Cisco Secure Networking Building Resilient Infrastructure

Sumant Mali and Mike Ketabforoosh of Cisco explained how Cisco is building resilient infrastructure for the AI and quantum era. Mali covered post-quantum cryptography across IPsec, SD-WAN, MACsec, and secure boot, including hybrid key exchange and live demos. Ketabforoosh introduced Live Protect, which uses eBPF-based shields to block exploits of known vulnerabilities until customers can patch. Both presented as part of Cisco’s appearance at Networking Field Day 41.

Mali explained that AES-256 remains safe, but public key exchange is exposed to harvest-now, decrypt-later attacks, and authentication and secure boot face real-time quantum risk. CNSA 2.0 will require ML-KEM, ML-DSA, and LMS for national security systems after January 2027. Cisco’s answer is hybrid key exchange under RFC 9370, which layers ML-KEM on top of a classical exchange. An “optional” keyword lets it fall back to classical cryptography, which supports a phased migration. In IOS XE 26.1 and 26.2, enabling it takes one CLI line for IPsec or three clicks for SD-WAN. SD-WAN now moves key exchange to IKEv2 and protects its control plane with TLS 1.3 and ML-KEM. Bringing up 15,000 FlexVPN tunnels takes about 21 minutes instead of 20. Mali showed interoperability with Cloudflare’s IPsec gateway and, for the first time in public, quantum-safe secure boot on the 8600 using LMS and ML-DSA signatures.

Mali advised customers to inventory their cryptography, classify long-lived data, and start with the WAN. Ketabforoosh said the time to exploit has shrunk from 2.3 years in 2018 to roughly 20 hours in 2026. Live Protect is built on the Tetragon agent from Cisco’s 2024 Isovalent acquisition and places eBPF programs in kernel hooks without changing binaries. PSIRT triages vulnerabilities, Talos builds the shields, and product teams test them. Shields run in monitor or enforce mode and are supported for six months, and Cisco currently recommends running no more than ten at once. Ketabforoosh stressed that a shield is not a substitute for patching. A demo showed a shield for last week’s SD-WAN control component API authentication flaw shipping alongside the fix. A delegate pointed out that monitor mode doesn’t stop a breach, while an operator in the room said Live Protect eases the race against a 20-hour exploit window on Cisco gear.