Over the first 8 parts of this series we built quantum-safe VPN tunnels on your laptop, using containers. That’s how you learn protocols: in a clean environment where everything is under your control. But running a VPN in a container is not the usual setup in production. At some point the question changes from “does the protocol work?” to “does the platform work?”. This is where we go find out. The hardware The platform I’ve used for this exercise is part of the Cisco 8000 Series Secure Router, specifically the C8235-G2. Three of them, wired back to back, running IOS XE 26.2 with the “advantage” license (which unlocks all crypto features). Why 26.2? Because 26.1 gave you post-quantum key exchange (ML-KEM) and left authentication classical. 26.2 adds ML-DSA signatures for IKEv2, so a site-to-site tunnel can now be quantum-safe end to end. Both pillars in one box. The lab 3 routers, 2 VLANs, 1 hub-and-spoke topology that stays the same for everything that follows: ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │ R1 │ │ R2 │ │ R3 │ │ (Spoke-1) │ │ (Hub/Transit)│ │ (Spoke-2) │ │ │ │ │ │ │ │ Vlan12 │ │ Vlan12 │ │ │ │ 10.0.12.1 │ │ 10.0.12.2 │ │ │ │ │ VLAN 12 │ │ │ │ │ Tw0/0/0 ├──────────┤ Tw0/0/0 │ │ │ │ │ 2.5 Gb │ │ │ │ │ │ │ Vlan23 │ │ Vlan23 │ │ │ │ 10.0.23.1 │ │ 10.0.23.2 │ │ │ │ │ VLAN 23 │ │ │ │ │ Tw0/0/1 ├──────────┤ Tw0/0/0 │ │ │ │ │ 2.5 Gb │ │ └──────────────┘ └──────────────┘ └──────────────┘ R2 sits in the middle as a Layer 3 transit router. The IPsec tunnel runs end to end between R1 and R3, traversing R2 as an intermediate hop to