Post-Quantum Readiness¶
Overview¶
Post-Quantum Readiness provides fleet-wide visibility into post-quantum cryptography (PQC) support and usage across your BIG-IP devices and virtual servers.
Use this page to understand:
- Which BIG-IP devices run software that supports PQC.
- Which virtual servers have Client SSL profiles configured for PQC.
- Where PQC key exchange has been observed in client connections.
- Where software support, configuration, traffic volume, or unavailable data affects the assessment.
Post-Quantum Readiness is a read-only assessment. F5 Insight doesn’t modify BIG-IP configuration or automatically migrate applications to PQC.
Note
Device support, virtual server configuration, and observed client usage are separate measurements. A device running a PQC-supported version doesn’t necessarily have PQC configured, and a configured virtual server doesn’t necessarily negotiate PQC with its clients.
About post-quantum cryptography¶
Post-quantum cryptography is designed to protect against attacks by sufficiently capable quantum computers.
For TLS connections, hybrid post-quantum key exchange combines a classical key exchange mechanism with a post-quantum mechanism, such as ML-KEM. Whether a connection uses hybrid key exchange depends on both the BIG-IP configuration and the capabilities of the connecting client.
F5 Insight distinguishes between configuration readiness and observed usage so that you can assess both deployment progress and client adoption.
Important
Post-Quantum Readiness assesses the client-facing TLS posture covered by this feature. It is not a certification of application security, regulatory compliance, or end-to-end post-quantum protection.
Before you begin¶
Make sure that:
- Your BIG-IP devices are onboarded to F5 Insight.
- Your F5 Insight account has permission to view the relevant fleet inventory.
- F5 Insight can collect Client SSL profile configuration and supported handshake statistics from the devices.
- Device collection credentials have the required read-only permissions.
F5 Insight uses iControl REST and tmsh to collect configuration and statistics. This feature doesn’t require iRule instrumentation.
Post-quantum cryptography (PQC) capability depends on the BIG-IP software version and effective Client SSL profile configuration. Refer to the applicable BIG-IP release documentation when confirming support.
Review the Post-Quantum Readiness report card¶
The Post-Quantum Readiness card appears in the Security section of the F5 Insight Home page. It summarizes Client SSL profile configuration for the selected data center, or for the fleet when All is selected.
The card shows a status, a short explanation, and when the summary was last updated. Select View Details to open the Post-Quantum Readiness page. If a data center is selected, the details page opens with that data center selected.
| Card status | When it appears |
|---|---|
| Critical | All device versions are below BIG-IP version 17.5.1. |
| Needs Attention | One or more assessed Client SSL profiles have TLS 1.3 disabled or PQC not configured. |
| Good | PQC is configured and TLS 1.3 is enabled on every evaluated Client SSL profile. |
| N/A | No eligible Client SSL profiles are available, or the profile configuration data is incomplete. |
Open Post-Quantum Readiness¶
Navigate to BIG-IP Fleet > PQC Readiness to view the Post-Quantum Readiness details.
You can also open the page from the Post-Quantum Readiness report card on the F5 Insight Home page.
Review the readiness summary¶
The page displays three summary panels.
Review the Post-Quantum Readiness panel¶
This panel provides a summary of:
| Metric | Description |
|---|---|
| Virtual servers with PQC observed | Percentage of assessed virtual servers on which PQC negotiation has been observed. |
| Devices supported | Percentage of assessed devices running a PQC-supported software version. |
Interpret these measurements together. High device support with low observed usage can indicate that configuration or client adoption still requires attention.
Review virtual servers with post-quantum encryption¶
This chart groups virtual servers by the observed PQC usage associated with their Client SSL profiles.
| Category | Description |
|---|---|
| PQC observed on all profiles | PQC negotiation has been observed for all assessed Client SSL profiles associated with the virtual server. |
| PQC observed on some profiles | PQC negotiation has been observed for some, but not all, assessed Client SSL profiles. |
| No PQC observed | PQC negotiation has not been observed in the available assessment data. |
Note
“PQC observed on all profiles” doesn’t mean that every client connection uses PQC. It describes observation across profiles, not the percentage of individual handshakes.
Review devices with PQC-supported versions¶
This chart groups devices by software support.
| Device status | Description |
|---|---|
| Supported | The device runs a software version identified as supporting PQC. |
| Needs upgrade | The device requires a PQC-supported software version. |
| Unknown | F5 Insight can’t determine the device’s PQC software support from the available data. |
A Supported device can still host virtual servers that require configuration changes.
