only one side offers will not be selected. This is why a vendor-level statement of support is not sufficient to approve a change: the peer's exact capability matters just as much as your own, and where the peer belongs to another organisation their upgrade timeline becomes part of your plan.

Question 6

Can PQVPN work with partner-controlled tunnels?

Accepted Answer

Yes. PQVPN identifies which tunnels terminate on a peer you do not control, establishes what that peer would need to support the target configuration, and prepares the technical request and test plan your team sends to the counterparty. PQVPN cannot compel a third party to upgrade, so these tunnels are tracked as coordination-dependent and are usually scheduled into later migration waves.

Question 7

Will PQVPN need administrative credentials?

Accepted Answer

Not necessarily. Several delivery models avoid it: your team executes the artifacts PQVPN generates, a runner hosted inside your environment applies them, temporary scoped credentials are issued for a defined change window, or an existing vendor management platform is used. Where credentials are needed the aim is time-bounded and least-privilege access, and PQVPN does not seek permanent unrestricted device credentials.

Question 8

Can our internal team perform the migration?

Accepted Answer

Yes, and the assessment is designed for that outcome. The deliverables include engineering runbooks, change and test plans, rollback procedures and vendor-specific implementation artifacts, all of which are written to be executed by your engineers. You can also deliver the programme jointly with PQVPN, or engage PQVPN to perform the migration. The choice does not change what the assessment produces.

Question 9

Does post-quantum key establishment also provide post-quantum authentication?

Accepted Answer

No, and conflating the two is the most common error in this area. A hybrid or post-quantum key exchange protects the session key against an adversary who records traffic now and decrypts it later with a quantum computer. It does nothing for peer authentication, which still relies on the certificate or preshared key already configured. Post-quantum authentication depends on separate certificate and PKI support and is generally further behind.

Question 10

Can the migration be completed without downtime?

Accepted Answer

Often, but it is not guaranteed and PQVPN does not promise it. Key establishment changes cause a tunnel to renegotiate, and a renegotiation is a production event even when it completes in seconds. Where the environment supports it, canary tunnels, wave sequencing and HA-aware ordering keep the impact within normal maintenance behaviour. Where a device requires a reboot or a software upgrade, an outage window is required and is stated in the plan.

Question 11

How is assessment pricing determined?

Accepted Answer

From the effort the estate actually requires. The drivers are estate size, vendor and platform diversity, topology and routing complexity, the number of externally controlled peers, legacy dependencies, business criticality, compliance and change-control constraints, and the quality of existing documentation. PQVPN does not publish a per-tunnel price, because two estates with the same tunnel count can differ by an order of magnitude in assessment effort.

Question 12

How is migration pricing determined?

Accepted Answer

From the approved migration plan produced by the assessment, which is why migration is quoted after assessment rather than before it. The plan states how many changes are required, on which platforms, in how many waves, under which change-control regime, and how many depend on an external counterparty. Delivery model matters too: a customer-led migration that PQVPN supports costs less than a PQVPN-led one.

Question 13

What information is required to begin?

Accepted Answer

To scope an assessment, approximate figures are enough: rough tunnel and site counts, which vendors and cloud providers are involved, whether external partners terminate tunnels, and what your change-control regime looks like. To perform the assessment, PQVPN needs gateway inventory with exact models and software versions, tunnel configurations, topology and routing information, and cloud VPN configuration exports. Do not send any of that through the public forms on this site.

Question 14

Can PQVPN work in regulated or air-gapped environments?

Accepted Answer

The assessment is designed to work from configuration exports rather than from live access, which suits environments where external connectivity is restricted. Data handling, residency and access arrangements are agreed per engagement before any configuration is transferred. PQVPN does not make specific compliance certification claims on this site; ask directly and you will get an accurate answer about what is and is not currently in place.

Question 15

How are implementation artifacts reviewed?

Accepted Answer

Every artifact that will touch a production device is reviewed by a human engineer before it is staged, regardless of how it was produced. Review covers the intended end state, the diff against current configuration, the rollback path and the test plan. Automation is used to generate and to check artifacts, never to approve them, and nothing is applied to production on the strength of generation alone.

Question 16

How is the live tunnel verified after migration?

Accepted Answer

By confirming what was actually negotiated on the established security association, not by re-reading the configuration that was pushed. Configuration states intent; only the negotiated SA shows the result. Verification captures evidence from both peers where both are reachable, confirms routing and failover behaviour, re-checks after failover because a standby member may differ, and stores the evidence against the change record.

Frequently asked questions

Assessment

Migration

Compatibility

Scope and pricing

Security and access

Technical detail

Still have a question this page does not answer?