Troubleshoot Post-Quantum Cryptography VPN Issues
Resolve common configuration and connectivity issues with Post-Quantum Cryptography
VPN tunnels.
| Where Can I Use This? | What Do I Need? |
|---|
- Prisma SD-WAN (Managed by Strata Cloud Manager)
|
- Prisma SD-WAN
- ION device software version 6.8.1 or later
|
Use this topic to resolve common issues when configuring or operating Post-Quantum
Cryptography (PQC) VPN tunnels on Prisma SD-WAN ION devices.
PPK Secret Validation Errors
Issue: You receive a validation error when entering the PPK Secret during
IPsec profile configuration.
Cause: The PPK Secret does not meet the required format or length
constraints.
Solution: Verify the PPK Secret meets all requirements:
- Uses only hexadecimal characters (0-9, A-F)
- Length is between 64 and 256 characters (32-128 bytes)
- Length is a multiple of 16 characters (8-byte increments)
- No spaces or special characters other than valid hexadecimal digits
If you click
Generate to create a PPK Secret automatically,
the system generates a compliant secret that meets all validation requirements. For
detailed PPK Secret configuration requirements and security recommendations, see
Create an IPsec Profile.
Tunnel Fails to Establish with PQC Enabled
Issue: The Standard VPN tunnel does not establish after you enable
Post-Quantum Cryptography features.
Cause: Configuration mismatch between VPN peers or incompatible settings.
Solution: Verify the following settings on both VPN peers:
- Both peers use IKEv2 (Post-Quantum Cryptography is not supported with
IKEv1).
- The PPK KeyID matches exactly on both peers (case-sensitive).
- The PPK Secret is identical on both peers (verify there are no copy-paste
errors).
- At least one ML-KEM algorithm is common between peers in each configured
Additional Key Exchange round.
- FIPS mode is disabled on both peers (PQC invalidates FIPS 140-3 and Common
Criteria certifications).
- The remote peer runs PAN-OS 11.1 or later (for Palo Alto Networks firewall
peers) or supports RFC 8784, RFC 9370, and RFC 9242 (for third-party
peers).
Use the dump servicelink status command to view tunnel status and
verify negotiated algorithms. If the tunnel is not establishing, check the PPK mode
and PPK Key ID values in the output to confirm they match your configuration.
Cannot Enable Post-Quantum Key Exchange Option
Issue: The Additional Key Exchanges option is grayed
out or unavailable during IPsec profile configuration.
Cause: Post-Quantum Key Exchange requires IKEv2 and is not available when
IKEv1 is selected.
Solution:
- Verify the Key Exchange field is set to
IKEv2 (not IKEv1 Main or Aggressive mode).
- Verify the ION device is running software version 6.8.1 or later.
- If you require IKEv1 for compatibility with legacy VPN peers, you cannot use
Post-Quantum Cryptography features. Consider upgrading the remote peer to
support IKEv2.
FIPS Mode Conflicts with PQC
Issue: You cannot enable Post-Quantum Cryptography features because FIPS mode
is enabled, or you cannot enable FIPS mode because PQC features are
configured.
Cause: Post-Quantum Cryptography support in release 6.8.1 invalidates FIPS
140-3 and Common Criteria certifications because the cryptographic libraries used
for PQC are not yet FIPS-validated.
Solution:
- If you require FIPS or FIPS-CC compliance, you must disable FIPS mode before
enabling PQC features.
- If you require both FIPS compliance and quantum resistance, you must choose one
or the other—FIPS mode and PQC cannot be enabled simultaneously in release
6.8.1.
- For more information about FIPS impact, see FIPS and FIPS-CC Security.
Downgrade Fails with PQC Configured
Issue: You cannot downgrade the ION device to a software version earlier than
6.8.1.
Cause: The device has Post-Quantum Cryptography features configured (PPK or
Additional Key Exchanges in IPsec profiles, or Standard VPN interfaces using
PQC-enabled profiles).
Solution: Before downgrading, you must remove all PQC configuration:
- Remove all Standard VPN interfaces that reference PQC-enabled IPsec
profiles.
- Edit or delete all IPsec profiles that have PPK (Post-Quantum Pre-shared Key) or
Additional Key Exchanges configured.
- Verify the configuration is committed successfully.
- Proceed with the downgrade operation.
Algorithm Negotiation Failures
Issue: The VPN tunnel establishes but PQC algorithms are not being used, or
the tunnel fails during IKE negotiation.
Cause: The VPN peers do not have at least one common algorithm in each
Additional Key Exchange round, or the remote peer does not support the selected PQC
algorithms.
Solution:
- Verify both peers have at least one common ML-KEM algorithm (ML-KEM-512,
ML-KEM-768, or ML-KEM-1024) in each Additional Key Exchange round you
configure.
- If the remote peer does not support PQC algorithms, you can select classical
algorithms (MODP-1024, MODP-1536, MODP-2048, ECP-256, ECP-384) or
None for specific rounds to maintain
compatibility.
- For PPK, configure the PPK mode to Preferred instead of
Mandatory to allow fallback to standard IKEv2 if the
remote peer does not support PPK or the PPK KeyID does not match.
- Use dump servicelink status to view the negotiated IKE and
IPsec algorithms and confirm which algorithms were selected during
negotiation.
Verify PQC Configuration and Status
Use CLI commands to verify your Post-Quantum Cryptography configuration and confirm
active tunnels use quantum-resistant algorithms. For command syntax and detailed
output field descriptions, see the
ION CLI Reference.