Review the virtual server inventory¶
Use the inventory table to examine the devices and Client SSL profiles associated with each virtual server.
| Column | Description |
|---|---|
| Virtual Server | Name and partition path of the virtual server. |
| Client SSL Profile | Client SSL profile associated with the assessment. |
| Device | BIG-IP device hosting the virtual server. |
| Device Status | Whether the device software supports PQC. |
| PQC Status | Assessment of PQC configuration or observed usage. |
| Reason | Explanation of the reported status, when available. |
For example, a virtual server can have a device status of Supported and a PQC status of Needs configuration change, with a reason such as PQC not configured or TLS 1.3 disabled.
PQC status reference¶
| PQC status | How to interpret it |
|---|---|
| In use | PQC negotiation has been observed in the collected traffic statistics. |
| Not in use | PQC negotiation has not been observed despite sufficient data for an assessment. |
| Needs upgrade | A software upgrade is required for PQC support. |
| Needs configuration change | The current configuration doesn’t meet the requirements for PQC negotiation. Review the Reason column. |
| Not enough traffic | Available traffic is insufficient to determine PQC usage reliably. |
| Data unavailable | Required configuration or statistics couldn’t be obtained. |
Important
Not enough traffic and Data unavailable are assessment limitations. Don’t interpret them as confirmation that a virtual server is classical-only.
Find virtual servers that need attention¶
- Select a Data Center, or select All to view the fleet.
- Use Device Status to filter by:
- Supported
- Needs upgrade
- Unknown
- Use PQC Status to narrow the inventory to the assessment states you want to review.
- Search by virtual server, Client SSL profile, or device name.
- Review the Reason column for each matching entry.
For a configuration review, filter for Supported devices and Needs configuration change PQC status.
To examine adoption after enabling PQC, review entries marked In use, Not in use, or Not enough traffic.
F5 Insight identifies posture and observation gaps. It doesn’t provide an automated remediation workflow.
Note
The dashboard shows enabled virtual servers with attached Client SSL profiles. Disabled virtual servers aren’t shown.
Refresh and download inventory data¶
Select Refresh to refresh the page view.
Select Download CSV to download inventory data for offline review.
Important
A CSV inventory download is not a cryptographic bill of materials (CBOM) or a compliance certification.
Understand collection timing¶
F5 Insight periodically collects Client SSL profile configuration at each device’s configured collection interval, which is 60 seconds by default. Handshake statistics are collected every five minutes by default.
For Post-Quantum Readiness, if a device’s collection interval is longer than five minutes, that longer interval is used when assessing its data.
Post-Quantum Readiness checks configuration data from the most recent collection cycle. For handshake statistics, it checks two collection cycles with a one-minute buffer to account for collection timing variations.
With the default settings, this means the report uses:
- Configuration data from the last six minutes (one collection cycle plus the one-minute buffer)
- Handshake statistics from the last 11 minutes (two collection cycles plus the one-minute buffer)
For a device with a 10-minute collection interval, those periods become 11 minutes and 21 minutes, respectively.
Data older than the relevant assessment period isn’t included. If there isn’t enough recent traffic, or required data is unavailable, the status may be Not enough traffic or Data unavailable.
Data collection and privacy¶
Post-Quantum Readiness collects Client SSL profile configuration and aggregated handshake counts.
Post-Quantum Readiness doesn’t collect:
- Client source IP addresses
- JA3 or JA4 TLS fingerprints
- Session identifiers
- Certificate serial numbers
Collection is read-only and follows existing F5 Insight access controls.
Known limitations¶
This release focuses on customer awareness of client-facing PQC posture. It doesn’t include:
- Server-side TLS posture for backend pools
- Performance or latency modeling
- Automated configuration changes
- Migration recommendations
- Harvest-now, decrypt-later (HNDL) risk classification — assessing the risk that encrypted data captured today could be decrypted by future quantum computers
- CBOM export or dedicated compliance reporting artifacts
- Deep analysis of TLS 1.2 and earlier
Observed PQC usage applies to the available collection window. It doesn’t guarantee that all current or future connections negotiate PQC.
Note
Post-Quantum Readiness is available through the web console only. REST API access is planned for a future release.