topic hi, in Network Security

Perfect Forward Secrecy (PFS)

Santhosh PS — Tue, 12 Mar 2019 08:38:10 GMT

Hi,

In router for the PFS, default group is 1.. How about in ASA firewall, which group is default for the PFS.

John Forester — Tue, 13 Dec 2016 19:14:17 GMT

Hi Santhosh,

The ASA uses PFS as an optional command - I do not believe there is a default.

You can type "show run all" to see all hidden and default commands on the ASA

Here is a link about IPSEC

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/119141-configure-asa-00.html

johnlloyd_13 — Wed, 14 Dec 2016 02:28:28 GMT

hi,

PFS in ASA (for IKE phase 2) is disabled by default.

you just manually choose which DH group to use for PFS.

Santhosh PS — Wed, 14 Dec 2016 06:49:21 GMT

PFS uses DH policy of 1,2,5.. Just wanted to know, If we give just set pfs, which default DH policy it will take up.