---
title: IPsec downgrade protection (beta)
description: Cloudflare IPsec now supports the IKE_SA_INIT_FULL_TRANSCRIPT_AUTH extension to prevent quantum downgrade attacks on IKEv2 tunnels.
image: https://edgetunnel-b2h.pages.dev/changelog-preview.png
---

> Documentation Index  
> Fetch the complete documentation index at: https://edgetunnel-b2h.pages.dev/changelog/llms.txt  
> Use this file to discover all available pages before exploring further. 

[Skip to content](#%5Ftop) 

# Changelog

New updates and improvements at Cloudflare.

[ Subscribe to RSS ](https://edgetunnel-b2h.pages.dev/changelog/rss/index.xml) [ View RSS feeds ](https://edgetunnel-b2h.pages.dev/fundamentals/new-features/available-rss-feeds/) 

![hero image](https://edgetunnel-b2h.pages.dev/_astro/hero.CVYJHPAd_26AMqX.svg) 

[ ← Back to all posts ](https://edgetunnel-b2h.pages.dev/changelog/) 

## IPsec downgrade protection (beta)

Jul 08, 2026 

[ Cloudflare One ](https://edgetunnel-b2h.pages.dev/cloudflare-one/)[ Cloudflare WAN ](https://edgetunnel-b2h.pages.dev/cloudflare-wan/) 

Cloudflare IPsec now supports the [IKE\_SA\_INIT\_FULL\_TRANSCRIPT\_AUTH ↗](https://datatracker.ietf.org/doc/draft-ietf-ipsecme-ikev2-downgrade-prevention/) IKEv2 extension to protect against downgrade attacks on IPsec tunnels.

IKEv2's original authentication design has each endpoint sign only its own outbound messages, not the full handshake transcript. A quantum-capable [on-path attacker ↗](https://www.cloudflare.com/learning/security/threats/on-path-attack/) can exploit this to bypass post-quantum key exchange by downgrading the connection to classical cryptography. The `IKE_SA_INIT_FULL_TRANSCRIPT_AUTH` extension addresses this by having both peers sign the entire handshake transcript during the authentication exchange, preventing an attacker from manipulating the negotiation without detection.

Key details:

* Available in beta for Cloudflare WAN and Magic Transit IPsec tunnels.
* Cloudflare sends the `IKE_SA_INIT_FULL_TRANSCRIPT_AUTH` notification unconditionally as a responder when the feature flag is enabled.
* Both the initiator (your device) and responder (Cloudflare) must support the extension for downgrade protection to be effective.
* This feature is currently gated by a per-account feature flag. Contact your account team to turn it on.

Refer to [Downgrade protection](https://edgetunnel-b2h.pages.dev/cloudflare-wan/reference/gre-ipsec-tunnels/#improved-downgrade-protection-beta) for more details.

```json
{"@context":"https://schema.org","@type":"BlogPosting","@id":"https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-08-ipsec-downgrade-protection/#page","headline":"IPsec downgrade protection (beta) · Changelog","description":"Cloudflare IPsec now supports the IKE\\_SA\\_INIT\\_FULL\\_TRANSCRIPT\\_AUTH extension to prevent quantum downgrade attacks on IKEv2 tunnels.","url":"https://edgetunnel-b2h.pages.dev/changelog/post/2026-07-08-ipsec-downgrade-protection/","inLanguage":"en","image":"https://edgetunnel-b2h.pages.dev/changelog-preview.png","dateModified":"2026-07-08","datePublished":"2026-07-08","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://edgetunnel-b2h.pages.dev/#website","name":"Cloudflare Docs","url":"https://edgetunnel-b2h.pages.dev/"}}
```