Which Part of a Network Is Actually Quantum-Resilient?

The label covers several systems

AT&T and Palo Alto Networks announced a Quantum-Resilient SASE Fabric on July 16, 2026. Their account reaches across management traffic, data tunnels, telemetry, branch hardware, multiple underlays and automated policy distribution. That breadth is useful because a network does not become quantum-safe in one place. It also makes the phrase quantum-resilient network harder to interpret. A product name can describe an architecture while leaving deployment state, algorithm choice, fallback behavior and covered traffic to the customer’s configuration.

The cited protocols have defined jobs

The announcement points to IETF RFC 9370, RFC 9242 and RFC 8784. These standards describe mechanisms within IKEv2: multiple key exchanges, an intermediate exchange before IKE authentication that can carry larger payloads, and the mixing of preshared keys for post-quantum security. The intermediate exchange permits IKE-level fragmentation, which can avoid problematic IP fragmentation. These mechanisms support important migration designs. They do not, by themselves, show which algorithms were negotiated on a particular circuit or prove that every control, data and telemetry path received the same protection. TLS 1.3 is also a protocol framework; calling traffic TLS 1.3 does not identify a post-quantum key exchange.

Operations decide what the label means

The useful unit is a live path from endpoint to endpoint, including the branch device, tunnel negotiation, classical fallback, management plane, software version and supplier handoff. Post-quantum network migration therefore connects engineering, procurement, regulated outsourcing and public trust. Hospitals, payment systems and public services depend on networks whose security claims must survive failover, upgrades and mixed infrastructure. The strongest reading of the launch is architectural: major connectivity vendors are preparing PQC controls for ordinary network operations. The unresolved part is observational: what each deployed path negotiates under normal and degraded conditions.