Specifying IPSec Security Association PFS and DH Group Parameters

The pfs group command specifies the IPSec SA perfect forward secrecy (PFS) option and Diffie-Hellman prime modulus group that IPSec SA negotiations can use for this profile.

Note: When the client initiates the IPSec negotiation, the router can accept Diffie-Hellman prime modulus groups that are higher than those configured.

For additional information about PFS, see Configuring IPSec.

pfs group

• Use to configure perfect forward secrecy for connections created with this IPSec tunnel configuration profile by assigning a Diffie-Hellman prime modulus group.
• Example

  host1(config-ipsec-tunnel-profile)#pfs group 5

• Use the no version to remove PFS from the profile.
• See pfs group.

Copyright © 2008, Juniper Networks, Inc. All rights reserved. Trademark Notice.