IPSEC Tunnel PFS Groups need to match?

[CiscoBrownBelt]

In regards to IPSEC tunnels, is it best to match PFS groups on the peer devices?

[Rob Ingram · Accepted solution]

Hi,
Yes, all attributes must match/mirror each other on the devices when establishing a VPN.
PFS is also optional.

HTH

[CiscoBrownBelt]

Tunnel is up with different PFS groups, however not sure if it causes problems.

[Rob Ingram]

Hmmm, can you provide the output of "show crypto ipsec sa detail" from both devices?

[desktopAdmin]

I had an issue with mismatched PFS settings yesterday......here's what happened in my case. Phase 1 and phase 2 completed and the tunnel was up. However, only the first device trying to send traffic through the tunnel was able to communicate. Communication from all other devices failed. It didn't matter which device was the first to initiate traffic, the device that initiated traffic was the only one that could communicate through the tunnel.......communication from all other devices would fail.

[Karsten Iwen · Accepted solution]

As RJI mentions, it should match/mirror on both sides. But it does not have to.

• If the initiator does not have PFS configured or a smaller group than the responder, the connection will fail.
• If the initiator has a group configured but the responder does not, or the responder has a smaller group configured, then the PFS-group of the initiator is used.

That means the PFS group is negotiated, but only to the minimum that is configured on the responder side.